Wireless Communication Security Lecture 8 PDF

Wireless Communication Security prepared by Dr/ Ahmed Ali Rosas LECTURE 8 Elements of information security with applications in the wireless environment  contents Elemen...

Wireless Communication Security prepared by Dr/ Ahmed Ali Rosas LECTURE 8 Elements of information security with applications in the wireless environment  contents Elements of radio frequency theory Data Encryption Algorithms Elements of information security with applications in the wireless environment Elements of physical layer security (the wiretap channel) Elements of RFID systems security analysis with case studies: the electronic passport Elements of WLAN security analysis WiFi- Bluetooth system security Security in mobile telephony systems 2G, 3G,4Gand opportunities in 5G. Elements of information security with applications in the wireless environment  Information Security The protection of information and its critical elements, including systems and hardware that use, store, and transmit that information enables organizations to protect digital and analog information and provides coverage for cryptography, mobile computing, social media, as well as infrastructure and networks containing private, financial, and corporate information.  information security, is a set of tools and practices that you can use to protect your digital and analog information. InfoSec covers a range of IT domains, including infrastructure and network security, auditing, and testing. It uses tools like authentication and permissions to restrict unauthorized users from accessing private information. These measures help you prevent harms related to information theft, modification, or loss  Cyber security Cybersecurity is the practice of protecting computers, servers, mobile devices, electronic systems, networks, and data from digital attacks, theft, and damage. It involves implementing measures to prevent unauthorized access to information, as well as detecting and responding to security threats. cybersecurity protects both raw and meaningful data, but only from internet-based threats. cybersecurity only covers Internet-based threats and digital data.  The Difference Between Information Security and Cybersecurity Information security and cybersecurity are closely related but distinct fields. InfoSec focuses on protecting data in all its forms, whether it's digital, physical, or even spoken. Its goal is to safeguard all data, regardless of form, and ensure it’s only accessible to authorized users while remaining accurate and reliable. Cybersecurity, on the other hand, specifically deals with protecting data and systems in the digital realm. It aims to defend from cyberattacks, such as hacking, malware, and phishing, focusing primarily on networks, computers, and the internet. While InfoSec covers broader information types and protection methods, cybersecurity zeroes in on safeguarding electronic data and digital infrastructures. Information security is a broader category of protections, covering cryptography, mobile computing, and social media. It is related to information assurance, used to protect information from non-person- based threats, such as server failures or natural disasters.  Cyberattacks A cyber attack occurs when there is an unauthorized action against computer infrastructure that compromises the confidentiality, integrity, or availability of its content. cyberattack can be defined as any attempt by an individual or organization "using one or more computers and computer systems to steal, expose, change, disable or eliminate information, or to breach computer information systems, computer networks, and computer infrastructures". Definitions differ as to the type of compromise required – for example, requiring the system to produce unexpected responses or cause injury or property damage. Cyberattacks can cause a variety of harms to targeted individuals, organizations, and governments, including significant financial losses and identity theft. They are usually illegal both as a method of crime and warfare, although correctly attributing the attack is difficult and perpetrators are rarely prosecuted. Hacking in cyber security refers to the misuse of devices like computers, smartphones, tablets, and networks to cause damage to or corrupt systems, gather information on users, steal data and documents, or disrupt data-related activity.  Phish Phishing is a form of social engineering and a scam where attackers deceive people into revealing sensitive information or installing malware such as viruses, worms, adware, or ransomware. Phishing attacks have become increasingly sophisticated and often transparently mirror the site being targeted, allowing the attacker to observe everything while the victim navigates the site, and transverses any additional security boundaries with the victiming, Malware /is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, deprive access to information, or which unknowingly interferes with the user's computer security and privacy. A computer virus/ is a type of malware that, when executed, replicates itself by modifying other computer programs and inserting its own code into those programs. If this replication succeeds, the affected areas are then said to be "infected" with a computer virus, a metaphor derived from biological viruses. Computer viruses generally require a host program. The virus writes its own code into the host program. When the program runs, the written virus program is executed first, causing infection and damage A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It will use this machine as a host to scan and infect other computers. When these new worm-invaded computers are controlled, the worm will continue to scan and infect other computers using these computers as hosts, and this behaviour will continue. Computer worms use recursive methods to copy themselves without host programs and distribute themselves based on exploiting the advantages of exponential growth, thus controlling and infecting more and more computers in a short time a Trojan horse (or simply Trojan) is any malware that misleads users of its true intent by disguising itself as a standard program. Trojans are generally spread by some form of social engineering. For example, where a user is duped into executing an email attachment disguised to appear innocuous (e.g., a routine form to be filled in), or by clicking on a fake advertisement on social media or anywhere else. Although their payload can be anything, many modern forms act as a backdoor, contacting a controller who can then have unauthorized access to the affected computer. Ransomware attacks are often carried out using a Trojan.  information security Information Security Protects Information from unauthorized access, disclosure, modification and use. Ensures safety of physical data Cyber Security Protects Internet-connected networks and systems from digital attacks Ensures the safety of entire digital data Network Security Protects directories and files in a network of computers against unauthorized access, misuse and hacking. Ensures the safety of only transmit data Telecom Network security Structures, techniques, transport protocols, and security measures used to provide integrity, availability, confidentiality and authentication for transmissions over private and public communication networks There are three elements of information security, otherwise known as the CIA triad. They guide organizations on protecting important data through those three pillars of data security: Confidentiality Integrity Availability  Confidentiality stands as the guardian of secrets, ensuring that sensitive information remains accessible only to those authorized to view it. It acts as the silent sentinel, shielding proprietary data, personal records, and classified materials from prying eyes. n your organization, employees need easy access to the data and information that they require to do their job. Keeping data confidential, though, means that employees only have access to the data that’s they absolutely need. Data confidentiality is also a major consideration in identity and access management standards. To achieve confidentiality, businesses can take advantage of data encryption technology and implement MFA (multi-factor authentication). Data encryption is the process of “scrambling” data to make it unreadable until it is delivered to the right person or user, at which point a decryption key is used. MFA requires a user to validate their identity through multiple methods, such as using a code delivered to a device or a biometric like a fingerprint  Integrity Data integrity means information should be intact, complete, and accurate. serves as the steadfast protector of data accuracy and trustworthiness. It upholds the sanctity of information, safeguarding it from unauthorized alteration, corruption, or tampering. By maintaining the integrity of data, organizations can rely on their information, fostering trust and ensuring sound decision-making.  Availability acts as the resilient backbone, ensuring that information remains accessible to authorized users. It guards against disruptions, downtime, and denial-of-service attacks. By preserving availability, organizations can remain operational even in the face of an attack or other disaster. Data availability means that a network, system, and necessary devices are ready to use as intended by authorized personnel. Essentially, data availability refers to your employees' ability to access the data they need at any given moment without delay. There are several factors that can hinder access to data, even for authorized users – especially in the era of cloud technology wherein so much data is hosted off-site. Types of Information Security When considering information security, there are many subtypes that you should know. These subtypes cover specific types of information, tools used to protect information and domains where information needs protection. Application security Application security strategies protect applications and application programming interfaces (APIs). You can use these strategies to prevent, detect and correct bugs or other vulnerabilities in your applications. If not secured, application and API vulnerabilities can provide a gateway to your broader systems, putting your information at risk. Much of application security is based on specialized tools for application shielding, scanning and testing. These tools can help you identify vulnerabilities in applications and surrounding components. Once found, you can correct these vulnerabilities before applications are released or vulnerabilities are exploited. Application security applies to both applications you are using and those you may be developing since both need to be secured. Types of Information Security Cloud security Cloud security provides similar protections to application and infrastructure security but is focused on cloud or cloud-connected components and information. Cloud security adds extra protections and tools to focus on the vulnerabilities that come from Internet-facing services and shared environments, such as public clouds. It also tends to include a focus on centralizing security management and tooling. This centralization enables security teams to maintain visibility of information and information threats across distributed resources. Another aspect of cloud security is a collaboration with your cloud provider or third-party services. When using cloud-hosted resources and applications, you are often unable to fully control your environments since the infrastructure is typically managed for you. This means that cloud security practices must account for restricted control and put measures in place to limit accessibility and vulnerabilities stemming from contractors or vendors. Types of Information Security Data Security Data security is the practice of protecting data from unauthorized access, corruption, or theft throughout its lifecycle, whether it is stored, transmitted, or being processed. This aspect of security is crucial because data is often the most valuable asset within an organization. It includes sensitive information such as customer records, financial data, intellectual property, and personal details that, if compromised, could result in significant financial loss, reputational damage, and legal consequences. Securing data is important because it helps maintain the confidentiality, integrity, and availability of the information. Confidentiality ensures that only authorized individuals can access the data, integrity prevents unauthorized alterations, and availability guarantees that the data is accessible to authorized users when needed. Data security also ensures compliance with regulatory requirements, such as GDPR or HIPAA, which mandate specific protections for personal and sensitive information. Types of Information Security Web Application Security Web application security involves protecting web applications from vulnerabilities and threats that could be exploited by attackers. Since web applications are often accessible over the internet, they are particularly vulnerable to attacks such as cross-site scripting (XSS), SQL injection, and distributed denial-of-service (DDoS) attacks. Securing web applications is essential because these applications often handle sensitive user data, process transactions, and provide critical services. A breach in web application security can lead to unauthorized access to user data, financial loss, and disruption of services. By implementing secure coding practices, regularly testing for vulnerabilities, and using protective tools like web application firewalls (WAFs), organizations can reduce the risk of attacks and protect both the application and its users.  Types of Information Security Email Security Email security involves protecting email communications from threats such as phishing, spam, malware, and unauthorized access. Email is one of the most common vectors for cyberattacks, often serving as an entry point for attackers aiming to compromise sensitive information or deliver malicious software. Effective email security strategies include using spam filters, anti-phishing tools, and email encryption. Spam filters help block unsolicited or harmful emails, while anti-phishing tools detect emails that mimic legitimate communications to trick users into revealing sensitive data. Encryption, on the other hand, protects email content by ensuring only intended recipients can read it.  Types of Information Security Endpoint Security Endpoint security helps protect end-user endpoints such as laptops, desktops, smartphones, and tablets against cyberattacks. Organizations implement endpoint security to protect devices used for work purposes, including those connected to a local network and those using cloud resources. Endpoints connecting to corporate networks become a security vulnerability that can potentially allow malicious actors to breach the network. An endpoint is essentially a potential entry point that cybercriminals can and often exploit through various techniques, like malicious software (malware) installed on an endpoint device to obtain control of a system or exfiltrate data. An endpoint security solution examines processes, files, and network traffic on each endpoint for indicators of malicious activity. Once the tool detects a threat, it notifies the relevant users and can perform automated responses.  Types of Information Security Edge Security In an increasingly connected world, edge security is becoming more important. Edge security refers to the measures taken to secure the edge of your network—the point where your network connects with the outside world. This could include your routers, firewalls, or other edge devices. Securing the network edge is crucial to prevent unauthorized access to your network and protect it from threats like cyber attacks or data breaches. This could involve measures like using secure network protocols, implementing robust firewalls, and regularly monitoring and analyzing your network traffic.  Types of Information Security Cryptography Cryptography uses a practice called encryption to secure information by obscuring the contents. When information is encrypted, it is only accessible to users who have the correct encryption key. If users do not have this key, the information is unintelligible. Security teams can use encryption to protect information confidentiality and integrity throughout its life, including in storage and during transfer. However, once a user decrypts the data, it is vulnerable to theft, exposure, or modification. To encrypt information, security teams use tools such as encryption algorithms or technologies like blockchain. Encryption algorithms, like the advanced encryption standard (AES), are more common since there is more support for these tools and less overhead for use. Chief information security officers (CISOs) are people responsible for managing and ensuring the protection of an organization’s information. This role may be a stand-alone position or be included under the responsibilities of the vice president (VP) of security or the chief security officer (CSO). The responsibilities of a CISO include managing: Security operations – includes real-time monitoring, analysis, and triage of threats. Cyber risk and cyber intelligence – includes maintaining current knowledge of security threats and keeping executive and board teams informed of the potential impacts of risks. Data loss and fraud prevention – includes monitoring for and protecting against insider threats. Security architecture – includes applying security best practices to the acquisition, integration, and operation of hardware and software. Identity and access management – includes ensuring proper use of authentication measures, authorization measures, and privilege granting. Program management – includes ensuring proactive maintenance of hardware and software through audits and upgrades. Investigations and forensics – includes collecting evidence, interacting with authorities, and ensuring that postmortems are performed.  information Security and Compliance Information security and compliance focus on ensuring that an organization’s security practices align with specific legal, regulatory, and industry standards. These regulations set the groundwork for how sensitive information should be protected and outline the penalties for non- compliance. Here are some of the most prominent regulations that significantly impact information security practices: General Data Protection Regulation (GDPR): GDPR is a European Union regulation designed to protect the personal data of EU citizens. It mandates strict data protection practices, such as obtaining explicit consent before processing personal data, implementing robust security measures, and notifying authorities of data breaches within 72 hours. GDPR directly impacts information security by requiring organizations to ensure that personal data is securely stored, processed, and transferred. Non-compliance can result in significant fines, making it essential for organizations to integrate strong security practices to meet GDPR requirements.  information Security and Compliance Health Insurance Portability and Accountability Act (HIPAA): HIPAA is a U.S. law that establishes data privacy and security provisions for safeguarding medical information. It requires healthcare providers, insurers, and their business associates to implement security measures to protect patient data, known as Protected Health Information (PHI). This includes encryption, access controls, and audit trails to prevent unauthorized access to sensitive health data. HIPAA compliance is critical for healthcare organizations to protect patient privacy and avoid hefty penalties for data breaches. Payment Card Industry Data Security Standard (PCI-DSS): PCI-DSS is an industry-standard that applies to organizations that handle credit card information. It mandates a set of security measures to protect cardholder data, including encryption, secure network architecture, and regular monitoring and testing of networks. Compliance with PCI-DSS is essential for businesses that process credit card transactions, as failure to secure payment data can result in fines, increased transaction fees, and loss of the ability to process credit card payments.  Common Information Security Risks In your daily operations, many risks can affect your system and information security. Some common risks to be aware of are included below. Social engineering attacks Social engineering involves using psychology to trick users into providing information or access to attackers. Phishing is one common type of social engineering, usually done through email. In phishing attacks, attackers pretend to be trustworthy or legitimate sources requesting information or warning users about a need to take action. For example, emails may ask users to confirm personal details or log in to their accounts via an included (malicious) link. If users comply, attackers can gain access to credentials or other sensitive information.  Common Information Security Risks Advanced persistent threats (APT) APTs are threats in which individuals or groups gain access to your systems and remain for an extended period. Attackers carry out these attacks to collect sensitive information over time or as the groundwork for future attacks. APT attacks are performed by organized groups that may be paid by competing nation-states, terrorist organizations, or industry rivals.  Common Information Security Risks Insider threats Insider threats are vulnerabilities created by individuals within your organization. These threats may be accidental or intentional, and involve attackers abusing “legitimate” privileges to access systems or information. In the case of accidental threats, employees may unintentionally share or expose information, download malware, or have their credentials stolen. With intentional threats, insiders intentionally damage, leak, or steal information for personal or professional gain. Cryptojacking Cryptojacking, also called crypto mining, is when attackers abuse your system resources to mine cryptocurrency. Attackers typically accomplish this by tricking users into downloading malware or when users open files with malicious scripts included. Some attacks are also performed locally when users visit sites that include mining scripts.  Common Information Security Risks Distributed denial of service (DDoS) DDoS attacks occur when attackers overload servers or resources with requests. Attackers can perform these attacks manually or through botnets, networks of compromised devices used to distribute request sources. The purpose of a DDoS attack is to prevent users from accessing services or to distract security teams while other attacks occur. Ransomware Ransomware attacks use malware to encrypt your data and hold it for ransom. Typically, attackers demand information, that some action be taken, or payment from an organization in exchange for decrypting data. Depending on the type of ransomware used, you may not be able to recover data that is encrypted. In these cases, you can only restore data by replacing infected systems with clean backups.  Common Information Security Risks Man-in-the-middle (MitM) attack MitM attacks occur when communications are sent over insecure channels. During these attacks, attackers intercept requests and responses to read the contents, manipulate the data, or redirect users. There are multiple types of MitM attacks, including: Session hijacking – in which attackers substitute their own IP for legitimate users to use their session and credentials to gain system access. IP spoofing – in which attackers imitate trusted sources to send malicious information to a system or request information back. Eavesdropping attacks – in which attackers collect information passed in communications between legitimate users and your systems.  Information Security Technologies Creating an effective information security strategy requires adopting a variety of tools and technologies. Most strategies adopt some combination of the following technologies. Firewalls Firewalls are a layer of protection that you can apply to networks or applications. These tools enable you to filter traffic and report traffic data to monitoring and detection systems. Firewalls often use established lists of approved or unapproved traffic and policies determining the rate or volume of traffic allowed. Security incident and event management (SIEM) SIEM solutions enable you to ingest and correlate information from across your systems. This aggregation of data enables teams to detect threats more effectively, more effectively manage alerts, and provide better context for investigations. SIEM solutions are also useful for logging events that occur in a system or reporting on events and performance. You can then use this information to prove compliance or to optimize configurations.  Information Security Technologies Data loss prevention (DLP) DLP strategies incorporate tools and practices that protect data from loss or modification. This includes categorizing data, backing up data, and monitoring how data is shared across and outside an organization. For example, you can use DLP solutions to scan outgoing emails to determine if sensitive information is being inappropriately shared. Web Application Firewall (WAF) A Web Application Firewall (WAF) is a security solution specifically designed to protect web applications by monitoring and filtering HTTP and HTTPS traffic between a web application and the internet. WAFs help to detect and block malicious requests, such as those involved in SQL injection, cross-site scripting (XSS), and other common web attacks. By analyzing the data packets and enforcing security policies, WAFs can prevent attackers from exploiting vulnerabilities in web applications.  Information Security Technologies Unlike traditional firewalls, which protect networks at the perimeter level, WAFs focus on the application layer (Layer 7 of the OSI model), making them essential for safeguarding web applications from sophisticated threats. WAFs can be deployed as hardware appliances, software, or as a cloud-based service, providing flexibility to fit into various IT environments. They are often integrated with other security technologies to enhance overall protection. Intrusion detection system (IDS) IDS solutions are tools for monitoring incoming traffic and detecting threats. These tools evaluate traffic and alert on any instances that appear suspicious or malicious. Intrusion prevention system (IPS) IPS security solutions are similar to IDS solutions and the two are often used together. These solutions respond to traffic that is identified as suspicious or malicious, blocking requests or ending user sessions. You can use IPS solutions to manage your network traffic according to defined security policies.  Information Security Technologies Attack Surface Management Attack surface management (ASM) is the practice of continuously discovering, monitoring, and managing the various points of entry that an attacker could exploit within an organization’s digital environment. ASM solutions identify all assets connected to the network, including hardware, software, cloud services, and IoT devices, creating an inventory of all potential attack vectors. User behavioral analytics (UBA) UBA solutions gather information on user activities and correlate those behaviors into a baseline. Solutions then use this baseline as a comparison against new behaviors to identify inconsistencies. The solution then flags these inconsistencies as potential threats. For example, you can use UBA solutions to monitor user activities and identify if a user begins exporting large amounts of data, indicating an insider threat.  Information Security Technologies Blockchain cybersecurity Blockchain cybersecurity is a technology that relies on immutable transactional events. In blockchain technologies, distributed networks of users verify the authenticity of transactions and ensure that integrity is maintained. While these technologies are not yet widely used, some companies are beginning to incorporate blockchain into more solutions. Endpoint detection and response (EDR) EDR cybersecurity solutions enable you to monitor endpoint activity, identify suspicious activity, and automatically respond to threats. These solutions are intended to improve the visibility of endpoint devices and can be used to prevent threats from entering your networks or information from leaving. EDR solutions rely on continuous endpoint data collection, detection engines, and event logging.  Information Security Technologies Extended Detection and Response (XDR) XDR is a collection of technologies that help security teams improve the effectiveness of their threat detection efforts and the speed of their investigation and response. XDR combines data from all layers of the IT environment, including networks, email, endpoints, IoT devices, cloud workloads, identity systems, and servers, and enriches the sources with threat intelligence to detect evasive, sophisticated threats. XDR provides automated, prepackaged threat detection, investigation, and response (TDIR) for various threats. Since XDR solutions are cloud-based, organizations can implement them for heterogeneous, distributed IT environments. These turn-key solutions immediately provide value and help improve the productivity of security teams.  Information Security Technologies Cloud security posture management (CSPM) CSPM is a set of practices and technologies you can use to evaluate your cloud resources’ security. These technologies enable you to scan configurations, compare protections to benchmarks, and ensure that security policies are applied uniformly. Often, CSPM solutions provide recommendations or guidelines for remediation that you can use to improve your security posture. VPN Remote Access and SASE A remote access virtual private network (VPN) enables organizations to provide secure remote access to data and applications residing within a corporate network. A VPN creates a tunnel between the network and a remote user. It secures traffic flowing across the tunnel by encrypting it. VPN remote access connects one user to on-premises resources but does not provide visibility into cloud resources. Secure Access Service Edge (SASE) establishes security across a hybrid environment, providing visibility into all resources. SASE is a cloud-based service that does not rely on VPNs or standalone proxies. Instead, it provides various network security tools as a cloud service.  Information Security Technologies BYOD Bring your own device (BYOD) is an approach that permits employees to use their personally- owned devices, such as laptops, tablets, smartphones, USB drives, and PCs, for work purposes. It means employees can use their devices to connect to the corporate network and access sensitive systems and confidential data. BYOD can improve the user experience, allowing employees to work using familiar devices from any location. It enables employees to use their devices to work remotely from home or while traveling. However, BYOD often leads to shadow IT, as IT staff have poor visibility (if at all) into these endpoints and cannot properly implement and maintain security measures. Organizations can protect against BYOD threats by employing application virtualization and endpoint security solutions to extend visibility and gain comprehensive security and management controls.  Types of IT Threats Computer virus Trojan Horses DNS poisoning Password grabbers Network worms Logic Bombs Hijacked home page Password cracker  Types of Attacks 1. SQL Injection 2. 2. Dictionary attack 3. 3. Phishing 4. 4. Cross site scripting (XSS) 5. 5. UI redressing  Security in different aspects: Data security helps to ensure the privacy of the individuals and the organizations. Data security is a method of protecting the data from unauthorized use. It has become an important part of the computer related business around the world. Data security is very important for the smooth operations in any One way to avoid the loss of data due to hard disk crash, accidental removal or due to virus attack is to take regular backup of your data on the CD-ROM, hard drives, USB drive or any other medium. If you have lost your critical data then there are many ways to recover it you just need to find a data recovery specialist in your area. Computer Security Every computer is susceptible to different attacks. It’s the responsibility of the computer user who manages the security of the computer to protect it from these attacks. Every computer system must have a predefined security measures to protect it from the viruses, spyware, adware, Trojan horses, web worms, internet security threats and hackers’ attacks. Firewall software provides a security mechanism that protects your computer from the unauthorized access and hackers’ attacks. Network Security Network security means the protecting your network from unauthorized use, viruses, spyware and internet threats. Protecting a computer network is the most important responsibility of the persons who manages the security of the Techniques used for Wireless Network Security There are many different techniques that serve to improve the security of wireless networks. The most common techniques are listed here: Encryption: In this method, the data is converted into a code that can only be accessed/decrypted by the users who are allowed to do it. Firewalls: This safety measure, blocks unwanted traffic from entering a network. Virtual Private Networks (VPNs): A VPN is referred to as a private network that secures data by using encryption. This allows remote users to access a network as VPN provides a secure connection between two networks. Intrusion Detection Systems (IDS): This can detect any signs of intrusion and monitor activity on a network. The IDS takes immediate action to block the attacker as soon as any intrusion is detected. Access Control Lists (ACLs): A list of permissions known as an ACL defines who has access to a network of the resource.