Security Mechanisms: Cryptography, Authentication, and More

Topic 7: Security Mechanism

• Security mechanism is a specific method, technique, or tool for protecting a computer system or network from cyber threats and attacks.

Learning Objectives

• Cryptography involves encryption concepts and operations
• Authentication covers security services like authentication, authorization, and accountability
• Data Security focuses on safeguarding data using tools and systems
• Risk Management includes identifying, assessing, and controlling risks

Definition of Security Mechanism

• A security mechanism protects a computer system and network for digital data from cyber threats and attacks, using specific methods, techniques, or tools.

Goals of Security Mechanism

• To maintain confidentiality, data is accessible only to authorized persons
• To maintain integrity, data must remain unaltered
• To maintain availability, data must be reliable in a timely manner and uninterrupted.

7.1 Cryptography

• Cryptology is the science of making and breaking secret codes.
• Cryptography is the art of protecting information so only the intended recipient can read or process it.

7.1.1 Encryption: Concepts and Operations

• Encryption is the process of transforming plaintext to ciphertext
• Decryption is the process of transforming ciphertext to plaintext.

Terminology used in Cryptography

• Plaintext: The original message, or clear text data or readable format data.
• Ciphertext: The encrypted message, or meaningless text data or non-readable format data
• Cryptanalysis: The study of secret code systems to obtain information
• Cryptosystem: The set of specific algorithm
• Algorithm: a set of instructions designed to perform a specific task, called cipher
• Key: The string of characters used within an encryption algorithm

7.1.2 Encryption Types

• Techniques include Symmetric and Asymmetric methods

Symmetric Encryption

• The same pre-shared key is used to encrypt and decrypt data.
• Process:
  • The sender creates a ciphertext message by encrypting the plaintext message with a symmetric encryption algorithm and a shared key
  • The sender sends the ciphertext message to the recipient
  • The recipient decrypts the ciphertext message back into plaintext with a shared key

Asymmetric Encryption

• Different keys are used to encrypt and decrypt data
• Process:
  • The sender creates a ciphertext message by encrypting the plaintext message with an asymmetric encryption algorithm and the recipient's public key.
  • The sender sends the ciphertext message to the recipient
  • The recipient decrypts the ciphertext message back into plaintext using the private key that corresponds to the public key

Methods of creating ciphertext

• Includes Substitution Cipher and Transposition Cipher

Substitution Cipher

• Letters are replaced by another letter to create ciphertext, applying a technique shift of key
• Easy to perform, but easily broken

Caesar Cipher technique shift of 3 example

• Plaintext: POCKET ROCKET MAN
• Ciphertext: SRFNHW URFNHW PDQ

Caesar Cipher technique shift of 4 example

• Ciphertext: VEHMS WTIGXVYQ MR JVIUYIRGC
• Ciphertext: radio spectrum in frequency

Transposition Cipher

• Letters are rearranged to create a ciphertext
• Plaintext is arranged in a number of columns
• Provides secure encryption when using a keyword

Single Transposition Cipher (Columnar Transposition Cipher)

• The number of columns is defined by the keyword
• × character for vacant slot

Single Transposition Cipher Steps

• Build the column by defining the number of keyword's character
• Set index order based on alphabetical
• Insert the plaintext into column by row, from left to right
• Extract the ciphertext column by column, start from column no.1 until complete

Single Transposition Cipher Example

• Plaintext: POCKET ROCKET MAN
• Keyword: TRACKS
• Ciphertext: CCN KKX EEX OOA TTX PRM

Double Transposition Cipher

• Transposes the column twice
• Runs the ciphertext from a single transposition algorithm for more difficult ciphertext.

Double Transposition Cipher Steps

• Ensure the built table and index order are the same
• Insert the single transposition ciphertext into column by row, from left to right
• Extract the new ciphertext column by column, start from column no.1 until complete

7.2 Authentication

• AAA Concept involves three security services in order to maintain Confidentiality, Integrity, and Availability (CIA) of data: Authentication, Authorization and Accountability
• AAA aims to provide security services to prevent unauthorized access

Authentication

• Refers to the process of recognizing a user's identity
• Authentication methods include: Something you know, Something you have, and Something you are

Authorization

• Refers to the process of giving a user the ability to access the system (either granting or denying).
• Authorization methods include Multi-Factor Authorization (MFA), Access Control Lists (ACLs), and Role-Based Access Control (RBAC).

Accountability

• Refers to the process of keeping track of a user's activity while accessing resources
• Accountability Methods: Access Control, Incident Response Plans, and Audit Trails and Logging.

Identification vs. Verification

• Identification is the process that identifies a user based upon comparison of a current sample against a previous collected sample, identifying them using a unique identifier.
• Verification verifies if a user is the person they claim to be, proving that person's identity

Implementation Techniques

• Includes Passwords & Smart Cards, Biometric, Kerberos

Passwords

• A secret word or expression used by authorized persons to prove their rights to access

Smart Cards

• Cards containing an embedded microchip that can be programmed to store info onto it

Characteristic of Good Password

• Combines letters, numbers, and symbols while using Upper/lowercase, is at least 8-12 characters long, is hard to predict, and is frequently changed

Characteristics of Smart Cards

• Contact Smart Cards require physical contact with a card reader (MyKad, Debit Cards, and Credit Cards).
• Contactless Smart Cards communicate with the reader using radio frequency without direct contact (RFID Cards)

Biometric

• An electronic identification of an individual on the basis of unique biological or physiological characteristics

Biometric Types

• Fingerprint is a biological characteristic using a fingerprint scanner that is used to recognize human fingerprints in various applications (counter banking system).
• Hand Geometry is used to recognize/verify human palm geometry to in high-security workplaces
• Retinal patterns uses the iris scanner in national identification systems
• Facial Features involves facial recognition systems in buildings
• Voice uses voice recognition systems in resident systems
• Signature uses signature recognition scanner in financial systems

Kerberos

• A client-server authentication protocol that enables mutual authentication
• Utilizes secret-key cryptography
• Named after the Greek Myth - three-headed dog

Elements of Kerberos

• Client: Represents a computer or user or software
• Target Server: Provides the service the client wants to access
• Key Distribution Center (KDC): Handles the distribution of keys and tickets

Steps in Kerberos Ticketing Exchange

• Client request ticket from KDC Authentication Service (AS), KDC either Provides ticket or denies (if it can decrypt)
• Client gives TGT to the KDC Ticket-Granting Service (TGS), and request the service ticket
• KDC TGS provide the service ticket to the client
• Client send Service Ticket and authentication request to the server
• Server checks the clients Service Ticket and initiates the Client-Server session

7.3 Data Security

• Refers to the practices, technologies, and measures used to protect data from unauthorized access, corruption, theft, or loss
• Maintains privacy, compliance with legal regulations, and integrity of an organization's data

Firewall

• System monitors and controls incoming/outgoing network traffic based on predetermined security rules
• Can be either software (program installed) or hardware (equipment installed)

Goals of Firewall

• All traffic must pass through the firewall authentication
• Only authorized traffic must be allowed to pass
• Immune to penetration

Capabilities of Firewall

• Prevent unauthorized entry into the protected network
• Prohibit vulnerable services from entering or leaving the network
• Provide protection from various kinds of IP spoofing and routing attacks
• Provide a location for monitoring security-related events
• Serve as a platform for Internet functions that are not security related
• Serve as the platform for IPsec

Types of Firewalls

• Packet filtering: Applying a set of rules to each incoming and outgoing IP packet
• Stateful inspection: Monitoring the state of active connections to determine which network packets to allow through the firewall
• Application level gateway: Runs proxies that copy and forward information across the gateway, preventing direct connection between a trusted server/client and an untrusted host
• Circuit level gateway: Monitors TCP handshaking between packets to determine whether requested session is legitimate

The Packet Filtering Firewall

• The external network uses a router to send a packet from external network to internal network
• Internal network contains the firewall to filter packets for internal network

Firewall Configuration

• Bastion Host: Deliberately exposes a host on a public network
• Individual Host-Based Bastion: Secures an individual host by filtering and restricting the flow of packets
• Personal Firewall: Protects only the installed computer by controlling the flow of network traffic (stand-alone)
• Distributed Firewall: Involves stand-alone firewall with host-based firewall under a central administrative control

7.4 Risk Management

• Cybersecurity risk management identifies, analyzes, and addresses an organization's IT security risks to prevent ongoing and future cyberattacks and cyberthreats
• Adheres strictly to relevant guidelines, standards, and best practices

Why does cybersecurity risk management matter?

• Mitigates cyberattacks and the damage associated with cyber risks
• Reduce operational costs
• Protect business assets and revenue
• Improve organizational reputation

Keys Steps in Cybersecurity Risk Management

• Identifying Risks which involves listing which systems/data could be attacked such as customer data and financial records
• Assessing Risks which involves determining the chances of a threat happening, and the potential impact if the threat occurs
• Managing Risks involves deciding how to handle each risk (reduce, transfer, avoid, or accept it).

Cybersecurity Risk Management Strategies

• Risk Avoidance: Prevent threat by changing plans or behavior (Avoid opening suspicious emails)
• Risk Reduction: Reduces chances or impact of a risk (Installing antivirus software and applying security patches)
• Risk Transfer: Shifting the risk to another party by purchasing cybersecurity insurance
• Risk Acceptance: Deciding to accept the risk if the impact is low and manageable