SDLecture10-SecurityPrinciples 2024 PDF

Security Principles Lecture 10 Riaz Ahmed Shaikh Outline Part 1: Security Principles Some basic principles of cyber security Common cyber threats Cyber security and IoT Part 2: Building Systems Custom-built vs Off-the-self software Outsourcing What is Cyber Security?...

Security Principles Lecture 10 Riaz Ahmed Shaikh Outline Part 1: Security Principles Some basic principles of cyber security Common cyber threats Cyber security and IoT Part 2: Building Systems Custom-built vs Off-the-self software Outsourcing What is Cyber Security? You probably think of images like these…. What is Cyber Security? When you think of cyber security you probably think of protecting digital systems However, it is so much more than that Cyber security also includes: Human beings Physical protection  CIA Triangle Keeping data secret Confidentiali E.g.: Preventing your email ty address from being leaked Keeping data in-tact/unchanged Keeping data available E.g.: Preventing hacks which E.g.: Preventing alter your info ransomware Integrit Availabilit y y Security Threats Disclosure The access to information which someone should not have access to Deception The acceptance of false information Disruption A break in the availability or regular function of a system Usurpation Unauthorised control of a system Security Principles Security relies on evaluation of risk You choose what risks are worth preventing The security trade-off: Cost of the security measure vs the Time and Effort to break it Security Principles Good security considers…. The people The involved technology The processes used 4 Areas of Security Reconstructi Preventative Detective Reactive ve Stop the Spot where Stop a Recover problem the issue problem as from an from occurred it’s issue happening and how happening Access Control and Policies Security Policies A security policy sets out an organisation’s goals and mechanisms to maintain security In reality this is usually done through multiple policies Access Control Restrict access to resources to people that need them For files: read, write, execute, delete Control Models Hierarchical: E.G. Official, secret, top secret Clearance at higher level allows access to lower levels Compartmental Access determined by role or function Types of Access Control Discretionary Role-Based Mandatory Access Control Access Control Access Control (DAC) (RBAC) (MAC) No individual Each object Uses access permissions, created has control lists instead done security labels on job role Very common Easiest, but Used only in on systems like has security high-security Windows concerns systems Access Control Issues Can make it very difficult to prevent access when dealing with large groups of people Authentication creep – if you move departments but your old privileges aren’t revoked Identification, Authentication, and Authorisation Identification Authorisatio n Authenticati on Identification, Authentication, and Authorisation Identification: Who are you? Authentication: Are you who you claim to be? Authorisation: Access to the system Types of authentication What you know What you are What you have How an authentication system works User Enters Details User Registration User Identifies Authenticatio Checked In Authenticated Period Themselves n Details Database (Or Denied) Identification The need to identify individuals is also important outside of authentication It allows data and actions to be associated with the perpetrator Allows for easy auditing when issues occur Digital Signature Digital signatures allows for authentication that a document or program arises from the person claiming it This ensures the integrity of the document If the document has been altered then the recipient will know Also ensures non-repudiation of the document Signer cannot deny the document’s validity Digital Signatures One-way hash Encryption Hashing 1011011 0110011 Algorith 0 1 m Private key One-way hash Hashing Validation 1011011 Algorith 0 m Decryption One-way hash 0110011 1011011 Transmission 1 0 Public key Improving Identification and Authentication Requiring 2 modes of authentication massively increases safety Eg. Card swipe + door code 2 Factor Authentication (2FA) is now the norm in many areas Enter a password then receive a one-time password (OTP) by text or email Cryptography Cryptography Cryptography is the art of encoding messages so they can only be understood by their intended recipient This has been around for centuries, starting with simple cyphers Able to be significantly more complex with the advent of computers Cryptography Plain Text Plain Text The original The original message message En on cry ti p ti r yp c De Cipher Text on The encrypted form Cryptography Requirements: The plain text A key An encryption function Keys There are 2 types of keys that can be used Symmetric: This is the original form of encryption Same key is used to encrypt and decrypt The secret key is known by both parties Asymmetric: A public key is used to encrypt the data, with the key being widely known A private key is used to decrypt the data, with this key being secret Encryption Issues Implementing good encryption can be difficult The more secure the encryption, the higher the resource cost and time Quality of encoding is influenced by the quality of random number generators Encryption itself is often seen as a political and privacy issue Attacks Malware MALWARE Maliciou Software s Definition: Software specifically designed to harm a user’s computer or data Malware Type of Description Examples Malware Virus A malicious piece of code that can replicate itself Anna Kournikova with malicious intention Worm A virus that can spread without needing to be CodeRed, SQLSlammer attached to a document Trojan Horse Malicious software that appears to provide a Zeus, Flashback useful service, while also harming the system Rootkit Software tools which allow hackers to gain control Flame of a system without being detected Ransomwar Malicious software designed to block access to a WannaCry (NHS hack), e system until a ransom is paid Norsk Hydro Types of Malware Non- Destructive Profitable destructive Adware Corrupt Data theft files Take control Destroy the (eg bitcoin hard disk mining) Ransomwar e Malware Propagation Two types of propagation 1. Self-replicating Worms You can become infected without doing anything 2. Human Intervention Usually caused by downloading an infected file or a Trojan horse Denial of Service Attacks Preventing normal use of a site or service by flooding it with so many requests that it fails Traditional DoS attacks originate from a single computer source DDoS (Distributed Denial of Service Attacks) utilise attacks from many different computers This is harder to prevent as more than a single IP needs to be blocked This can either be done by users purposefully, or computers infected by viruses may be used as a ‘botnet’ to complete the requests. Man-in-the-Middle Attacks Where a legitimate transaction is intercepted by a malicious actor It can then be read or altered This is often done through public wifi routers Web-based Attacks If a website is coded poorly, it can be vulnerable to hacks SQL Injection Access to the database without permission Cross-Site Scripting (XSS) Injection of javascript code to either change a site or reveal secret information Physical Security Digital systems can also be damaged physically The aim of physical systems is to avoid theft and damage to hardware Lack of physical security can cause damage via: Loss of service Loss of data Physical Risks (cont…) Natural Disaster/Risk Fire Power Failure Earthquakes Flooding Human Risk Sabotage Theft Physical Security (cont…) We look at physical security (and security generally) as a weighing of the potential damage vs the risk the damage occurs It’s important to allocate resources based on this risk assessment Otherwise there is a potential for wasting resources Risk assessment table example Physical Security examples SME (Small/Medium Enterprises) Keep servers in a locked room Have a backup server somewhere off-site Cloud storage Larger Enterprises Multiple redundant systems Automatic fire suppression Internet of Things What is IoT? Internet of Things refers to computing devices embedded in everyday objects, that can send and receive data via the internet This includes: Industrial settings Home networks (ie smart thermostats) Wearable devices (ie smart watches) These (in theory) make life easier Smartphone Vs Lightswitch 1. Find your phone 1. Walk up to light 2. Turn on screen switch 3. Unlock it 2. Flip the switch 4. Find the “Lights” 3. Go back to bed app 5. Select the light 6. Turn it off 7. Put phone away IoT Devices and User Experience You need to build IoT devices to be easy to use Voice commands Dashboards Easy to use remotes But equally the device needs to be secure If you compromise security to improve UX then your product will have further issues later Security and IoT MGC We look at securing IoT devices at 3 key points: MGC eMbedded devices (The devices themselves – hive, smartwatch) Gateway (the link – your phone) Cloud systems Two Key Areas Data Security System Security Data Security Keeping the data collected and processed by IoT devices safe and private IoT devices can collect a lot of data Home occupancy information Medical data Location data Even conversations System Security Keeping the devices themselves safe from hacking Must be adequate on every device This includes: Encryption Authentication procedures Safe architecture End to end security Because IoT devices generate data, it needs to be transferred securely using encryption This data may frequently be sent to multiple places, where the data may be altered or decrypted at any stage Ideally the data is only decrypted at the point of the end user  What do you think are the difficulties with IoT security? Difficulties of IoT Security Cheap hardware Unique architecture Many IoT devices are coded using unique languages making support difficult Lack of update procedure Many IoT devices don’t have easy ways to update their firmware if a vulnerability is discovered Many different access methods Wifi, Bluetooth etc This leads to many vulnerable entry points Difficulties in IoT Security 3rd Party Integration Can lead to security conflicts Can collect lots of unnecessary data This means that devices may be a valuable target The potential consequences can be severe For example, smart plugs are often marketed as good for knowing your hair straightener or iron is definitely not receiving power But if this is hijacked, the consequences could lead to deaths Owlet (a case study) Owlet was a baby sock aimed at providing monitoring information for new parents The sock connected through a base station to the home network None of this connection was secure IoT Solutions Develop legislation and common standards Ensure that security makes economic sense Improve technologies IoT Solutions Develop legislation and common standards Ensure that security makes economic sense Improve technologies  Part 2: Building Systems So far… We’ve focused this semester on how to develop a new system: What How will we should the deliver the system do? system? How will How will we people use secure the the system? system? How do we build a system? When we refer to ‘building’ a system in Systems Development, we don’t necessarily mean creating something from scratch We could create something brand new Custom for this scenario Or we could buy something off-the-shelf (OTS) Free (FOTS) or Commercial (COTS) Custom Built Software Pros Cons Complete control! Specialist knowledge Can be an exact fit for required the requirements Software development is IP ownership difficult Resale opportunities Often very expensive Will be a non-standard system – so difficult to maintain Off-the-Shelf Software Pros Cons It already exists! Have to find the solution Can be installed quickly No IP ownership No risk of development Ongoing licensing costs costs Can’t add more More mature software and requirements later organisation A perfect solution may Usually cheaper not exist No specialist knowledge required Not one or the other Systems are built on a scale – from fully custom to fully OTS Fully Custom Fully OTS Customisation You can take an existing system as a base, then apply customisation Light customisation Heavy customisation Both are typical with free open-source software Who is going to make it for us? Should we do it in house? Do we have the capability? Outsourcing An agreement in which one company contracts-out a part of their existing internal activity to another company” (McCarthy and Anagnostou, 2004) In our case, we’re talking about having some other company develop software for us Outsourcing is incredibly common For example, think of the components of a phone Outsourcing Pros Cons More mature software Finding a trustworthy and organisation company Usually cheaper Relies on a 3rd party No specialist Ongoing costs knowledge required Adding requirements Risk is transferred via can be difficult contract Limited control Staff Augmentation Adding a member of staff with specialist skills into the project Used where a specialist skill is needed, but nobody in the team has it Usually a temporary arrangement The ‘outsourced’ worker works directly for us Often as agency staff or a freelancer C0-Sourcing Where a client and a vendor develop a system in tandem This can include the client selecting vendor team- members Allows a vendor to develop specific components All components are then merged into a single bigger system Agreements tend to be more around service and function than hours Managed Service Client hires vendor for specific function(s) and services(s) For example, cloud-based IT support Contractual prices based around the service Uses Service Level Agreements (SLAs) The resources are managed by the vendor Total Outsourcing The vendor manages the entire service end-to-end Everything is covered by the vendor Longer-term contracts require strategic and board-level negotiations Best used when you want to have no involvement with the system Total Outsourcing Does an OTS Should we Should we What type of system exist? build in- outsource it? outsourcing? house? Is it cost- Do we have Is it cost- What is our effective? the skilled effective? current skill Is it staff? Is a level? reliable? Is it cost- company What is the Does is effective? available cost? meet our Is it time that we can How large requiremen effective? trust? is the ts now? Is it too Will there project? Will it meet complex? be future our future Is the risk support? requiremen too great? ts? Is it supported?