Comprehensive Notes on Information and Cyber Security (CE 372)

Security Objectives and the Information Environment

• Age of Universal Electronic Connectivity: Modern scenarios involve activities like hacking, viruses, and electronic fraud. Without robust security measures, network conversations or distributed applications are easily compromised.
• Modern Challenges:
  • Financial risks in online purchases utilizing credit/debit cards.
  • Potential for customers to be redirected to fraudulent websites.
  • Impersonation by hackers (sending messages pretending to be another entity).
• Primary Drivers of Security Development:
  • Introduction of computers into organizations.
  • Proliferation of distributed systems and communication facilities for data transmission.
• Distinction in Protections:
  • Computer Security: A collection of tools designed to protect local data and thwart hackers.
  • Network Security: Specific measures intended to protect data during transmission.
  • Internet Security: Measures to protect data during transmission over interconnected networks, focusing on deterring, preventing, detecting, and correcting storage and transmission violations.
• Core Priority: Security efforts are primarily focused on protecting information and its accessibility rather than the physical computers and networks themselves.

Threats and Security Statistics

• Definition of a Threat: An object, person, or entity representing a constant danger to an asset.
• CSI Survey (2007) Findings:
  • Survey included 494 computer security practitioners.
  • $46\%$ suffered security incidents.
  • $29\%$ reported incidents to law enforcement.
  • Average annual loss reported was $350,424.
  • One-fifth suffered a targeted attack.
• Prevalent Security Problems:
  • Insider abuse of network access.
  • Email vulnerabilities.
  • Human error or failures.
  • Intellectual property compromises.
  • Deliberate acts: espionage, extortion, sabotage, vandalism, theft, and software attacks.
  • System failures: Technical hardware/software failures, quality of service deviations, and technological obsolescence.
  • Forces of nature.

Aspects of Information Security: Attacks, Services, and Mechanisms

• Security Attack: Any action compromising information security within an organization. Information security aims to prevent or detect these actions.
• Security Service: Processing or communication services provided by a system to produce specific protection for resources, implementing security policies via security mechanisms.
• Security Mechanism: Processes (reversible or irreversible) like encryption, hash algorithms, or digital signatures used to provide security services.

Classification of Security Attacks

• Passive Attacks: Monitoring of transmissions to obtain information. These are difficult to detect as they do not involve data alteration.
  • Eavesdropping: Monitoring network traffic.
  • Traffic Analysis: Observing the frequency and length of messages to determine communication patterns.
• Active Attacks: Involving some modification of the data stream or the creation of false streams.
  • Interruption: An attack on availability; destroying or making a system resource unusable (e.g., jamming wireless signals, disabling file systems).
  • Interception: An attack on confidentiality; unauthorized access to an asset (e.g., wiretapping or illicitly copying programs).
  • Modification: An attack on integrity; tampering with an asset (e.g., altering message contents or program code).
  • Fabrication: An attack on authenticity/authenticity; inserting counterfeit objects or messages into a system (also known as impersonation).

Security Services and X.800 Definitions

• Confidentiality: Protection of data from unauthorized disclosure and protection of traffic flow from analysis.
• Authentication: Assurance that the communication is genuine.
  • Peer Entity Authentication: Verifies identities at connection establishment.
  • Data Origin Authentication: Assures the source of a data unit (does not protect against duplication or modification).
• Integrity: Ensures data is not modified without authorization.
  • Connection-Oriented: Assures a stream of messages remains in order, without modification, duplication, or replays.
  • Connectionless-Oriented: Protects individual messages against modification only.
• Non-repudiation: Prevents either the sender or receiver from denying a transmitted message; essential for e-commerce liability.
• Access Control: Limits and controls access to host systems and applications via communication links.
• Availability: Ensuring system resources are accessible and usable on demand by authorized entities.

Models for Network Security

• General Model Tasks:
  1. Design an algorithm for security-related transformation.
  2. Generate secret information to be used with the algorithm.
  3. Develop methods to distribute and share secret information.
  4. Specify a protocol for the principals to use the algorithm and secret info.
• Security Transformation: Making data unreadable to opponents and adding verification codes.
• Trusted Third Party: Often responsible for distributing secret information and settling disputes regarding authenticity.
• Information Access Threats: Logic inserted to intercept or modify data (e.g., viruses, worms).
• Service Threats: Logic inserted to exploit flaws and inhibit legitimate use.

Cryptography: Concepts and Terminologies

• Plaintext: The original message.
• Ciphertext: The coded message.
• Cipher: The algorithm for transformation.
• Key: Information known only to sender/receiver to control the cipher.
• Encipher (Encrypt): Converting plaintext to ciphertext.
• Decipher (Decrypt): Recovering plaintext from ciphertext.
• Cryptography: Study of encryption principles/methods.
• Cryptanalysis: Study of principles to decipher without knowing the key.
• Cryptology: The combined field of cryptography and cryptanalysis.
• Dimensions of Cryptographic Systems:
  1. Type of operations: Substitution and Transposition.
  2. Number of keys: Symmetric (single key) and Asymmetric (public-private key pair).
  3. Processing method: Block ciphers (fixed blocks) and Stream ciphers (continuous elements).

Basic Cryptanalysis Attacks

• Ciphertext Only: Analyst has only the ciphertext.
• Known Plaintext: Analyst has instances of ciphertext and their corresponding plaintext.
• Chosen Plaintext: Analyst can choose specific plaintexts to be encrypted to observe the resulting ciphertext.
• Chosen Ciphertext: Analyst can choose specific ciphertexts to be decrypted to observe the resulting plaintext.

Classical Substitution Techniques

• Caesar Cipher: Simplest substitution; replaces each letter with the letter 3 places down the alphabet.
  • General formula: $C = E(p) = (p + k) \pmod{26}$
  • Decryption formula: $P = D(C) = (C - k) \pmod{26}$
• Monoalphabetic Ciphers: Use a permutated alphabet (26! possible keys, approx. $4 \times 10^{26}$). Vulnerable to frequency analysis of the language (e.g., identifying 'E' as the most frequent letter in English).
• Playfair Cipher: Encrypts pairs of letters (digrams) using a $5 \times 5$ matrix.
  • Rules: Fill matrix with a keyword, then remaining alphabet letters (I/J usually occupy the same spot).
  • Encryption: If letters in same row, replace with right neighbors (wrap around); if same column, replace with neighbors below; if a rectangle, swap corners.
• Hill Cipher: Multi-letter cipher based on linear algebra.
  • Uses a matrix $K$ as the key and column vectors $P$ for plaintext.
  • Encryption: $C = KP \pmod{26}$
  • Decryption: $P = K^{-1}C \pmod{26}$
• Polyalphabetic Cipher (Vigenere): Uses a keyword to select different Caesar shift alphabets for each letter. The Vigenere tableau is the standard tool for this process.
• Autokey System: Keyword is concatenated with the plaintext itself to form a non-periodic key.

Classical Transposition Techniques

• Rail Fence: Simplest transposition; plaintext written as a diagonal sequence and read off as rows.
• Row Transposition Ciphers: Plaintext written row by row in a rectangle, and read off column by column in a permutated order determined by a key.
• Complex Permutations: Achieved by performing multiple stages of transposition.

Steganography

• Definition: Methods used to conceal the existence of a message rather than its contents.
• Techniques:
  • Character Marking: Overwriting selected printed letters with pencil.
  • Invisible Ink: Substances appearing only when heat or chemicals are applied.
  • Pin Punctures: Small holes in specific letters.
  • Correction Ribbon: Typing between lines with correction tape, visible only under strong light.
• Drawbacks: Significant overhead (hiding few bits requires much data); if the system is discovered, it is worthless.

Symmetric Block Ciphers: DES and AES

• Feistel Cipher Structure: A general design for block ciphers. Plaintext (length $2w$) is split into $L_0$ and $R_0$.
  • Encryption for round $i$ follows:
    • $L_i = R_{i-1}$
    • $R_i = L_{i-1} \oplus F(R_{i-1}, K_i)$
• Data Encryption Standard (DES):
  • 64-bit block size.
  • 56-bit key size (plus 8 parity bits for a total 64-bit input).
  • 16 rounds of processing.
  • Initial Permutation (IP) and Inverse Initial Permutation ($IP^{-1}$) at the end.
• Simplified DES (S-DES): Educational version using an 8-bit block and 10-bit key.
  • Subkeys: $K_1$ and $K_2$ (8 bits each) generated using $P10, LS-1, P8$.
  • Functions used: $IP, f_k, SW, f_k, IP^{-1}$.
• Advanced Encryption Standard (AES):
  • Standardized replacement for DES; block length is 128 bits.
  • Key lengths: 128, 192, or 256 bits.
  • Rounds: 10, 12, or 14 (depending on key size).
  • Internal State: Structured as a $4 \times 4$ matrix of bytes.
  • Round Transformation Stages:
    1. Substitute Bytes (using S-boxes).
    2. Shift Rows (circular left shifts: row 0 = 0 bytes, row 1 = 1 byte, etc.).
    3. Mix Columns (matrix multiplication in $GF(2^8)$).
    4. Add Round Key (XOR with the expanded subkey).

Other Symmetric Algorithms and Modes

• Blowfish: Designed by Bruce Schneier. Fast, uses variable key size (32 to 448 bits), 18 subkeys ($P$-array), and four $8 \times 32$ S-boxes.
• Block Cipher Modes of Operation:
  • ECB (Electronic Code Book): Each block encrypted independently. Weak for long messages as identical plaintext blocks yield identical ciphertext blocks.
  • CBC (Cipher Block Chaining): Each plaintext block XORed with previous ciphertext block. Requires an Initialization Vector (IV).
  • CFB (Cipher Feedback): Converts block cipher into a stream cipher. Ciphertext is fed back into the shift register.
  • OFB (Output Feedback): Similar to CFB, but internal output of the cipher is fed back. Bit errors do not propagate.
  • CTR (Counter): Encrypts an incrementing counter value to generate a key stream.

Public Key Cryptography (Asymmetric)

• Concept: Uses two mathematically related keys: Public (anyone can know) and Private (kept secret).
• Confidentiality: Sender encrypts with receiver's public key; only receiver can decrypt with their private key.
• Authentication/Signature: Sender encrypts with their private key; anyone can verify with sender's public key.
• RSA Algorithm:
  • Key Generation:
    1. Select two large primes $p, q$.
    2. Calculate $n = p \times q$ and $\phi(n) = (p-1)(q-1)$.
    3. Select $e$ such that $gcd(e, \phi(n)) = 1$.
    4. Calculate $d \equiv e^{-1} \pmod{\phi(n)}$.
  • Encryption: $C = M^e \pmod{n}$.
  • Decryption: $M = C^d \pmod{n}$.
• Diffie-Hellman Key Exchange: Allows two parties to create a shared secret.
  • Standard: $Shared\,Secret\,K = (Y_A)^{X_B} \pmod{q} = (Y_B)^{X_A} \pmod{q}$.
  • Vulnerabilities: Subject to Man-in-the-Middle attacks because it lacks identity authentication.
• Elliptic Curve Cryptography (ECC): Offers equal security to RSA but with significantly smaller bit sizes (e.g., 256-bit ECC is comparable to 3072-bit RSA).
  • Hard problem: Elliptic Curve Logarithm Problem ($Q = kP$).

Message Authentication and Hash Functions

• Message Authentication Code (MAC): Uses a shared secret key to generate a fixed-size check value appended to a message.
• Hash Function Requirements:
  1. Can be applied to any size message.
  2. Produces fixed-length output.
  3. Easy to compute $H(M)$.
  4. Pre-image resistance (one-way property).
  5. Second pre-image resistance (weak collision resistance).
  6. Collision resistance (strong collision resistance).
• MD5: 128-bit digest; processed in 512-bit blocks; involves 4 rounds of 16 steps.
• SHA-1: 160-bit digest; processed in 512-bit blocks; involves 4 rounds of 20 steps.
• HMAC: A MAC mechanism specifically designed to use a cryptographic hash function like MD5 or SHA-1.

Digital Signatures

• Direct Digital Signature: Involves only sender and receiver; depends on sender's private key.
• Arbitrated Digital Signature: Involves an arbiter who validates the signature. Arbiter may or may not see the message content.
• Digital Signature Standard (DSS): Uses the Digital Signature Algorithm (DSA) paired with SHA; designed for signatures only (not encryption).

Authentication Infrastructure and Applications

• Kerberos: Third-party authentication service.
  • Version 4: Uses DES; introduces Authentication Service (AS) and Ticket Granting Service (TGS).
  • Version 5: Corrects deficiencies (ticket lifetime, protocol dependence, encryption system dependence).
• X.509: Recommendation for directory services and certificate formats. Certificates bind identities to public keys and are signed by a Certificate Authority (CA).
• Biometrics: Using unique biological traits (fingerprints, retina, facial recognition) for authentication.
  • Issues: High deployment costs, susceptibility to smudging/reading errors, and user privacy concerns.

Email Security: PGP and S/MIME

• Pretty Good Privacy (PGP): Created by Phil Zimmermann.
  • Services: Authentication (DSS/SHA or RSA/SHA), Confidentiality (CAST-128, IDEA, or 3DES), Compression (ZIP), Email compatibility (Radix-64), Segmentation/Reassembly.
• S/MIME: Security enhancement to MIME.
  • Functions: Enveloped data (encrypted), Signed data (encoded digest), Clear-signed data (digest only encoded).

IP Security (IPSec)

• Overview: Framework for protecting IP communications. Mandatory for IPv6; optional for IPv4.
• Security Associations (SA): Database records defining parameters for a one-directional communication link, identified by SPI, IP Address, and Protocol ID.
• Protocols:
  • Authentication Header (AH): Provides integrity and authentication; prevents address spoofing.
  • Encapsulating Security Payload (ESP): Provides confidentiality (encryption), and optionally integrity/authentication.
• Modes:
  • Transport Mode: Protects the upper-layer payload; IP header is not protected.
  • Tunnel Mode: Protects the entire IP packet; encapsulates original packet in a new IP packet.
• Key Management: Uses ISAKMP/Oakley (Internet Security Association and Key Management Protocol).

Web Security Procedures

• Secure Socket Layer (SSL): Provides security between TCP/IP and applications like HTTP.
  • Protocols: Record Protocol (confidentiality/integrity), Handshake Protocol (authentication/key negotiation), Alert Protocol (warning/fatal errors), Change Cipher Spec Protocol.
• Transport Layer Security (TLS): Standardized version of SSL 3.0 (defined in RFC 2246).
• Secure Electronic Transaction (SET): Protocol for credit card safety on the Internet.
  • Dual Signature: Links payment information (PI) and order information (OI) without sharing PI with merchant or OI with bank.
  • Formula: $DS = E(PR_c, [H(H[PI] \, || \, H[OI])])$.

Intruders, Malicious Software, and Firewalls

• Intruder Classes:
  • Masquerader: Unauthorized outsider penetrating system controls.
  • Misfeasor: Authorized insider misusing privileges.
  • Clandestine User: Insider/outsider seizing supervisory control.
• Malicious Software Types:
  • Virus: Needs a host program (Parasitic, Stealth, Polymorphic, Macro).
  • Worm: Independent program replicating across networks (e.g., Morris, Nimda).
  • Logic Bomb: Triggers when specific conditions occur.
  • Trojan Horse: Hidden functionality in an innocuous program.
• Firewall Types:
  • Packet Filter: Inspects IP/TCP headers; applies discard or forward rules.
  • Application-Level Gateway (Proxy): Acts as a relay for specific applications; high overhead but high security.
  • Circuit-Level Gateway: Relays TCP connections without examining contents (e.g., SOCKS).
• Firewall Configurations:
  • Screened Host (Single-homed/Dual-homed): Uses a bastion host and a packet-filtering router.
  • Screened Subnet: Most secure; creates an isolated network (DMZ) between two filtering routers.

Case Studies and Forensic Science

• Computer Forensics: Explaining how security policies were violated (culpability) versus Security (integrity).
• Forensic Challenges: Security measures like encryption or data wiping can hinder forensic investigations by limiting logs or concealing data.
• Emergent Trends: Security is increasingly involving forensic techniques for post-incident analysis.
• Security Vulnerabilities: Cross Site Scripting (XSS), Secure Inter-branch transactions, and Virtual Election security are persistent research areas.