Computer Security Principles and Practice, 4th Edition William Stallings Solution Manual

Type:

Solution Manual

Resource:

Computer Security Principles and Practice

Edition:

4th Edition

Author(s):

William Chuck Easttom

TABLE OF CONTENTS

Chapter 1 Overview ................................................................. 5 Chapter 2 Cryptographic Tools................................................... 9 Chapter 3 User Authentication .................................................. 19 Chapter 4 Access Control ......................................................... 25 Chapter 5 Database and Cloud Security ..................................... 31 Chapter 6 Malicious Software ................................................... 36 Chapter 7 Denial-of-Service Attacks .......................................... 43 Chapter 8 Intrusion Detection .................................................. 48 Chapter 9 Firewalls and Intrusion Prevention Systems ................. 57 Chapter 10 Buffer Overflow ...................................................... 68 Chapter 11 Software Security ................................................... 75 Chapter 12 Operating System Security ...................................... 82

-4-

CHAPTER 1 OVERVIEW ANSWERS TO QUESTIONS 1.1 Computer security refers to protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability and confidentiality of information system resources (includes hardware, software, firmware, information/data, and telecommunications).

1.2 Passive threats have to do with eavesdropping on, or monitoring, transmissions. Electronic mail, file transfers, and client/server exchanges are examples of transmissions that can be monitored. Active threats include the modification of transmitted data and attempts to gain unauthorized access to computer systems.

1.3 Passive attacks: release of message contents and traffic analysis.

Active attacks: masquerade, replay, modification of messages, and denial of service.

1.4 Authentication: The assurance that the communicating entity is the one that it claims to be.

Access control: The prevention of unauthorized use of a resource (i.e., this service controls who can have access to a resource, under what conditions access can occur, and what those accessing the resource are allowed to do).

Data confidentiality: The protection of data from unauthorized disclosure.

Data integrity: The assurance that data received are exactly as sent by an authorized entity (i.e., contain no modification, insertion, deletion, or replay).

Nonrepudiation: Provides protection against denial by one of the entities involved in a communication of having participated in all or part of the communication.

Availability service: The property of a system or a system resource being accessible and usable upon demand by an authorized system entity, according to performance specifications for the system (i.e., a system is available if it provides services according to the system design whenever users request them).

-5-

1.5 An attack surface consists of the reachable and exploitable vulnerabilities in a system. An attack tree is a branching, hierarchical data structure that represents a set of potential techniques for exploiting security vulnerabilities.

ANSWERS TO PROBLEMS 1.1 The system must keep personal identification numbers confidential, both in the host system and during transmission for a transaction. It must protect the integrity of account records and of individual transactions.

Availability of the host system is important to the economic well being of the bank, but not to its fiduciary responsibility. The availability of individual teller machines is of less concern.

1.2 The system does not have high requirements for integrity on individual transactions, as lasting damage will not be incurred by occasionally losing a call or billing record. The integrity of control programs and configuration records, however, is critical. Without these, the switching function would be defeated and the most important attribute of all availability - would be compromised. A telephone switching system must also preserve the confidentiality of individual calls, preventing one caller from overhearing another.

1.3 a. The system will have to assure confidentiality if it is being used to publish corporate proprietary material. b. The system will have to assure integrity if it is being used to laws or regulations. c. The system will have to assure availability if it is being used to publish a daily paper.

1.4 a. An organization managing public information on its web server determines that there is no potential impact from a loss of confidentiality (i.e., confidentiality requirements are not applicable), a moderate potential impact from a loss of integrity, and a moderate potential impact from a loss of availability. b. A law enforcement organization managing extremely sensitive investigative information determines that the potential impact from a loss of confidentiality is high, the potential impact from a loss of integrity is moderate, and the potential impact from a loss of availability is moderate. c. A financial organization managing routine administrative information (not privacy-related information) determines that the potential impact from a loss of confidentiality is low, the potential impact from a loss of integrity is low, and the potential impact from a loss of availability is low.

-6-

d. The management within the contracting organization determines that: (i) for the sensitive contract information, the potential impact from a loss of confidentiality is moderate, the potential impact from a loss of integrity is moderate, and the potential impact from a loss of availability is low; and (ii) for the routine administrative information (non-privacy-related information), the potential impact from a loss of confidentiality is low, the potential impact from a loss of integrity is low, and the potential impact from a loss of availability is low. e. The management at the power plant determines that: (i) for the sensor data being acquired by the SCADA system, there is no potential impact from a loss of confidentiality, a high potential impact from a loss of integrity, and a high potential impact from a loss of availability; and (ii) for the administrative information being processed by the system, there is a low potential impact from a loss of confidentiality, a low potential impact from a loss of integrity, and a low potential impact from a loss of availability. Examples from FIPS 199.

1.5 a. At first glance, this code looks fine, but what happens if IsAccessAllowed fails? For example, what happens if the system runs out of memory, or object handles, when this function is called? The user can execute the privileged task because the function might return an error such as ERROR NOT ENOUGH MEMORY. b.

DWORD dwRet = IsAccessAllowed(...); if (dwRet == NO_ERROR) { // Secure check OK. // Perform task. } else { // Security check failed. // Inform user that access is denied. } In this case, if the call to IsAccessAllowed fails for any reason, the user is denied access to the privileged operation.

-7-

1.6

Open Safe

Pick Lock

Learn Combination

Find Written Combo

Threaten

Cut Open Safe

Install Improperly

Get Combo from Target

Blackmail

Eavesdrop

Listen to Conversation

Bribe

Get Target to State Combo

1.7 We present the tree in text form; call the company X: Survivability Compromise: Disclosure of X proprietary secrets OR 1. Physically scavenge discarded items from X OR 1. Inspect dumpster content on-site 2. Inspect refuse after removal from site 2. Monitor emanations from X machines AND 1. Survey physical perimeter to determine optimal monitoring position 2. Acquire necessary monitoring equipment 3. Setup monitoring site 4. Monitor emanations from site 3. Recruit help of trusted X insider OR 1. Plant spy as trusted insider 2. Use existing trusted insider 4. Physically access X networks or machines OR 1. Get physical, on-site access to Intranet 2. Get physical access to external machines 5. Attack X intranet using its connections with Internet OR 1. Monitor communications over Internet for leakage 2. Get trusted process to send sensitive information to attacker over Internet 3. Gain privileged access to Web server 6. Attack X intranet using its connections with public telephone network (PTN) OR 1. Monitor communications over PTN for leakage of sensitive information 2. Gain privileged access to machines on intranet connected via Internet -8-

CHAPTER 2 CRYPTOGRAPHIC TOOLS ANSWERS TO QUESTIONS 2.1 Plaintext, encryption algorithm, secret key, ciphertext, decryption algorithm.

2.2 One secret key.

2.3 (1) a strong encryption algorithm; (2) Sender and receiver must have obtained copies of the secret key in a secure fashion and must keep the key secure.

2.4 Message encryption, message authentication code, hash function.

2.5 An authenticator that is a cryptographic function of both the data to be authenticated and a secret key.

2.6 (a) A hash code is computed from the source message, encrypted using symmetric encryption and a secret key, and appended to the message.

At the receiver, the same hash code is computed. The incoming code is decrypted using the same key and compared with the computed hash code. (b) This is the same procedure as in (a) except that public-key encryption is used; the sender encrypts the hash code with the sender's private key, and the receiver decrypts the hash code with the sender's public key. (c) A secret value is appended to a message and then a hash code is calculated using the message plus secret value as input.

Then the message (without the secret value) and the hash code are transmitted. The receiver appends the same secret value to the message and computes the hash value over the message plus secret value. This is then compared to the received hash code.

2.7

1. H can be applied to a block of data of any size.

2. H produces a fixed-length output.

3. H(x) is relatively easy to compute for any given x, making both hardware and software implementations practical.

4. For any given value h, it is computationally infeasible to find x such that H(x) = h.

5. For any given block x, it is computationally infeasible to find y ≠ x with H(y) = H(x).

-9-

6. It is computationally infeasible to find any pair (x, y) such that H(x) = H(y).

2.8 Plaintext: This is the readable message or data that is fed into the algorithm as input. Encryption algorithm: The encryption algorithm performs various transformations on the plaintext. Public and private keys: This is a pair of keys that have been selected so that if one is used for encryption, the other is used for decryption. The exact transformations performed by the encryption algorithm depend on the public or private key that is provided as input. Ciphertext: This is the scrambled message produced as output. It depends on the plaintext and the key. For a given message, two different keys will produce two different ciphertexts. Decryption algorithm: This algorithm accepts the ciphertext and the matching key and produces the original plaintext.

2.9 Encryption/decryption: The sender encrypts a message with the recipient's public key. Digital signature: The sender "signs" a message with its private key. Signing is achieved by a cryptographic algorithm applied to the message or to a small block of data that is a function of the message. Key exchange: Two sides cooperate to exchange a session key. Several different approaches are possible, involving the private key(s) of one or both parties.

2.10 The key used in conventional encryption is typically referred to as a secret key. The two keys used for public-key encryption are referred to as the public key and the private key.

2.11 A digital signature is an authentication mechanism that enables the creator of a message to attach a code that acts as a signature. The signature is formed by taking the hash of the message and encrypting the message with the creator's private key. The signature guarantees the source and integrity of the message.

2.12 A pubic-key certificate consists of a public key plus a User ID of the key owner, with the whole block signed by a trusted third party.

Typically, the third party is a certificate authority (CA) that is trusted by the user community, such as a government agency or a financial institution.

2.13 Several different approaches are possible, involving the private key(s) of one or both parties. One approach is Diffie-Hellman key exchange.

Another approach is for the sender to encrypt a secret key with the recipient's public key.

ANSWERS TO PROBLEMS -10-

2.1 Yes. The eavesdropper is left with two strings, one sent in each direction, and their XOR is the secret key.

2.2 a.

2 C B R O U Y R T U S T

8 R E D M T C E S A T W

10 Y A P T S E T E R F O

7 P T I H I U O V E U F

9 T T L E D M N E D L R

6 O H L L E T I N I B I

3 G E A E T H G I S R E

1 A T R F H E H F T I N

4 H H F T E A T Y R N D

5 I I R O L T A O U G S

4 N T B E H I H T E T A

2 E R R A F R L I D L P

8 T F O E T O L H M E T

10 W H U T E L E I T D S

5 O E Y H A T T U C M E

6 R H R G T A I O E N T

3 K F T I Y O N V S E E

7 S T U S R U I E A D R

1 C I S R N G B U T L F

9 U N T E D S I F W R O

BUTLF TUCME IFWRO

RRAFR HRGTA HUTEL

LIDLP IOENT EITDS

FTIYO TUSRU

NVSEE IEADR

TBEHI FOETO

HTETA LHMET

ISRNG EYHAT NTEDS

b. The two matrices are used in reverse order. First, the ciphertext is laid out in columns in the second matrix, taking into account the order dictated by the second memory word. Then, the contents of the second matrix are read left to right, top to bottom and laid out in columns in the first matrix, taking into account the order dictated by the first memory word. The plaintext is then read left to right, top to bottom. c. Although this is a weak method, it may have use with time-sensitive information and an adversary without immediate access to good cryptanalysis t(e.g., tactical use). Plus it doesn't require anything more than paper and pencil, and can be easily remembered.

-11-

2.3 a. Let -X be the additive inverse of X. That is -X P = (C + –K1) ⊕ K0 b. First, calculate –C'. Then –C' = (P' ⊕ K0)

+ X = 0. Then:

+ (– K1). We then have:

+ –C' = (P ⊕ K0) + (P' ⊕ K0) However, the operations + and ⊕ are not associative or distributive C

with one another, so it is not possible to solve this equation for K0.

2.4 a. The constants ensure that encryption/decryption in each round is different.

-12-

b. First two rounds: L0

R0 K0 <<4 Delta1

K1 >>5

L1

R1 K2 <<4 Delta2

K3 >>5

L2

R2

-13-

c. First, let's define the encryption process: L2 = L0 + [(R0 << 4) + K0] ⊕ [R0 + R2 = R 0

+ [(L2 << 4) + K2] ⊕ [L2

+ K1] + δ2] ⊕ [(L2 >> 5) + K3] δ1] ⊕ [(R0 >> 5)

Now the decryption process. The input is the ciphertext (L2, R2), and the output is the plaintext (L0, R0). Decryption is essentially the same as encryption, with the subkeys and delta values applied in reverse order. Also note that it is not necessary to use subtraction because there is an even number of additions in each equation.

R0 = R 2

+ [(L2 << 4) + K2] ⊕ [L2 + δ2] ⊕ [(L2 >> 5) + K3]

L0 = L2

+ [(R0 << 4) + K0] ⊕ [R0 + δ1] ⊕ [(R0 >> 5) + K1]

-14-

d.

L0

R0 K0 <<4 Delta1

K1 >>5

L1

R1 K2 <<4 Delta2

K3 >>5

L2

R2

2.5 a. Will be detected with both (i) DS and (ii) MAC. b. Won’t be detected by either (Remark: use timestamps). c. (i) DS: Bob simply has to verify the message with the public key from both. Obviously, only Alice’s public key results in a successful verification.

-15-

(ii) MAC: Bob has to challenge both, Oscar and Bob, to reveal their secret key to him (which he knows anyway). Only Bob can do that. d. (i) DS: Alice has to force Bob to prove his claim by sending her a copy of the message in question with the signature. Then Alice can show that message and signature can be verified with Bob’s public key ) Bob must have generated the message. (ii) MAC: No, Bob can claim that Alice generated this message.

2.6 The statement is false. Such a function cannot be one-to-one because the number of inputs to the function is of arbitrary, but the number of unique outputs is 2n. Thus, there are multiple inputs that map into the same output.

-16-

2.7 a. Overall structure: N × 16 letters

Message

16 letters

16 letters

M1

M2 16

IV = 4 0000

F

Padding

16 letters

•••

MN

16

H1

16

H2 F

F

•••

HN = hash code

Compression function F:

Hi–1

Mi

Column-wise mod 26 addition row-wise rotations Column-wise mod 26 addition Hi b. BFQG c. Simple algebra is all you need to generate a result: AYHGDAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAA

-17-

2.8

5 1 a. M3 = 3 4 2

2 4 1 3 5

1 3 2 4 5

4 2 5 1 3

5 2 3 4 1

b. Assume a plaintext message p is to be encrypted by Alice and sent to Bob. Bob makes use of M1 and M3, and Alice makes use of M2. Bob chooses a random number, k, as his private key, and maps k by M1 to get x, which he sends as his public key to Alice. Alice uses x to encrypt p with M2 to get z, the ciphertext, which she sends to Bob. Bob uses k to decrypt z by means of M3, yielding the plaintext message p. c. If the numbers are large enough, and M1 and M2 are sufficiently random to make it impractical to work backwards, p cannot be found without knowing k.

2.9 We show the creation of a digital envelope: Sender's private key

H

E Hash code

Message

Digital signature

E Encrypted message

Random symmetric key

Digital envelope

E Receiver's public key

Encrypted symmetric key

-18-

CHAPTER 3 USER AUTHENTICATION ANSWERS TO QUESTIONS 3.1 Something the individual knows: Examples includes a password, a personal identification number (PIN), or answers to a prearranged set of questions.

Something the individual possesses: Examples include electronic keycards, smart cards, and physical keys. This type of authenticator is referred to as a token.

Something the individual is (static biometrics): Examples include recognition by fingerprint, retina, and face.

Something the individual does (dynamic biometrics): Examples include recognition by voice pattern, handwriting characteristics, and typing rhythm.

3.2 We can identify the following attack strategies and countermeasures: Offline dictionary attack: Typically, strong access controls are used to protect the system's password file. However, experience shows that determined hackers can frequently bypass such controls and gain access to the file. The attacker obtains the system password file and compares the password hashes against hashes of commonly used passwords. If a match is found, the attacker can gain access by that ID/password combination.

Specific account attack: The attacker targets a specific account and submits password guesses until the correct password is discovered.

Popular password attack: A variation of the preceding attack is to use a popular password and try it against a wide range of user IDs. A user's tendency is to choose a password that is easily remembered; this unfortunately makes the password easy to guess.

Password guessing against single user: The attacker attempts to gain knowledge about the account holder and system password policies and uses that knowledge to guess the password.

Workstation hijacking: The attacker waits until a logged-in workstation is unattended.

Exploiting user mistakes: If the system assigns a password, then the user is more likely to write it down because it is difficult to remember.

This situation creates the potential for an adversary to read the written password. A user may intentionally share a password, to enable a colleague to share files, for example. Also, attackers are frequently -19-

successful in obtaining passwords by using social engineering tactics that trick the user or an account manager into revealing a password.

Many computer systems are shipped with preconfigured passwords for system administrators. Unless these preconfigured passwords are changed, they are easily guessed.

Exploiting multiple password use. Attacks can also become much more effective or damaging if different network devices share the same or a similar password for a given user.

Electronic monitoring: If a password is communicated across a network to log on to a remote system, it is vulnerable to eavesdropping.

Simple encryption will not fix this problem, because the encrypted password is, in effect, the password and can be observed and reused by an adversary.

3.3 One technique is to restrict access to the password file using standard access control measures. Another technique is to force users to select passwords that are difficult to guess.

3.4 User education: Users can be told the importance of using hard-toguess passwords and can be provided with guidelines for selecting strong passwords.

Computer-generated passwords: the system selects a password for the user.

Reactive password checking: the system periodically runs its own password cracker to find guessable passwords.

Proactive password checking: a user is allowed to select his or her own password. However, at the time of selection, the system checks to see if the password is allowable and, if not, rejects it.

3.5 Memory cards can store but not process data. Smart cards have a microprocessor.

3.6 Facial characteristics: Facial characteristics are the most common means of human-to-human identification; thus it is natural to consider them for identification by computer. The most common approach is to define characteristics based on relative location and shape of key facial features, such as eyes, eyebrows, nose, lips, and chin shape. An alternative approach is to use an infrared camera to produce a face thermogram that correlates with the underlying vascular system in the human face.

Fingerprints: Fingerprints have been used as a means of identification for centuries, and the process has been systematized and automated particularly for law enforcement purposes. A fingerprint is the pattern of ridges and furrows on the surface of the fingertip. Fingerprints are believed to be unique across the entire human population. In practice, automated fingerprint recognition and matching system extract a -20-

number of features from the fingerprint for storage as a numerical surrogate for the full fingerprint pattern.

Hand geometry: Hand geometry systems identify features of the hand, including shape, and lengths and widths of fingers.

Retinal pattern: The pattern formed by veins beneath the retinal surface is unique and therefore suitable for identification. A retinal biometric system obtains a digital image of the retinal pattern by projecting a low-intensity beam of visual or infrared light into the eye.

Iris: Another unique physical characteristic is the detailed structure of the iris.

Signature: Each individual has a unique style of handwriting and this is reflected especially in the signature, which is typically a frequently written sequence. However, multiple signature samples from a single individual will not be identical. This complicates the task of developing a computer representation of the signature that can be matched to future samples.

Voice: Whereas the signature style of an individual reflects not only the unique physical attributes of the writer but also the writing habit that has developed, voice patterns are more closely tied to the physical and anatomical characteristics of the speaker. Nevertheless, there is still a variation from sample to sample over time from the same speaker, complicating the biometric recognition task.

3.7 Enrollment is analogous to assigning a password to a user. For a biometric system, the user presents a name and, typically, some type of password or PIN to the system. At the same time the system senses some biometric characteristic of this user (e.g., fingerprint of right index finger). The system digitizes the input and then extracts a set of features that can be stored as a number or set of numbers representing this unique biometric characteristic; this set of numbers is referred to as the user's template. The user is now enrolled in the system, which maintains for the user a name (ID), perhaps a PIN or password, and the biometric value. Verification is analogous to a user logging on to a system by using a memory card or smart card coupled with a password or PIN. For biometric verification, the user enters a PIN and also uses a biometric sensor. The system extracts the corresponding feature and compares that to the template stored for this user. If there is a match, then the system authenticates this user.

For an identification system, the individual uses the biometric sensor but presents no additional information. The system then compares the presented template with the set of stored templates. If there is a match, then this user is identified. Otherwise, the user is rejected 3.8 A false match occurs when an imposter's biometric data is declared by the system to be matched with the stored biometric data for a user. A false mismatch occurs when the system declares that the biometric data -21-

of a genuine user does not match the stored biometric data for that user. The rate refers to the probability of a false match or false mismatch.

3.9 In general terms, a challenge-response protocol functions as follows. A user attempts to logon to a server. The server issues some sort of challenge that the user must respond to in order to be authenticated.

ANSWERS TO PROBLEMS 3.1 a. If this is a license plate number, that is easily guessable. b. suitable c. easily guessable d. easily guessable e. easily guessable f. suitable g. very unsuitable h. This is bigbird in reverse; not suitable.

3.2 The number of possible character strings of length 8 using a 36character alphabet is 368 ≈ 241. However, only 215 of them need be looked at, because that is the number of possible outputs of the random number generator.

26 4 3.3 a. T = seconds = 63.5 hours 2 b. Expect 13 tries for each digit. T = 13 × 4 = 52 seconds.

3.4 a. p = b. p = c. p =

rk rk − r p r k+ p rp

3.5 a. T = (21 × 5 × 21)2 = 4,862,025 b. p = 1/T ≈ 2 × 10–7 3.6 There are 9510 ≈ 6 × 1019 possible passwords. The time required is:

6 × 1019 passwords = 9.4 × 1012 seconds 6.4 × 10 6 passwords/second =300,000 years

-22-

3.7 a. Since PUa and PRa are inverses, the value PRa can be checked to validate that Pa was correctly supplied: Simply take some arbitrary block X and verify that X = D(PRa, E[PUa, X]). b. Since the file /etc/publickey is publicly readable, an attacker can guess P (say P') and compute PRa' = D(P', E[P, PRa]). now he can choose an arbitrary block Y and check to see if Y = D(PRa, E[PUa, Y]).

If so, it is highly probable that P' = P. Additional blocks can be used to verify the equality.

3.8 Without the salt, the attacker can guess a password and encrypt it. If ANY of the users on a system use that password, then there will be a match. With the salt, the attacker must guess a password and then encrypt it once for each user, using the particular salt for each user.

3.9 It depends on the size of the user population, not the size of the salt, since the attacker presumably has access to the salt for each user. The benefit of larger salts is that the larger the salt, the less likely it is that two users will have the same salt. If multiple users have the same salt, then the attacker can do one encryption per password guess to test all of those users.

3.10 a. If there is only one hash function (k = 1), which produces one of N possible hash values, and there is only one word in the dictionary, then the probability that an arbitrary bit bi is set to 1 is just 1/N. If there are k hash functions, let us assume for simplicity that they produce k distinct hash functions for a given word. This assumption only introduces a small margin of error. Then, the probability that an arbitrary bit bi is set to 1 is k/N. Therefore, the probability that bi is equal to 0 is 1 – k/N. The probability that a bit is left unset after D dictionary words are processed is just the probability that each of the D transformations set other bits:

k⎞ ⎛ Pr [ bi = 0 ] = ⎜ 1− ⎟ ⎝ N⎠

D

This can also be interpreted as the expected fraction of bits that are equal to 0.

-23-

b. A word not in the dictionary will be falsely accepted if all k bits tested are equal to 1. Now, from part (a), we can say that the expected fraction of bits in the hash table that are equal to one is 1 – φ. The probability that a random word will be mapped by a single hash function onto a bit that is already set is the probability that the bit generated by the hash function is in the set of bits equal to one, which is just 1 – φ. Therefore, the probability that the k hash functions applied to the word will produce k bits all of which are in the set of bits equal to one is (1 – φ)k. c. We use the approximation (1 – x) ≈ e-x.

3.11 For a static biometric device, the user's biometric is matched to a template at the client; thus the client biometric device must be authenticated. For a dynamic biometric device, the host or server generates a random sequence of numbers, characters, or words. The user then generates a response (handwriting, voice) and the result is analyzed at the host. In this case, the client biometric device need not be authenticated.

-24-

CHAPTER 4 ACCESS CONTROL ANSWERS TO QUESTIONS 4.1 Discretionary access control (DAC) controls access based on the identity of the requestor and on access rules (authorizations) stating what requestors are (or are not) allowed to do. This policy is termed discretionary because an entity might have access rights that permit the entity, by its own volition, to enable another entity to access some resource. Mandatory access control (MAC) controls access based on comparing security labels (which indicate how sensitive or critical system resources are) with security clearances (which indicate system entities are eligible to access certain resources). This policy is termed mandatory because an entity that has clearance to access a resource may not, just by its own volition, enable another entity to access that resource.

4.2 Role-based access control (RBAC) controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles. RBAC may have a discretionary or mandatory mechanism.

4.3 Owner: This may be the creator of a resource, such as a file. For system resources, ownership may belong to a system administrator. For project resources, a project administrator or leader may be assigned ownership.

Group: In addition to the privileges assigned to an owner, a named group of users may also be granted access rights, such that membership in the group is sufficient to exercise these access rights. In most schemes, a user may belong to multiple groups.

World: The least amount of access is granted to users who are able to access the system but are not included in the categories owner and group for this resource.

4.4 A subject is an entity capable of accessing objects. Generally, the concept of subject equates with that of process. Any user or application actually gains access to an object by means of a process that represents that user or application. An object is anything to which access is controlled. Examples include files, portions of files, programs, and segments of memory.

-25-

4.5 An access right describes the way in which a subject may access an object.

4.6 For each object, an access control list lists users and their permitted access rights. A capability ticket specifies authorized objects and operations for a user.

4.7 A protection domain is a set of objects together with access rights to those objects.

4.8 RBAC0 contains the minimum functionality for an RBAC system. RBAC1 includes the RBAC0 functionality and adds role hierarchies, which enable one role to inherit permissions from another role. RBAC2 includes RBAC0 and adds constraints, which restrict the ways in which the components of a RBAC system may be configured. RBAC3 contains the functionality of RBAC0, RBAC1, and RBAC2.

4.9 User: An individual that has access to this computer system. Each individual has an associated user ID. Role: A named job function within the organization that controls this computer system. Typically, associated with each role is a description of the authority and responsibility conferred on this role, and on any user who assumes this role.

Permission: An approval of a particular mode of access to one or more objects. Equivalent terms are access right, privilege, and authorization.

Session: A mapping between a user and an activated subset of the set of roles to which the user is assigned.

4.10 Mutually exclusive roles are roles such that a user can be assigned to only one role in the set. Cardinality refers to setting a maximum number with respect to roles. A system might be able to specify a prerequisite, which dictates that a user can only be assigned to a particular role if it is already assigned to some other specified role.

4.11 SSD enables the definition of a set of mutually exclusive roles, such that if a user is assigned to one role in the set, the user may not be assigned to any other role in the set. DSD specifications limit the availability of the permissions by placing constraints on the roles that can be activated within or across a user’s sessions.

ANSWERS TO PROBLEMS -26-

4.1 a.

Read Write Own Read Write

F1 Read

A Own Read Write

F2

Own Read Write

Read

B

C Read

Write

F3

F4

Own Read Write

b. For simplicity and clarity, the labels are omitted. Also, there should be arrowed lines from each subject node to itself.

F1

S2

D1

F2

S1

D2

P1

S3

P1

c. A given access matrix generates only one directed graph, and a given directed graph yields only one access matrix, so the correspondence is one-to-one.

4.2 a. We could implement "subject" objects that are not associated with any user. The subject would be a protection domain and would have all the privileges that subject has in the access control lists. An operation on the subject object would be to allow the process to 'become" that subject. Being that subject would be equivalent to being in that protection domain. b. It is only necessary to change the system so that sets of capabilities can exist independent of a process, and a process can run in a protection domain. There would be a capability to enter each -27-

protection domain, and only processes holding that capability would be allowed to enter. You could have some capabilities associated with the process and some with the protection domain it is running in.

4.3 a. The advantage of four modes is that there is more flexibility to control access to memory, allowing finer tuning of memory protection. The disadvantage is complexity and processing overhead.

For example, procedures running at each of the access modes require separate stacks with appropriate accessibility. b. In principle, the more modes, the more flexibility, but it seems difficult to justify going beyond four.

4.4 a. With j < i, a process running in Di is prevented from accessing objects in Dj. Thus, if Dj contains information that is more privileged or is to be kept more secure than information in Di, this restriction is appropriate. However, this security policy can be circumvented in the following way. A process running in Dj could read data in Dj and then copy that data into Di. Subsequently, a process running in Di could access the information. b. An approach to dealing with this problem, known as a trusted system, is discussed in Chapter 10.

4.5 Suppose that the directory d and the file f have the same owner and group and that f contains the text something. Disregarding the superuser, no one besides the owner of f can change its contents can change its contents, because only the owner has write permission.

However, anyone in the owner's group has write permission for d, so that any such person can remove f from d and install a different version, which for most purposes is the equivalent of being able to modify f. This example is from Grampp, F., and Morris, R. "UNIX Operating System Security." AT&T Bell Laboratories Technical Journal, October 1984.

4.6 A default UNIX file access of full access for the owner combined with no access for group and other means that newly created files and directories will only be accessible by their owner. Any access for other groups or users must be explicitly granted. This is the most common default, widely used by government and business where the assumption is that a person’s work is assumed private and confidential.

A default of full access for the owner combined with read/execute access for group and none for other means newly created files and directories are accessible by all members of the owner’s group.

This is suitable when there is a team of people working together on a server, and in general most work is shared with the group.

-28-

However there are also other groups on the server for which this does not apply. An organization with cooperating teams may choose this.

A default of full access for the owner combined with read/execute access for both group and other means newly created files and directories are accessible by all users on the server. This is appropriate for organization’s where users trust each other in general, and assume that their work is a shared resource. This used to be the default for University staff, and in some research labs. It is also often the default for small businesses where people need to rely on and trust each other.

4.7 In order to provide the Web server access to a user’s ‘public_html’ directory, then search (execute) access must be provided to the user’s home directory (and hence to all directories in the path to it), read/execute access to the actual Web directory, and read access to any Web pages in it, for others (since access cannot easily be granted just to the user that runs the web server). However this access also means that any user on the system (not just the web server) has this same access. Since the contents of the user’s web directory are being published on the web, local public access is not unreasonable (since they can always access the files via the web server anyway). However in order to maintain these required permissions, if the system default is one of the more restrictive (and more common) options, then the user must set suitable permissions every time a new directory or file is created in the user’s web area. Failure to do this means such directories and files are not accessible by the server, and hence cannot be access over the web. This is a common error. As well the fact that at least search access is granted to the user’s home directory means that some information can be gained on its contents by other user’s, even if it is not readable, by attempting to access specific names. It also means that if the user accidentally grants too much access to a file, it may then be accessible to other users on the system. If the user’s files are sufficiently sensitive, then the risk of accidental leakage due to inappropriate permissions being set may be too serious to allow such a user to have their own web pages.

N

4.8 a. ∑ (Ui × Pi ) i=1 N

b. ∑ (Ui + Pi ) i=1

4.9 For a limited role hierarchy, a role is limited to a single immediate descendent. Enough links must be removed from the diagram to satisfy this requirement.

-29-

4.10 a. r1  r2 ⇒ authorized_permissions(r2) ⊆ authorized_permissions(r1) ∧ authorized_users(r2) ⊆ authorized_users(r1) b. r  r1 ∧ r  r2 ⇒ r1 = r2

4.11 a. Role(x) > Role(y) ⇔ Role(x).Position > Role(y).Position ∧ Role(x).Function = Role(y).Function b. Role(x) > Role(y) ⇔ Role(x).Position > Role(x).Function = Role(y).Function 4.12 RBAC Roles: Adult premium user role Adult regular user role Juvenile premium user role Juvenile regular user role Child premium user role Child regular user role RBAC Permissions Can view R rated new release Can view R rated old release Can view PG-13 rated new release Can view PG-13 rated old release Can view G rated new release Can view G rated old release

-30-

CHAPTER 5 DATABASE AND CLOUD SECURITY ANSWERS TO QUESTIONS 5.1 A database is a structured collection of data stored for use by one or more applications. In addition to data, a database contains the relationships between data items and groups of data items. A database management system (DBMS), which is a suite of programs for constructing and maintaining the database and for offering ad hoc query facilities to multiple users and applications. A query language provides a uniform interface to the database for users and applications.

5.2 A relational database is a collection of tables (also called relations).

Individual values in a table can be used to link one table to another.

5.3 Whereas the value of a primary key must be unique for each tuple (row) of its table, a foreign key value can appear multiple times in a table.

5.4 Centralized administration: A small number of privileged users may grant and revoke access rights.

Ownership-based administration: The owner (creator) of a table may grant and revoke access rights to the table.

Decentralized administration: In addition to granting and revoking access rights to a table, the owner of the table may grant and revoke authorization to other users, allowing them to grant and revoke access rights to the table.

5.5 The grant option enables an access right to cascade through a number of users. If a user has an access right with grant option, the user may pass the right to another user.

5.6 The inference problem arises when the combination of a number of data items is more sensitive than the individual items, or when a combination of data items can be used to infer data of a higher sensitivity.

-31-

5.7 Key management: Authorized users must have access to the decryption key for the data for which they have access. Because a database is typically accessible to a wide range of users and a number of applications, providing secure keys to selected parts of the database to authorized users and applications is a complex task.

Inflexibility: When part or all of the database is encrypted, it becomes more difficult to perform record searching.

5.8 Tier 1: Basic; 99.671% availability.

Tier 2:: Redundant components; 99.741% availability.

Tier 3 Concurrently maintainable: 99.982% availability.

Tier 4 Fault tolerant; 99.995% availability.

ANSWERS TO PROBLEMS 5.1

Course Name

Course Number

Day

Time

Faculty Name

Course 1

Course 2

Course 3

Student Name

Course 1

Course 2

Course 3

Room Number

Max Enrollment

5.2 It is clear that Climber-ID is the primary key of the table. The first row cannot be added. If violates the uniqueness property of the key because there is a Climber-ID 214 already in the table. The second row cannot be added. It violates the integrity constraint of the key because there is no value for the primary key. The third row can be added.

5.3 a. (1) Updating an owner’s name or other data must be done in (potentially) many rows (2) Possibly incorrect, inconsistent owner data across rows (change in one row, but not in another) (3) Entering correct data inconsistently (4) No place to store owner (your customer) data unless they have a pet b.

-32-

PET

OWNER

PetID

Pet Name

Type

Owner Name

Owner Phone

Owner Email

Breed

DOB

Owner Phone

5.4 CREATE TABLE student ( sid INTEGER PRIMARY KEY, sname VARCHAR (25), sphone CHAR(10) ) 5.5 a. This statement retrieves the 'id', 'forename' and 'surname' columns from the 'authors' table, returning all rows in the table that match forename = 'john' and surname = 'smith'. b. The 'query string' becomes this: SELECT id, forename, surname FROM authors WHERE forename = 'jo'hn' AND surname = 'smith' When the database attempts to run this query, it is likely to return an error. The reason is that the insertion of the 'single quote' character 'breaks out' of the single-quote delimited data. The database then tried to execute 'hn' and fails. c. The authors table will be deleted.

5.6 a. SELECT accounts FROM users WHERE login=’doe’ AND pass=’secret’ AND pin=123 b. SELECT accounts FROM users WHERE login=’’ or 1=1 -- AND pass=’’ AND pin= The code injected in the conditional (OR 1=1) transforms the entire WHERE clause into a tautology. The database uses the conditional as the basis for evaluating each row and deciding which ones to return to the application. Because the conditional is a tautology, the query evaluates to true for each row in the table and returns all of them.

The returned set evaluates to a nonnull value, which causes the application to conclude that the user authentication was successful.

Therefore, the application would invoke method displayAccounts() and show all of the accounts in the set returned by the database.

5.7 This produces the following query: SELECT accounts FROM users WHERE login=’’ UNION -33-

SELECT cardNo from CreditCards where acctNo=10032 -- AND pass=’’ AND pin= Assuming that there is no login equal to “”, the original first query returns the null set, whereas the second query returns data from the “CreditCards” table. In this case, the database would return column “cardNo” for account “10032.” The database takes the results of these two queries, unions them, and returns them to the application. In many applications, the effect of this operation is that the value for “cardNo” is displayed along with the account information.

5.8 The grant of the DELETE privilege by X at time t = 25 must be revoked because X's earliest remaining DELETE privilege was received at time t = 30. But X’s grants of READ and INSERT are allowed to remain because they are still supported by incoming grants that occurred earlier in time.

5.9 B A

t = 40

C

5.10 a. Consider the the concept of a noncascading revocation, defined as follows. Whenever user A revokes a privilege from user B, authorizations granted by B are not revoked; instead they are respecified as if they had been granted by S, the user issuing revocation. The semantics of the revocation without cascade is to produce the authorization state that would have resulted if the revoker (A) had granted the authorizations that were granted by the revokee (B). b. The disadvantage of the cascading revocation is that it can be disruptive. In many organizations the authorizations a user possesses are related to his or her particular task or function within the organization. If a user changes task or function (e.g., is promoted), it is desirable to remove only the authorizations of this user, without triggering recursive revocation of all authorizations granted by this user. The disadvantage of the noncascading revocation would be if there are instances when we would like to revoke a user's authorization and simultaneously undo any authorizations by that user. This could occur if the user comes under suspicion.

-34-

5.11 User

Permission level

Accounts payable clerk

Should be able to access and change all data.

Installation foreman

Needs to access but not change parts information. Probably does not need to have access to any vendor information except perhaps name.

Receiving clerk

Needs to be able to access and change parts information, such as number in stock. Should be able to access but not change vendor information.

5.12 We assume that there is a unique constraint on flight ID and cargo hold (to prevent scheduling two shipments for the same hold). When a user in role 2 sees that nothing is scheduled for hold C on flight 1254, the user might attempt to insert a new record to transport some vegetables on that flight. However, when he or she attempts to insert the record, the insert will fail due to the unique constraint. At this point, the user has all the data needed to infer that there is a secret shipment on flight 1254. The user could then cross-reference the flight information table to find out the source and destination of the secret shipment and various other information.

5.13 GRANT select ON inventory TO hulkhogan, undertaker; GRANT select ON item TO hulkhogan, undertaker; 5.14 Another way is to create a separate (unclassified) relation HIRE-DATES (EMP#, START-DATE). Note that EMP # rather than S# must be used as the key for the new relation, otherwise the inference is not removed.

5.15 If the first two queries are answered, then the max query is denied whenever its value is exactly equal to the ratio of the sum and the count values (which happens when all the selected rows have the same salary value). Hence the attacker learns the salary values of all the selected rows when denial occurs.

-35-

CHAPTER 6 MALICIOUS SOFTWARE ANSWERS TO QUESTIONS 6.1 The three broad mechanisms malware can use to propagate are: • infection of existing executable or interpreted content by viruses that is subsequently spread to other systems; • exploit of software vulnerabilities either locally or over a network by worms or drive-by-downloads to allow the malware to replicate; and • social engineering attacks that convince users to bypass security mechanisms to install trojans, or to respond to phishing attacks.

6.2 Four broad categories of payloads that malware may carry are: • corruption of system or data files; • theft of service in order to make the system a zombie agent of attack as part of a botnet; • theft of information from the system, especially of logins, passwords or other personal details by keylogging or spyware programs; and • stealthing where the malware hides it presence on the system from attempts to detect and block it.

6.3 The characteristics of an advanced persistent threat giving its name are: • Advanced: Use of a wide variety of intrusion technologies and malware, including the development of custom malware if required.

• Persistent: application of attacks over an extended period against the chosen target in order to maximize the chance of success.

• Threats: a result of the organized, capable, and well-funded attackers intent to compromise the specifically chosen targets.

6.4 The typical phases of operation of a virus or worm are: • a dormant phase (when the virus is idle), • a propagation phase (where it makes copies of itself elsewhere), • a triggering phase (when activated), and • an execution phase (to perform some target function).

6.5 Some mechanisms a virus can use to conceal itself include: encryption, stealth, polymorphism, metamorphism.

6.6 Machine executable viruses infect executable program files to carry out their work in a manner that is specific to a particular operating system -36-

and, in some cases, specific to a particular hardware platform. Macro viruses infect files with macro or scripting code that is used to support active content in a variety of user document types, and is interpreted by an application.

6.7 A worm may access remote systems to propagate using: an electronic mail or instant messenger facility, file sharing, remote execution capability, remote file access or transfer capability, or a remote login capability.

6.8 A “drive-by-download” exploits browser vulnerabilities so that when the user views a web page controlled by the attacker, it contains code that exploits some browser bug to download and install malware on the system without the user’s knowledge or consent. It differs from a worm since it does not actively propagate as a worm does, but rather waits for unsuspecting users to visit the malicious web page in order to spread to their systems.

6.9 A trojan is an (apparently) useful program or utility containing hidden code that, when invoked, performs some unwanted or harmful function.

A Trojan enables malware to propagate as it executes with the privileges of the person running it. Trojans are very common on both computer systems, and increasingly on mobile platforms, though much more on Android than on iOS devices.

6.10 A logic bomb is code embedded in the malware that is set to "explode" when certain conditions are met, such as the presence or absence of certain files or devices on the system, a particular day of the week or date, a particular version or configuration of some software, or a particular user running the application. When triggered, the bomb executes some payload carried by the malware.

6.11 A backdoor is a secret entry point into a program or system that allows someone who is aware of the backdoor to gain access without going through the usual security access procedures.

A bot subverts the computational and network resources of the infected system for use by the attacker.

A keylogger captures keystrokes on the infected machine, to allow an attacker to monitor sensitive information including login and password credentials.

Spyware subverts the compromised machine to allow monitoring of a wide range of activity on the system, including monitoring the history and content of browsing activity, redirecting certain web page requests to fake sites controlled by the attacker, dynamically modifying data exchanged between the browser and certain web sites of interest; -37-

which can result in significant compromise of the user’s personal information.

A rootkit is a set of programs installed on a system to maintain covert access to that system with administrator (or root) privileges, whilst hiding evidence of its presence to the greatest extent possible.

These can all be present in the same malware.

6.12 A phishing attack uses a spam e-mail to exploit social engineering to leverage user’s trust by masquerading as communications from a trusted source, that may direct a user to a fake Web site, or to complete some enclosed form and return in an e-mail accessible to the attacker. A more dangerous variant of this is the spear-phishing attack. This again is an e-mail claiming to be from a trusted source.

However, the recipients are carefully researched by the attacker, and each e-mail is carefully crafted to suit its recipient specifically, often quoting a range of information to convince them of its authenticity.

This greatly increases the likelihood of the recipient responding as desired by the attacker.

6.13 A rootkit may be placed in: user mode where it can intercept calls to APIs and modify results; in kernel mode where it can intercept kernel API calls and hide it presence in kernel tables; in a virtual machine hypervisor where it can then transparently intercept and modify states and events occurring in the virtualized system; or in some other external mode such as BIOS or in BIOS or system management mode, where it can directly access hardware.

6.14 Malware countermeasure elements include: • prevention in not allowing malware to get into the system in the first place, or blocking its ability to modify the system, via policy, awareness, vulnerability mitigation and threat mitigation; • detection to determine that it has occurred and locate the malware; • identification to identify the specific malware that has infected the system; and • removal to remove all traces of malware virus from all infected systems so that it cannot spread further.

6.15 Three places malware mitigation mechanisms may be located, are: • on the infected system, where some host-based “anti-virus” program is running, monitoring data imported into the system, and the execution and behavior of programs running on the system; • as part of the perimeter security mechanisms used in an organizations firewall and intrusion detection systems; • or it may use distributed mechanisms that gather data from both host-based and perimeter sensors, potentially over a large number -38-

of networks and organizations, in order to obtain the largest scale view of the movement of malware.

6.16 The four generations of anti-virus software are: • First generation: simple scanners that require a malware signature to identify it • Second generation: heuristic scanners use heuristic rules to search for probable malware instances, or uses integrity checking to identify changed files • Third generation: activity traps that identify malware by its actions rather than its structure in an infected program • Fourth generation: full-featured protection uses packages of a variety of anti-virus techniques used in conjunction, including scanning and activity trap components.

ANSWERS TO PROBLEMS 6.2 D is supposed to examine a program P and return TRUE if P is a computer virus and FALSE if it is not. But CV calls D. If D says that CV is a virus, then CV will not infect an executable. But if D says that CV is not a virus, it infects an executable. D always returns the wrong answer.

6.3 The original code has been altered to disrupt the signature without affecting the semantics of the code. The ineffective instructions in the metamorphic code are the second, third, fifth, sixth, and eighth.

6.4 a. The following is from Spafford, E. " The Internet Worm Program: An Analysis." Purdue Technical Report CSD-TR-823.

Common choices for passwords usually include fantasy characters, but this list contains none of the likely choices (e.g., “hobbit”, “dwarf”, “gandalf”, “skywalker”, “conan”). Names of relatives and friends are often used, and we see women's names like “jessica”, “caroline”, and “edwina”, but no instance of the common names “jennifer” or “kathy”.

Further, there are almost no men's names such as “thomas” or either of “stephen” or “steven” (or “eugene”!). Additionally, none of these have the initial letters capitalized, although that is often how they are used in passwords. Also of interest, there are no obscene words in this dictionary, yet many reports of concerted password cracking experiments have revealed that there are a significant number of users who use such words (or phrases) as passwords. The list contains at least one incorrect spelling: “commrades” instead of “comrades”; I also believe that “markus” is a misspelling of “marcus”. Some of the words do not appear in standard dictionaries and are non-English names: “jixian”, “vasant”, “puneet”, etc. There are also some unusual words in this list that I would not expect to be considered common: -39-

“anthropogenic”, “imbroglio”, “umesh”, “rochester”, “fungible”, “cerulean”, etc. b. Again, from Spafford: I imagine that this list was derived from some data gathering with a limited set of passwords, probably in some known (to the author) computing environment. That is, some dictionary-based or brute-force attack was used to crack a selection of a few hundred passwords taken from a small set of machines. Other approaches to gathering passwords could also have been used: Ethernet monitors, Trojan Horse login programs, etc. However they may have been cracked, the ones that were broken would then have been added to this dictionary.

Interestingly enough, many of these words are not in the standard online dictionary (in /usr/dict/words). As such, these words are useful as a supplement to the main dictionary-based attack the worm used as strategy #4, but I would suspect them to be of limited use before that time.

6.5 Logic bomb.

6.6 Backdoor.

6.7 The found USB memory stick may pose a range of threats to the confidentiality, integrity and availability of the work system. Each of the malware propagation mechanisms we discuss could use such a memory stick for transport. It may carry a program infected with an executable virus, or document infected with a macro virus, which if run or opened can allow the virus to run and spread. It could carry a malicious worm that may be run automatically using the autorun capability, or by exploiting some vulnerability when the USB stick is viewed. Or it could contain a trojan horse program or file that would threaten the system if installed or allowed to run. You can mitigate these threats, and try to safely determine the contents of the memory stick, by scanning the memory stick with suitable, up-to-date anti-virus software for any signs of malware – though this will not detect unknown, zero-day exploits.

You could examine the memory stick in a controlled environment, such as a live-boot linux or other system, or in some emulation environment, which cannot be changed even if the malware does manage to run.

6.8 Observations of your home PC is responding very slowly, with high levels of network activity, may indicate the presence of malware, likely including bot code, on the system. The slow response and net traffic could be caused by it participating in a botnet, perhaps distributing spam emails, performing DDoS attacks, or other malicious activities.

This malware could have gained access to the system as a result of installing some trojan program perhaps advertised in spam email or on a compromised website, from a drive-by-download, or from exploit of -40-

some vulnerability on the system by a worm. Possible steps to check whether this has occurred include examining the process/task list for unknown programs executing, looking at logs of network traffic kept by a host firewall program to see which programs are generating traffic, or scanning the system with suitable, up-to-date anti-virus software for any signs of malware – though this will not detect unknown, zero-day exploits. If you do identify malware on your PC, you may be able to restore it to safe operation using suitable, up-to-date anti-virus software, provided the malware is known. Otherwise you may have to erase all storage and rebuild the system from scratch.

6.9 If a user installs some custom codec claimed needed to view some videos, they may actually be installing trojan horse code. It may indeed allow viewing of the video, or may just be an excuse to compromise the system. Such code may pose a range of threats to the confidentiality, integrity and availability of the system. It may include backdoor, bot, keylogger, spyware, rootkit or indeed any other malware payloads.

6.10 If when you download and start to install some game app, you are asked to approve the access permissions “Send SMS messages” and to “Access your address-book”, you should indeed be suspicious that a game wants these types of permissions, as it would not seem needed just for a game. Rather it could be malware that wants to collect details of all your contacts, and either return them to the attacker via SMS, or allow the code to send SMS messages to your contacts, perhaps enticing them to also download and install this malware. Such code is a trojan horse, since it contains covert functions as well as the advertised functionality.

6.11 If you should open the PDF attachment, then it could contain malicious scripting code that could run should you indeed select the ‘Open’ button. This may be either worm (specifically exploiting a client-side vulnerability), or trojan horse code. You could you check your suspicions without threatening your system by using the scroll bar to examine all the code about to be executed should you select the ‘Open’ button, and see if it looks suspicious. You could also scan the PDF document with suitable, up-to-date anti-virus software for any signs of malware – though this will not detect unknown, zero-day exploits. This type of message is associated with a spear-phishing attack, given that the email was clearly crafted to suit the recipient.

That particular e-mail would only have been sent to one or a few people for whom the details would seem plausible.

6.12 This email is attempting a general phishing attack, being sent to very large numbers of people, in the hope that a sufficient number both use the named bank, and are fooled into divulging their sensitive login -41-

credentials to the attacker. The most likely mechanism used to distribute this e-mail is via a botnet using large numbers of compromised systems to generate the necessary high volumes of spam emails. You should never ever follow such a link in an email and supply the requested details. You should only ever access sensitive sites by directly entering their known URL into your browser. It may be appropriate to forward a copy of such emails to a relevant contact at the bank if they ask for this. Otherwise it should just be deleted.

6.13 Such a letter strongly suggests that an attacker has collected sufficient personal details about you in order to satisfy the finance company that they are you for the purpose of establishing such a loan. Having taken the money, they have then left you responsible for the repayments.

This was most likely done using either a phishing attack, perhaps persuading you to complete and return some form with the needed personal details; or by using spyware installed on your personal computer system by a worm or trojan horse malware, that then collected the necessary details from files on the system, or by monitoring your access to sensitive sites, such as banking sites.

6.14 A (host-based) personal firewall monitors and controls network traffic flowing between the host and the net, and can help protect against exploit of remotely accessible network server vulnerabilities by blocking access to all but required services. Anti-virus software helps protect against the import and use of malware however it enters the system. Anti-virus software helps block the spread of macro viruses spread using email attachments. A (host-based) personal firewall could block the use of backdoors on the system.

-42-

CHAPTER 7 DENIAL-OF-SERVICE ATTACKS ANSWERS TO QUESTIONS 7.1 A denial of service (DoS) attack is an action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU), memory, bandwidth, and disk space.

7.2 Resources that could be attacked include any limited resources such as: network bandwidth, system resources, or application resources.

7.3 The goal of a flooding attack is generally to overload the network capacity on some link to a server, or alternatively to overload the server’s ability to handle and respond to this traffic.

7.4 Virtually any type of network packet can be used in a flooding attack, though common flooding attacks use ICMP, UDP or TCP SYN packet types.

7.5 Many DoS attacks use packets with spoofed source addresses so any responses packets that result are no longer be reflected back to the original source system, but rather are scattered across the Internet to all the various forged source addresses. Some of these addresses might correspond to real systems, others may not be used, or not reachable.

Any response packets returned as a result only add to the flood of traffic directed at the target system.

7.6 “backscatter traffic” are packets generated in response to a DoS attack packet with a forged random source address, e.g. the ICMP echo response from an ICMP echo request being used to flood a link.

Monitoring these packets, which are randomly distributed over the Internet, gives valuable information on the type and scale of attacks.

This backscatter traffic provides information on any DoS attacks that use a forged random source address with the destination address being the target, including various single and distributed flooding attacks, and syn spoofing attacks. It does not provide information on attacks that do -43-

not use randomly forged source addresses, or reflection or amplification attacks where the forged source address is that of the desired target.

7.7 A distributed denial of service (DDoS) attack uses multiple attacking systems, often using compromised user workstations or PC’s. Large collections of such systems under the control of one attacker can be created, collectively forming a “botnet”. By using multiple systems, the attacker can significantly scale up the volume of traffic that can be generated. Also by directing the attack through intermediaries, the attacker is further distanced from the target, and significantly harder to locate and identify.

7.8 Distributed denial of service (DDoS) attack botnets typically use a control hierarchy, where a small number of systems act as handlers controlling a much larger number of agent systems, as shown in Figure 7.4. These have are a number of advantages, as the attacker can send a single command to a handler, which then automatically forwards it to all the agents under its control. Automated infection tools can also be used to scan for and compromise suitable zombie systems.

7.9 In a reflection attack, the attacker sends a network packet with a spoofed source address to a service running on some network server, that responds to the spoofed source address that belongs to the actual attack target. If the attacker sends a number of such spoofed requests to a number of servers, the resulting flood of responses can overwhelm the target’s network link. The fact that normal server systems are being used as intermediaries, and that their handling of the packets is entirely conventional, means these attacks can be easier to deploy, and harder to trace back to the actual attacker.

7.10 An amplification attack involves sending packets to intermediaries with a spoofed source address for the target system. They differ in generating multiple response packets for each original packet sent, typically by directing the original request to the broadcast address for some network. Alternatively they use a service, often DNS, that can generate a much larger response packet than the original request.

7.11 The primary defense against many DoS attacks is to prevent source address spoofing. This must be implemented close to the source of any packet, when the real address (or at least network) is known. Typically this is the ISP providing the network connection for an organization or home user. It knows which addresses are allocated to all its customers, and hence is best placed to ensure that valid source addresses are used in all packets from its customers.

-44-

7.12 Non-spoofed flooding attacks are best defended against by the provision of significant excess network bandwidth and replicated distributed servers, particularly when the overload is anticipated. This does have a significant implementation cost though. Rate limits of various types on traffic can also be imposed. However such attacks cannot be entirely prevented, and may occur “accidentally” as a result of very high legitimate traffic loads.

7.13 It is possible to specifically defend against the SYN spoofing attack by using a modified version of the TCP connection handling code, which instead of saving the connection details on the server, encodes critical information in a “cookie” sent as the server’s initial sequence number.

When a legitimate client responds with an ACK packet, the server is able to reconstruct this information. Typically this technique is only used when the table overflows, as it does take computation resources on the server, and also blocks the use of certain TCP extensions.

7.14 Like all the reflection-based attacks, the basic defense against DNS amplification attacks is to prevent the use of spoofed source addresses. This filtering needs to be done as close to the source as possible, by routers or gateways knowing the valid address ranges of incoming packets. Typically this is the ISP providing the network connection for an organization or home user. Otherwise, appropriate configuration of DNS servers, in particular limiting recursive responses to internal client systems only, as described in RFC 5358, can restrict some variants of DNS amplification attacks.

7.15 To prevent an organization’s systems being used as intermediaries in a broadcast amplification attack, the best defense is to block the use of IP directed broadcasts. This can be done either by the ISP, or by any organization whose systems could potentially be used as an intermediary.

7.16 The terms slashdotted or flash crowd refer to very large volumes of legitimate traffic, as result of high publicity about a specific site, often as a result of a posting to the well-known Slashdot or other similar news aggregation site. There is very little that can be done to prevent this type of either accidental or deliberate overload, without also compromising network performance. The provision of significant excess network bandwidth and replicated distributed servers is the usual response as noted in question 7.12.

7.17 In order to successfully respond to a denial of service attack, a good incident response plan is needed to provide guidance. When a denial of service attack is detected, the first step is to identify the type of attack and hence the best approach to defend against it. From this analysis -45-

the type of attack is identified, and suitable filters designed to block the flow of attack packets. These have to be installed by the ISP on their routers. If the attack targets a bug on a system or application, rather than high traffic volumes, then this must be identified, and steps taken to correct it to prevent future attacks. In the case of an extended, concerted, flooding attack from a large number of distributed or reflected systems, it may not be possible to successfully filter enough of the attack packets to restore network connectivity. In such cases the organization needs a contingency strategy to switch to alternate backup servers, or to rapidly commission new servers at a new site with new addresses, in order to restore service.

7.18 The organization may wish to trace the source of various types of packets used in a DoS attack. If non-spoofed addresses are used, this is easy. However if spoofed sources addresses are used, this can be difficult and time-consuming, as their ISP will need to trace the flow of packets back in an attempt to identify their source. This is generally neither easy nor automated, and requires cooperation from the network providers these packets traverse.

ANSWERS TO PROBLEMS 7.1 In a DoS attack using ICMP Echo Request (ping) packets 500 bytes in size, to flood a target organization using a 0.5 Megabit per second (Mbps) link the attacker needs 500000 / (500 × 8) = 125 packets per second. On a 2-Mbps link its 2000000 / (500 × 8) = 500 packets per second. On a 10-Mbps link its 10000000 / (500 × 8) = 2500 packets per second.

7.2 For a TCP SYN spoofing attack, on a system with a table for 256 connection requests, that will retry 5 times at 30 second intervals, before purging the request from its table, each connection request occupies a table entry for 6 × 30 secs (initial + 5 repeats) = 3 min. In order to ensure that the table remains full, the attacker must continue to send 256/ 3 or about 86 TCP connection requests per minute?

Assuming the TCP SYN packet is 40 bytes in size, this consumes about 86 × 40 × 8 / 60, which is about 459 bits per second, a negligible amount.

7.3 In the distributed variant of the attack from Problem 7.1, a single zombie PC can send 128000 / (500 × 8) = 32 packets per second. About 4 such zombie systems are needed to flood a target organization using a 0.5 Megabit per second (Mbps) link, looking either at 500kbps / 128 kbps, or 125 / 32 packets per sec. For a 2Mbps link about 16 are needed (500/32 pps), for a 10-Mbps link about 79 are needed (2500/32 -46-

pps). Given reports of botnets composed of many thousands of zombie systems, clearly multiple such simultaneously DDoS attacks are possible. As is an attack on a major organization with multiple, much larger network links (e.g. 1000 zombies with 128-kbps links can flood 128 Mbps of network link capacity).

7.4 The answers for the DNS amplification attack are the same as in Problem 7.1. On a 0.5-Mbps link, 125 packets, each of 500 bytes, are needed per second. 500 pps are needed to flood a 2-Mbps link, and 2500 pps to flood a 10-Mbps link. Assuming a 60-byte DNS request packet then 125 × 60 × 8 = 60 kbps is needed to trigger the flood on a 0.5-Mbps link, 240 kbps to flood the 2-Mbps link, and 1.2 Mbps to flood the 10-Mbps link. In all cases the amplification is 500 / 60 = 8.3 times.

7.5 The answer to this question depends on the operating system (and version) chosen, however SYN Cookies are now supported on many systems.

7.6 The answer to this question also depends on the type of router investigated, but again these features are common on enterprise grade devices.

7.7 In this future idealized more secure network, administrators of server systems still do need to be concerned about, and take further countermeasures against, DoS attacks. Attacks using real addresses from real systems with high bandwidth network connections are still possible, as are “flash-crowd” overloads as a result of, possible fraudulent, publicity.

To reduce the impact of such attacks, measures are needed to manage intermittent high traffic volumes, as mentioned in review questions 7.11 and 7.13.

7.8 The results of practical lab experiments such as these depend on the facilities and equipment available.

-47-

CHAPTER 8 INTRUSION DETECTION ANSWERS TO QUESTIONS 8.1

Four classes of intruders we discuss are: • Cyber criminals are either individuals or members of an organized crime group with a goal of financial reward; • Activists: are either individuals, usually working as insiders, or members of a larger group of outsider attackers, who are motivated by social or political causes; • State-sponsored organizations: are groups of hackers sponsored by governments to conduct espionage or sabotage activities. They are also known as Advanced Persistent Threats (APTs), due to the covert nature and persistence over extended periods involved with many attacks in this class; and • Others: are hackers with motivations other than those listed above, including classic hackers or crackers who are motivated by technical challenge or by peer-group esteem and reputation.

8.2

The steps typically used by intruders when attacking a system are: • Target Acquisition and Information Gathering: where the attacker identifies and characterizes the target systems using publicly available information, both technical and non-technical, and the use network exploration tools to map target resources; • Initial Access: typically by exploiting a remote network vulnerability, by guessing weak authentication credentials used in a remote service, or via the installation of malware on the system using some form of social engineering or drive-by-download attack; • Privilege Escalation: are actions taken on the system, typically via a local access vulnerability to increase the privileges available to the attacker to enable their desired goals on the target system; • Information Gathering or System Exploit: are actions by the attacker to access or modify information or resources on the system, or to navigate to another target system; • Maintaining Access: are actions such as the installation of backdoors or other malicious software, or the addition of covert authentication credentials or other configuration changes to the system, to enable continued access by the attacker after the initial attack.

-48-

•

8.3

Covering Tracks: where the attacker disables or edits audit logs to remove evidence of attack activity, and uses rootkits and other measures to hide covertly installed files or code

Table 8.1 lists examples of activities associated with each of the attack steps that may be used by an intruder. Pick any item from each part.

8.4 Sensors: Sensors are responsible for collecting data. The input for a sensor may be any part of a system that could contain evidence of an intrusion. Types of input to a sensor include network packets, log files, and system call traces. Sensors collect and forward this information to the analyzer.

Analyzers: Analyzers receive input from one or more sensors or from other analyzers. The analyzer is responsible for determining if an intrusion has occurred. The output of this component is an indication that an intrusion has occurred. The output may include evidence supporting the conclusion that an intrusion occurred. The analyzer may provide guidance about what actions to take as a result of the intrusion.

User interface: The user interface to an IDS enables a user to view output from the system or control the behavior of the system. In some systems, the user interface may equate to a manager, director, or console component.

8.5 Host-based IDS: Monitors the characteristics of a single host and the events occurring within that host for suspicious activity Network-based IDS: Monitors network traffic for particular network segments or devices and analyzes network, transport, and application protocols to identify suspicious activity Distributed or hybrid IDS: Combines information from a number of sensors, often both host and network-based, in a central analyzer that is able to better identify and respond to intrusion activity.

8.6 1. If an intrusion is detected quickly enough, the intruder can be identified and ejected from the system before any damage is done or any data are compromised. Even if the detection is not sufficiently timely to preempt the intruder, the sooner that the intrusion is detected, the less the amount of damage and the more quickly that recovery can be achieved.

2. An effective intrusion detection system can serve as a deterrent, so acting to prevent intrusions.

3. Intrusion detection enables the collection of information about intrusion techniques that can be used to strengthen the intrusion prevention facility.

8.7 A false positive, or false alarm, is where authorized users are identified as intruders by an IDS. A false negative is when intruders -49-

are not identified as intruders by an IDS, as a result of a tighter interpretation of intruder behavior in an attempt to limit false positives.

8.8 The base-rate fallacy occurs when there is an attempt to detect a phenomenon that occurs rarely. The frequency of occurrence is referred to as the base rate. When the base rate is very low, it is difficult to achieve low levels of both false positives and false negatives.

8.9 •Run continually with minimal human supervision.

•Be fault tolerant in the sense that it must be able to recover from system crashes and reinitializations.

•Resist subversion. The IDS must be able to monitor itself and detect if it has been modified by an attacker.

•Impose a minimal overhead on the system where it is running.

•Be able to be configured according to the security policies of the system that is being monitored.

•Be able to adapt to changes in system and user behavior over time.

•Be able to scale to monitor a large number of hosts.

•Provide graceful degradation of service in the sense that if some components of the IDS stop working for any reason, the rest of them should be affected as little as possible.

•Allow dynamic reconfiguration; that is, the ability to reconfigure the IDS without having to restart it.

8.10 Anomaly detection involves the collection of data relating to the behavior of legitimate users over a period of time. Then statistical tests are applied to observed behavior to determine with a high level of confidence whether that behavior is not legitimate user behavior.

Signature or Heuristic detection uses a set of known malicious data patterns (signatures) or attack rules (heuristics) that are compared with current behavior to decide if is that of an intruder. It is also known as misuse detection. This approach can only identify known attacks for which it has patterns or rules.

8.11 The three broad categories of classification approaches used by anomaly detection systems are: • Statistical: Analysis of the observed behavior using univariate, multivariate, or time-series models of observed metrics.

• Knowledge based: Approaches use an expert system that classifies observed behavior according to a set of rules that model legitimate behavior.

• Machine learning: Approaches automatically determine a suitable classification model from the training data using data mining techniques.

-50-

8.12 A number of machine-learning approaches used in anomaly detection systems include: • Bayesian networks: Encode probabilistic relationships among observed metrics.

• Markov models: Develop a model with sets of states, some possibly hidden, interconnected by transition probabilities.

• Neural networks: Simulate human brain operation with neurons and synapse between them, that classify observed data.

• Fuzzy logic: Uses fuzzy set theory where reasoning is approximate, and can accommodate uncertainty.

• Genetic algorithms: Uses techniques inspired by evolutionary biology, including inheritance, mutation, selection and recombination, to develop classification rules.

• Clustering and outlier detection: Group the observed data into clusters based on some similarity or distance measure, and then identify subsequent data as either belonging to a cluster or as an outlier.

8.13 Signature approaches match a large collection of known patterns of malicious data against data stored on a system or in transit over a network. Rule-based heuristic identification involves the use of rules for identifying known penetrations or penetrations that would exploit known weaknesses. Rules can also be defined that identify suspicious behavior, even when the behavior is within the bounds of established patterns of usage.

8.14 Some data sources used in a HIDS are: • System call traces: A record of the sequence of systems calls by processes on a system; • Audit (log file) records: Most modern operating systems include accounting software that collects information on user activity; • File integrity checksums: Periodically scan critical files for changes from the desired baseline by comparing a current cryptographic checksums for these files, with a record of known good values; • Registry access: An approach used on Windows systems is to monitor access to the registry, given the amount of information and access to it used by pro- grams on these systems.

8.15 Signature and heuristic HIDS are currently more commonly deployed, particularly on Windows systems, due to the difficulty in gathering suitable data to use in anomaly HIDS, and because of the load placed on the system to gather and classify this data. Signature or heuristic based HIDS are widely used, particularly as seen in anti-virus (A/V), more correctly viewed as anti-malware, products. These are very commonly used on Windows systems, and also incorporated into mail -51-

and web application proxies on firewalls and in network based IDSs. These products are quite efficient at detecting known malware, however they are not capable of detecting zero-day attacks that do not correspond to the known signatures or heuristic rules.

8.16 A Distributed HIDS provide a more effective defense by coordination and cooperation among HIDSs across the network.

8.17 An inline sensor is inserted into a network segment so that the traffic that it is monitoring must pass through the sensor. A passive sensor monitors a copy of network traffic; the actual traffic does not pass through the device.

8.18 Possible locations for NIDs sensors are: • just inside the external firewall; • between the external firewall and the Internet or WAN; • at the entrance to major backbone networks; • on workstation LANs. 8.19 As with host-based intrusion detection, network-based intrusion detection makes use of signature detection and anomaly detection.

Unlike the case with HIDS, a number of commercial anomaly NIDS products are available, as well as more traditional signature detection systems.

8.20 A distributed or hybrid IDS combines in a central IDS, the complementary information sources used by HIDS with host-based process and data details, and NIDS with network events and data, to manage and coordinate intrusion detection and response in an organization’s IT infrastructure.

8.21 Honeypots are decoy systems that are designed to lure a potential attacker away from critical systems.

8.22 Honeypots are typically classified as being either a: • Low interaction honeypot: a software package that emulates particular IT services or systems well enough to provide a realistic initial interaction, but does not execute a full version of those services or systems.

• High interaction honeypot: a real system, with a full operating system, services and applications, which are instrumented and deployed where they can be accessed by attackers.

ANSWERS TO PROBLEMS -52-

8.1 Types of publicly available information that could be used by an attacker include: information required by law such as business registration and contact details or share registration details; contact information in phone books, DNS entries, network registration and WHOIS details; publicity and contact details provided by an organization on their website, or in publications handed out to the public. This suggests that from a security perspective, the content and detail of such information should be minimized. But this may well conflict with the organization’s business and legal requirements to make this information available? It can be very difficult to reconcile these conflicting demands, though the appropriate balance may be suggested by the results of a risk assessment of the organization which may identify which types of information may be particularly dangerous. It may be possible to remove details of individual’s names and positions, which would be of use in a spear-phishing attack, and use generic position details instead.

8.2 This is a typical example:

8.3 Choosing sensor locations for a wireless IDP deployment is a fundamentally different problem than choosing locations for any other type of IDP sensor. If the organization uses WLANs, wireless sensors should be deployed so that they monitor the RF range of the organization’s WLANs (both APs and STAs), which often includes mobile components such as laptops and PDAs. Many organizations also want to deploy sensors to monitor physical regions of their facilities where there should be no WLAN activity, as well as channels and bands that the organization’s WLANs should not use, as a way of detecting rogue APs and ad hoc WLANs. Other considerations for selecting wireless sensor locations include the following: Physical Security. Sensors are often deployed into open locations (e.g., hallway ceilings, conference rooms) because their range is much greater there than in closed locations (e.g., wiring closets). Sensors are sometimes deployed outdoors as well.28 Generally, sensors in open -53-

interior locations and external locations are more susceptible to physical threats than other sensors. If the physical threats are significant, organizations might need to select sensors with anti-tamper features or deploy sensors where they are less likely to be physically accessed (e.g., within view of a security camera).

Sensor Range. The actual range of a sensor varies based on the surrounding facilities (e.g., walls, doors). Some wireless IDP vendors offer modeling software that can analyze building floor plans and the attenuation characteristics of walls, doors, and other facility components to determine effective locations for sensors. Sensor range can also vary based on the location of people within the facility and other changing characteristics, so sensors should be deployed so that their ranges have some overlap (e.g., at least 20%).

Wired Network Connections. The sensors typically need to be connected to the wired network. If there is a need to deploy sensors in an area where there is no wired network, then it might be necessary to extend the wired network into that area. This is generally a concern only if the organization wants to monitor portions of their facilities that are outside the range of the WLAN. Cost. Ideally, an organization could deploy sensors throughout its facilities to perform full wireless monitoring. However, the number of sensors needed to do so can be quite large, especially in wide-open campus environments. Organizations should compare WLAN threats to the cost of sensor purchases, deployment, and maintenance, and develop a solution that creates an acceptable level of risk. For example, an organization might decide to deploy fixed sensors throughout the range of the organization’s WLANs, and to do periodic checks of other areas using mobile sensors.

AP and Wireless Switch Locations. If a bundled solution (e.g., wireless IDP software on an AP) would meet the organization’s other requirements, then the locations of APs and wireless switches are particularly important because the wireless IDP software could potentially be deployed onto those devices.

8.4 a. This rule wants to catch attempts to create a new database instance.

Line 1, the rule header, states that interesting packets are flowing from external IP addresses for database servers responding on Oracle ports. Line 2 is the text alert to be reported. Line 3 defines two additional matching conditions: first, packets must be directed to a server and must be part of an already established TCP connection, and second, the case-independent string "create database" must be contained in the packet payload. b. Typically, a system administrator would configure a system to forbid database creation from across the Internet. Such attempts would be blocked by the firewall. The external NIDS would simply be a way of segregating out such attacks and alerting on them. If the NIDS is -54-

inside the firewall, it would be able to catch a serious deficiency in firewall behavior.

8.5 a. The graph below doesn't look like a correct probability distribution and is instead labeled as event distribution. The point here is that even if you have nice, mostly non-overlapping probability distributions for distinguishing intruders and authorized users like Figure 8.1, the problem is for most systems we hope the actual numbers of intruders is dwarfed by the number of authorized users.

This means that the long tail of the authorized users distribution that overlaps with the intruders distribution would generate lots of false positives (relative to the number of real intruders detected) even if it is only a few percent of the authorized users.

Event distribution profile of authorized user behavior

overlap in observed or expected behavior

profile of intruder behavior

Measurable behavior parameter b. A randomly selected event that in the overlap region is (roughly) 95% likely to be an authorized user, even though the region covers 50% of the intruders probability distribution.

8.6 A file integrity checking tool such as tripwire can be very useful in identifying changed files or directories on a system, particularly when those change should not have occurred. However most computer systems are not static, and significant numbers of files do change constantly. Hence it is necessary to configure tripwire with a list of files and directories to monitor, since otherwise reports to the administrator -55-

would be filled with lists of files that are changing as a matter of normal operation of the system. It is not too difficult to monitor a small list of critical system programs, daemons and configuration files. Doing this means attempts to alter these files will likely be detected. However the large areas of the system not being monitored means an attacker changing or adding files in these areas will not be detected. The more of the system that is to be monitored, the more care is needed to identify only files not expected to change. Even then, it is likely that user’s home areas, and other shared document areas, cannot be monitored, since they are likely to be creating and changing files in there regularly.

As well, there needs to be a process to manage the update of monitored files (as a result of installing patches, upgrades, new services, configuration changes etc). This process has to verify that the changed files are correct, and then update the cryptographic checksums of these files. Lastly the database of cryptographic checksums must be protected from any attempt by an attacker to corrupt it, ideally by locating on read-only media (except when controlled updates are occurring).

8.7 This is a conditional probability problem. Total possible combinations for threat level Medium are: (P3, P4), (P4, P3) out of a total number of combinations = 16 – [Number of Events with neither of the two nodes generating a P3 signature] = 16 – 9 = 7 All Possibilities: (P1, P1)(P1, P2), (P1, P3)(P1, P4)(P2, P1)(P2, P2)(P2, P3)(P2, P4)(P3, P1)(P3, P2)(P3, P3)(P3, P4)(P4, P1)(P4, P2)(P4, P3) (P4, P4) Therefore, the Probability is = 2/7 Or Let A = {1 P3 and 1 P4}, B = {at least one is P3} Pr[A|B] = Pr[AB]/ P[B] Pr[AB] is the probability that one outcome is P3 and one outcome is P4 AND that at least one outcome is P3, is 2/16, and the probability of getting at least one P3 is 7/16, therefore, the Pr[A|B] = [2/16]/[7/16] = 2/7 8.8 Let WB equal the event {witness reports Blue cab}. Then: Pr[Blue WB] = =

Pr[WB Blue ]Pr[ Blue ] Pr[WB Blue ]Pr[ Blue ] + Pr[WB Green]Pr[Green]

( 0.8 )(0.15) = 0. 41 (0.8)(0.15) + ( 0.2 )( 0.85)

This example, or something similar, is referred to as "the juror's fallacy."

-56-

CHAPTER 9 FIREWALLS AND INTRUSION PREVENTION SYSTEMS ANSWERS TO QUESTIONS 9.1 1. All traffic from inside to outside, and vice versa, must pass through the firewall. This is achieved by physically blocking all access to the local network except via the firewall. Various configurations are possible, as explained later in this section.

2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. Various types of firewalls are used, which implement various types of security policies, as explained later in this section.

3. The firewall itself is immune to penetration. This implies that use of a trusted system with a secure operating system.

9.2 IP Address and Protocol Values: Controls access based on the source or destination addresses and port numbers, direction of flow being inbound or outbound, and other network and transport layer characteristics.

Application Protocol: Controls access on the basis of authorized application protocol data.

User Identity: Controls access based on the users identity, typically for inside users who identify themselves using some form of secure authentication technology, such as IPSec. Network Activity: Controls access based on considerations such as the time or request, or other activity patterns.

9.3 Source IP address: The IP address of the system that originated the IP packet.

Destination IP address: The IP address of the system the IP packet is trying to reach.

Source and destination transport-level address: The transport level (e.g., TCP or UDP) port number, which defines applications such as SNMP or TELNET. IP protocol field: Defines the transport protocol.

Interface: For a router with three or more ports, which interface of the router the packet came from or which interface of the router the packet is destined for.

-57-

9.4 1. Because packet filter firewalls do not examine upper-layer data, they cannot prevent attacks that employ application-specific vulnerabilities or functions. For example, a packet filter firewall cannot block specific application commands; if a packet filter firewall allows a given application, all functions available within that application will be permitted.

2. Because of the limited information available to the firewall, the logging functionality present in packet filter firewalls is limited. Packet filter logs normally contain the same information used to make access control decisions (source address, destination address, and traffic type).

3. Most packet filter firewalls do not support advanced user authentication schemes. Once again, this limitation is mostly due to the lack of upper-layer functionality by the firewall.

4. They are generally vulnerable to attacks and exploits that take advantage of problems within the TCP/IP specification and protocol stack, such as network layer address spoofing. Many packet filter firewalls cannot detect a network packet in which the OSI Layer 3 addressing information has been altered. Spoofing attacks are generally employed by intruders to bypass the security controls implemented in a firewall platform.

5. Finally, due to the small number of variables used in access control decisions, packet filter firewalls are susceptible to security breaches caused by improper configurations. In other words, it is easy to accidentally configure a packet filter firewall to allow traffic types, sources, and destinations that should be denied based on an organization's information security policy.

9.5 A traditional packet filter makes filtering decisions on an individual packet basis and does not take into consideration any higher layer context. A stateful inspection packet filter tightens up the rules for TCP traffic by creating a directory of outbound TCP connections, as shown in Table 9.2. There is an entry for each currently established connection. The packet filter will now allow incoming traffic to highnumbered ports only for those packets that fit the profile of one of the entries in this directory 9.6 An application-level gateway, also called a proxy server, acts as a relay of application-level traffic.

9.7 A circuit-level gateway does not permit an end-to-end TCP connection; rather, the gateway sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. Once the two connections are established, the gateway typically relays TCP segments from one connection to the other without examining the contents. The security function consists of determining which connections will be allowed.

-58-

9.8 Packet filtering firewall: Applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet.

Stateful inspection firewall: Tightens up the rules for TCP traffic by creating a directory of outbound TCP connections, as shown in Table 9.2. There is an entry for each currently established connection. The packet filter will now allow incoming traffic to high-numbered ports only for those packets that fit the profile of one of the entries in this directory.

Application proxy firewall: Acts as a relay of application-level traffic (Figure 9.1d). The user contacts the gateway using a TCP/IP application, such as Telnet or FTP, and the gateway asks the user for the name of the remote host to be accessed. When the user responds and provides a valid user ID and authentication information, the gateway contacts the application on the remote host and relays TCP segments containing the application data between the two endpoints. If the gateway does not implement the proxy code for a specific application, the service is not supported and cannot be forwarded across the firewall. Further, the gateway can be configured to support only specific features of an application that the network administrator considers acceptable while denying all other features Circuit-level proxy firewall: As with an application gateway, a circuitlevel gateway does not permit an end-to-end TCP connection; rather, the gateway sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. Once the two connections are established, the gateway typically relays TCP segments from one connection to the other without examining the contents. The security function consists of determining which connections will be allowed.

9.9 • The bastion host hardware platform executes a secure version of its operating system, making it a hardened system.

• Only the services that the network administrator considers essential are installed on the bastion host. These could include proxy applications for DNS, FTP, HTTP, and SMTP. • The bastion host may require additional authentication before a user is allowed access to the proxy services. In addition, each proxy service may require its own authentication before granting user access.

• Each proxy is configured to support only a subset of the standard application’s command set.

• Each proxy is configured to allow access only to specific host systems.

This means that the limited command/feature set may be applied only to a subset of systems on the protected network.

• Each proxy maintains detailed audit information by logging all traffic, each connection, and the duration of each connection. The audit log is an essential tool for discovering and terminating intruder attacks.

-59-

• Each proxy module is a very small software package specifically designed for network security. Because of its relative simplicity, it is easier to check such modules for security flaws. For example, a typical UNIX mail application may contain over 20,000 lines of code, while a mail proxy may contain fewer than 1000.

• Each proxy is independent of other proxies on the bastion host. If there is a problem with the operation of any proxy, or if a future vulnerability is discovered, it can be uninstalled without affecting the operation of the other proxy applications. Also, if the user population requires support for a new service, the network administrator can easily install the required proxy on the bastion host.

• A proxy generally performs no disk access other than to read its initial configuration file. Hence, the portions of the file system containing executable code can be made read only. This makes it difficult for an intruder to install Trojan horse sniffers or other dangerous files on the bastion host.

• Each proxy runs as a nonprivileged user in a private and secured directory on the bastion host.

9.10 • Filtering rules can be tailored to the host environment. Specific corporate security policies for servers can be implemented, with different filters for servers used for different application.

• Protection is provided independent of topology. Thus both internal and external attacks must pass through the firewall.

• Used in conjunction with stand-alone firewalls, the host-based firewall provides an additional layer of protection. A new type of server can be added to the network, with its own firewall, without the necessity of altering the network firewall configuration.

9.11 Between internal and external firewalls are one or more networked devices in a region referred to as a DMZ (demilitarized zone) network.

Systems that are externally accessible but need some protections are usually located on DMZ networks. Typically, the systems in the DMZ require or foster external connectivity, such as a corporate Web site, an e-mail server, or a DNS (domain name system) server.

9.12 An external firewall is placed at the edge of a local or enterprise network, just inside the boundary router that connects to the Internet or some wide area network (WAN). One or more internal firewalls protect the bulk of the enterprise network.

9.13 An IPS blocks traffic, as a firewall does, but makes use of the types of algorithms developed for IDSs.

-60-

9.14 Like an IDS, an IPS can be host-based, network-based, or distributed/hybrid combining information from a range of host and network based sensors.

9.15 Once an IPS has detected malicious activity, it can respond by modifying or blocking network packets across a perimeter or into a host, or by modifying or blocking system calls by programs running on a host.

9.16 A UTM performs network firewalling, network intrusion detection and prevention and gateway anti-virus.

ANSWERS TO PROBLEMS 9.1 It will be impossible for the destination host to complete reassembly of the packet if the first fragment is missing, and therefore the entire packet will be discarded by the destination after a time-out.

9.2 When a TCP packet is fragmented so as to force interesting header fields out of the zero-offset fragment, there must exist a fragment with FO equal to 1. If a packet with FO = 1 is seen, conversely, it could indicate the presence, in the fragment set, of a zero-offset fragment with a transport header length of eight octets Discarding this one-offset fragment will block reassembly at the receiving host and be as effective as the direct method described above.

9.3 If the router's filtering module enforces a minimum fragment offset for fragments that have non-zero offsets, it can prevent overlaps in filter parameter regions of the transport headers.

9.4 1. Allow return TCP Connections to internal subnet.

2. Prevent Firewall system itself from directly connecting to anything.

3. Prevent External users from directly accessing the Firewall system.

4. Internal Users can access External servers, 5. Allow External Users to send email in.

6. Allow External Users to access WWW server.

7. Everything not previously allowed is explicitly denied.

9.5 a. Rules A and B allow inbound SMTP connections (incoming email) Rules C and D allow outbound SMTP connections (outgoing email) Rule E is the default rule that applies if the other rules do not apply. b. Packet 1: Permit (A); Packet 2: Permit (B): Packet 3: Permit (C) Packet 4: Permit (D)

-61-

c. The attack could succeed because in the original filter set, rules B and D allow all connections where both ends are using ports above 1023.

9.6 a. A source port is added to the rule set. b. Packet 1: Permit (A); Packet 2: Permit (B): Packet 3: Permit (C) Packet 4: Permit (D); Packet 5: Deny (E); Packet 6: Deny (E) 9.7 a. Packet 7 is admitted under rule D. Packet 8 is admitted under rule C. b. Add a column called ACK Set, with the following values for each rule: A = Yes; B = Yes; C = Any; D = Yes; E = Any

-62-

9.8 Pattern matching

Stateful matching

Protocol anomaly

Traffic anomaly

Pros •Identifies known attacks •Provides specific information for analysis and response •Identifies known attacks •Detects signatures spread across multiple packets •Provides specific information for analysis and response •Can identify attacks without a signature •Reduces false positives with well-understood protocols •Can identify unknown attacks and DoS floods

Statistical •Can identify unknown anomaly attacks and DoS floods

Cons •May trigger false positives •Requires frequent updates of signature tables •Attacks can be modified to avoid detection •May trigger false positives • Requires frequent updates of signature tables •Attacks can be modified to avoid detection •May lead to false positives and false negatives with poorly understood or complex protocols •Protocol analysis modules take longer to deploy to customers than signatures •Can be difficult to tune properly •Must have clear understanding of normal traffic environment •Can be difficult to tune properly •Must have clear understanding of normal traffic environment

9.9 A requirement like "all external Web traffic must flow via the organization's Web proxy." is easier stated than implemented. This is because identifying what actually constitutes “web traffic” is highly problematical. Although the standard port for HTTP web servers is port 80, servers are found on a large number of other ports (including servers belonging to large, well-known and widely used organizations).

This means it is very difficult to block direct access to all possible web servers just using port filters. Whilst it is easy enough to configure web browser programs to always use a proxy, this will not stop direct access by other programs. It also means that the proxy server must have access to a very large number of external ports, since otherwise access to some servers would be limited. As well as HTTP access, other protocols are used on the web. All of these should also be directed via the proxy in order to implement the desired policy. But this may impact the operation of other programs using these protocols. In particular, the -63-

HTTPS protocol is used for secure web access that encrypts all traffic flowing between the client and the server. Since the traffic is encrypted, it means the proxy cannot inspect its contents in order to apply malware, SPAM or other desired filtering. Whilst there are some mechanisms for terminating the encrypted connections at the proxy, they have limitations and require the use of suitable browsers and proxy servers.

9.10 A possible requirement to manage information leakage requires all external e-mail to be given a sensitivity tag (or classification) in its subject and for external e-mail to have the lowest sensitivity tag. At its simplest a policy can just require user’s to always include such a tag in email messages. Alternatively with suitable email agent programs it may be possible to enforce the prompting for and inclusion of such a tag on message creation. Then, when external email is being relayed through the firewall, the mail relay server must check that the correct tag value is present in the Subject header, and refuse to forward the email outside the organization if not, and notify the user of its rejection.

-64-

9.11 Suitable packet filter rulesets FOR the "External Firewall" and the "Internal Firewall" respectively, to satisfy the stated "informal firewall policy", could be: action src permit DMZ mail gateway permit any

port any

dest any

any

permit

any

any

permit

any

permit

DMZ web proxy DMZ DNS server any

DMZ mail gateway DMZ mail gateway any

permit

any

DNS (53) DNS (53) any

deny

any

any

action src permit any internal

port any

permit

any internal

any

permit

any internal

any

permit

any internal

permit

DMZ DNS server any internal

DNS (53) DNS (53) any

permit

permit permit permit permit deny

any DMZ DNS server any DMZ server any dest DMZ mail gateway DMZ mail gateway DMZ web proxy DMZ DNS server any internal any DMZ server any DMZ server mgmt user hosts

port flags SMTP (25) SMTP (25) POP3S (995) HTTP/S (80,443) DNS (53) DNS (53) any estab lished any

comment header sanitize

port flags SMTP (25) POP3/S (110,995) HTTP/S (80,443) DNS (53) DNS (53) SSH (22)

comment

mgmt user hosts any DMZ server

any

any DMZ server any

any

any internal

SNMP (161) SNMP TRAP (162) any

any

any

any

any

estab lished

content filtered user auth content filtered, user auth TCP & UDP TCP & UDP return traffic flow block all else

user auth content filtered, user auth UDP lookup UDP lookup user auth on server

return traffic flow block all else

9.12 Yes. A rule set such as the following will do the trick: drop tcp *:* -> 5.6.7.8:* The following might be a little better, because it does not restrict outbound connections initiated by our internal server: drop tcp *:* -> 5.6.7.8:* (if SYN flag set) -65-

9.13 a. Here are the strengths.

(1) It mediates all incoming traffic from external hosts and can protect against many attacks by outsiders; (2) It is easier to manage and to update policies, because of single central location; (3) It protects against some kinds of DoS attacks launched from the outside.

Here are the weaknesses.

(1) It has no protection against malicious insiders; (2) It has no protection for mobile laptops while they are connected to other networks; (3) It has no protection if laptops get infected while travelling and then spread infection when they re-connect to our internal network b. Here are the strengths.

(1) It protects against malicious insiders and infected internal machines as well as outside attackers; (2) It protects laptops even while they are travelling and connected to other networks; (3) It may be easier to customize firewall protection on a permachine basis.

Here are the weaknesses.

(1) It is potentially more difficult to manage policies, due to the number of machines whose rulesets must be configured and updated; (2) Uncooperative users may be able to modify settings or disable firewalls on their own machines, and viruses/worms may be able to do the same to machines they infect; (3) It is potentially less resistant to DDoS, since DoS attacks can still flood internal network links; (4) Depending upon firewall configuration, it may block legitimate internal traffic and/or make some internal services harder to use. c. Here are the strengths.

(1) Layered defense provides redundancy in case one firewall fails; (2) It can easily update policy against external attacks if a new threat develops, which gives some time to update the rulesets on internal hosts.

(3) Strengths (a)(1) and (b)(1)–(3) also apply.

Here are the weaknesses.

(1) Potential for overblocking of legitimate traffic, since traffic flows only if permitted by both firewalls.

(2) Weaknesses (b)(1), (b)(4) also apply -66-

9.14 Modify the rule action from Alert to Drop to block these packets entering the home network, and to log the attempt: Drop tcp $EXTERNAL_NET any -> $HOME_NET any\ (msg: “SCAN SYN FIN” flags: SF, 12;\ reference: arachnids, 198; classtype: attempted-recon;)

-67-

CHAPTER 10 BUFFER OVERFLOW ANSWERS TO QUESTIONS 10.1 A “buffer overflow” results from adding more information to a program’s buffer than it was designed to hold.

10.2 Buffer overflow attacks typically target buffers located in one of the stack, the heap, or the data section of a process.

10.3 The consequences of a buffer overflow include corruption of data used by the program, unexpected transfer of control in the program, possibly memory access violations, and very likely eventual program termination. When done deliberately as part of an attack on a system, the transfer of control could be to code of the attacker’s choosing, resulting in the ability to execute arbitrary code with the privileges of the attacked process.

10.4 To exploit any type of buffer overflow, the attacker needs to identify both a buffer overflow vulnerability in some program that can be triggered using externally sourced data under the attackers control, and to understand how that buffer will be stored in the processes memory, and hence the potential for corrupting adjacent memory locations and potentially altering the flow of execution of the program.

10.5 The programming languages vulnerable to buffer overflows are those without a very strong notion of the type of variables, and what constitutes permissible operations on them. They include assembly language, and C and similar languages. Strongly typed languages such as Java, ADA, Python, and many others are not vulnerable to these attacks.

10.6 A “stack buffer overflow” occurs when the targeted buffer is located on the stack, usually as a local variable in a function’s stack frame. If the function code that copies externally sourced data into such a buffer fails to correctly limit the amount of data written, then the values of adjacent variables, and even control fields such as the saved frame pointer and return address, can be overwritten. This can result in the program crashing, or in execution being transferred to (shell) code the attacker provides.

-68-

10.7 “shellcode” is code supplied by the attacker, and often saved in the buffer being overflowed. It is called “shellcode” because traditionally its function was to transfer control to a user command-line interpreter, or shell, which gave access to any program available on the system with the privileges of the attacked program.

10.8 There are several generic restrictions on the content of shellcode.

Firstly it has to be “position-independent”. That means it cannot contain any absolute address referring to itself, because the attacker generally cannot determine in advance exactly where the targeted buffer will be located in the stack frame of the function in which it is defined. Instead the code is written to determine its location when actually run. Another restriction is that it cannot contain any NULL values. This is a consequence of the common use of C string routines to copy this data into the buffer. To overcome this, any NULL values must be written in when the code actually runs.

10.9 A “NOP sled” is a run of NOP (no operation, do nothing) instructions, which are included before the desired shellcode to help overcome the lack of knowledge by the attacker of its precise location. In a buffer overflow attack, the attacker arranges for the transfer of control (via overwritten return address) to occur somewhere in the NOP Sled (guessing around the middle of the most likely location). Then when control transfers, no matter where in this run it occurs, the CPU executes NOPs until it reaches the actual desired shellcode.

10.10 Apart from just spawning a command-line shell, the attacker may wish to create shellcode to perform somewhat more complex operations. The Packet Storm website includes a large collection of packaged shellcode, including code that can: set up a listening service to launch a remote shell when connected to; create a reverse shell that connects back to the hacker; local exploits that establish a shell or execve a process; flush firewall rules (such as IPTables and IPChains) that currently block other attacks; break out of a chrooted (restricted execution) environment, giving full access to the system.

10.11 Two broad categories of defenses against buffer overflows are: compile-time defenses which aim to harden programs to resist attacks in new programs; and run-time defenses which aim to detect and abort attacks in existing programs.

10.12 Compile-time defenses include: writing programs using a modern high-level programming language that is not vulnerable to buffer overflow attacks; using safe coding techniques to validate buffer use; -69-

using language safety extensions and/or safe library implementations; or using stack protection mechanisms.

10.13 Run-time defenses that provide some protection for existing vulnerable programs include: using “Executable Address Space Protection” that blocks execution of code on the stack, heap, or in global data; using “Address Space Randomization” to manipulate the location of key data structures such as the stack and heap in the processes address space; or by placing guard pages between critical regions of memory in a processes address space.

10.14 In a “return to system call” attack, typically a stack overflow is used, but the return address is changed to jump to existing code on the system, typically in standard libraries. This avoids triggering run-time defenses that block executable code on the stack or heap. They can be prevented using stack protection mechanisms.

10.15 In a “heap buffer overflow” attack, the targeted buffer is located on the heap rather than stack. These generally target either function pointers located adjacent to such buffers, or heap management pointers. These attacks avoid defenses that focus on stack based attacks. Defenses include making the heap non-executable, or randomizing addresses of structures on the heap.

10.16 In a “global data area overflow” attack, the targeted buffer is located in the global data area. The attack is similar to heap overflows, as are the defenses.

-70-

ANSWERS TO PROBLEMS 10.1 Safer variants of the unsafe standard C library functions shown in Table 10.2 are: Safer Alternative

Original Unsafe Function gets(char *str)

fgets(char *str, int size, FILE * fil)

sprintf(char *str, char *fmt, ...)

snprintf(char *str, int size, char * fmt, ...)

strcat(char *dest, char *src)

strncat(char *dest, char *src, int count) strlcat(char *dest, char *src, int size)

strcpy(char *dest, char *src)

strncpy(char *dest, char *src, int count) strlcpy(char *dest, char *src, int size)

vsprintf(char *str, char *fmt, va_list ap)

vsnprintf(char *str, int size, char *fmt, va_list ap)

nb. the strlXXX routines are regarded as safer than the strnXXX routines, but may not be available on all systems.

10.2 Corrected version of the program shown in Figure 10.1a (see bold lines): int main(int argc, char *argv[]) { int valid = FALSE; char str1[8]; char str2[8]; next_tag(str1); fgets(str2, sizeof(str2), stdin); if (strncmp(str1, str2, sizeof(str2)) == 0) valid = TRUE; printf("buffer1: str1(%s), str2(%s), valid(%d)\n", str1, str2, valid); }

10.3 Corrected version of the program shown in Figure 10.5a (see bold lines): void hello(char *tag) { char inp[16]; printf("Enter value for %s: ", tag); fgets(inp, sizeof(inp), stdin); printf("Hello your %s is %s\n", tag, inp); }

-71-

10.4 Corrected version of (part of) the program shown in Figure 10.7a (see bold lines): void display(char *val) { char tmp[16]; snprintf(tmp, sizeof(tmp), "read val: %s\n", val); puts(tmp); }

10.5 The extended shellcode from Figure 10.8b including a call to exit(0) is (see bold lines):

cont:

find: stack sh: args:

jmp pop xor mov lea mov mov mov mov lea lea int mov xor int call

find %esi %eax,%eax %al,0x7(%esi) (%esi),%ebx %ebx,0x8(%esi) %eax,0xc(%esi) $0xb,%al %esi,%ebx 0x8(%esi),%ecx 0xc(%esi),%edx $0x80 $0x1,%al %ebx,%ebx $0x80 cont

.string "/bin/sh " .long 0 .long 0

// jump to end of code // pop address of sh off stack into %esi // zero contents of EAX // copy zero byte to end of string sh (%esi) // load address of sh (%esi) into %ebx // save address of sh in args[0] (%esi+8) // copy zero to args[1] (%esi+c) // copy execve syscall number (11) to AL // copy address of sh (%esi) t0 %ebx // copy address of args (%esi+8) to %ecx // copy address of args[1] (%esi+c) to %edx // software interrupt to execute syscall // copy exit syscall number (1) to AL // zero contents of EBX // software interrupt to execute syscall // call cont which saves next address on // string constant // space used for args array // args[1] and also NULL for env array

Note that the syscall numbers are listed in the architecture specific “unistd.h” include file. This code can be tested by changing the encoded shell name to one that does not exist (e.g.. “/bin/xx”).

10.6 The details and results from running this experiment depend on the specific UNIX O/S variant and example vulnerable program used. The book's Web site includes a zipfile with the example programs used in this chapter, as run on a Knoppix CD-bootable system. Note that you may well need to use an older O/S release, since recent versions have defenses such as non-executable stack enabled by default.

10.7 The Packet Storm (http://www.packetstormsecurity.org/) site (shellcode area) includes several examples of PPC code to exec a shell under MacOSX (http://www.packetstormsecurity.org/shellcode/execMacOSX.txt, http://www.packetstormsecurity.org/shellcode/osx72bytes.txt) and Linux/PPC -72-

(http://www.packetstormsecurity.org/shellcode/execve-core.c). It also includes a comprehensive paper on this topic http://www.packetstormsecurity.org/shellcode/PPC_OSX_Shellcode_Assembly.pdf.

10.8 The details depend on which safe library alternative is examined. Note the Wikipedia page on “Buffer_overflow” provides links to the websites for many of the alternative safe library implementations.

10.9 No detailed answer available yet, however the Wikipedia page on “Return-to-libc_attack” provides some brief information and links to other resources.

10.10 Corrected version of the functions shown in Figure 10.10 (see bold lines). Note that the function “signatures” have to change, since information on the size of the buffer is needed (as seen in the safer variants of the string copy/cat functions). int safe_copy_buf(char *to, int size, int pos, char *from, int len) { int i; if (len <= 0) /* invalid negative or zero len */ return pos; if ((pos+len)>size)) /* len exceeds available space in buffer */ len = size – pos; for (i=0; i<len; i++) { to[pos] = from[i]; pos++; } return pos; } short safe_read_chunk(FILE fil, int size, char *to) { short len; fread(&len, 2, 1, fil); /* read length of binary data */ if (len <= 0) /* invalid negative or zero len */ return 0; if (len > size)) /* len exceeds space in buffer */ len = size; fread(to, 1, len, fil); /* read len bytes of binary data return len; }

-73-

10.11 Corrected version of the program shown in Figure 10.11a (see bold lines): #define INP_SIZE 64 /* record type to allocate on heap */ typedef struct chunk { char inp[INP_SIZE]; /* input buffer */ void (*process)(char *); /* pointer to function to process inp */ } chunk_t; void showlen(char *buf) { int len; len = strlen(buf); printf("buffer5 read %d chars\n", len); } int main(int argc, char *argv[]) { chunk_t *next; setbuf(stdin, NULL); next = malloc(sizeof(chunk_t)); next->process = showlen; printf("Enter value: "); fgets(next->inp, INP_SIZE, stdin); next->process(next->inp); printf("buffer5 done\n"); }

10.12 The details depend on the current vulnerability status.

10.13 No detailed answer available yet, however [LHEE03] includes details on the “format string overflow” attack.

10.14 No detailed answer available yet, however the Wikipedia page on “Integer overflow” includes some information on the “integer string overflow” attack.

-74-

CHAPTER 11 SOFTWARE SECURITY ANSWERS TO QUESTIONS 11.1 Software quality and reliability is concerned with the accidental failure of a program as a result of some theoretically random, unanticipated input, system interaction, or use of incorrect code. These failures are expected to follow some form of probability distribution. Software security differs in that the attacker chooses the probability distribution, targeting specific bugs that result in a failure that can be exploited by the attacker. These bugs may often be triggered by inputs that differ dramatically from what is usually expected, and hence are unlikely to be identified by common testing approaches.

11.2 Defensive programming is a form of defensive design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of said software. The idea can be viewed as reducing or eliminating the prospect of Murphy's Law having effect.

Defensive programming techniques come into their own when a piece of software could be misused mischievously or inadvertently to catastrophic effect.

11.3 Program input refers to any source of data that originates outside the program, and whose value is not explicitly known by the programmer when the code was written. It includes data read into the program from user keyboard or mouse entry, files, or network connections. It also includes data supplied to the program in the execution environment, the values of any configuration or other data read from files by the program, and values supplied by the operating system to the program.

11.4 An injection attack refers to a wide variety of program flaws related to invalid handling of input data, particularly when such input data can accidentally or deliberately influence the flow of execution of the program. Examples of injection attacks include: command injection, SQL injection, code injection, and remote code injection. There are a wide variety of mechanisms that can result in injection attacks. These include when input data is passed as a parameter to another helper program (command) or to a database system (SQL), whose output is then processed and used by the original program. Or when the input -75-

includes either machine or script code that is then executed/interpreted by the attacked system (code).

11.5 In a command injection attack, the unchecked input is used in the construction of a command that is subsequently executed by the system with the privileges of the attacked program. In an SQL injection attack, the user-supplied input is used to construct a SQL request to retrieve information from a database. In both cases the unchecked input allows the execution of arbitrary programs/SQL queries rather than the program/query specified by the program designer. They differ in the syntax of the respective shell/SQL metacharacters used that allow this to occur.

11.6 A cross-site scripting attack occurs when concerns input provided to a program by one user, is subsequently output to another user. They are most commonly seen in scripted web applications, where the vulnerability involves the inclusion of script code in the HTML content of a web page displayed by a user’s browser. An example of such an attack concerns an unsafe guestbook application where a comment saved by one user includes javascript code, such as that shown in Figure 11.5a, that executes when the comment is viewed by other users.

11.7 The main technique used by a defensive programmer to validate assumptions about program input is to compare it against a regular expressions, which is a pattern that describes either what is wanted or what is known to be dangerous. The result of the comparison is used to either accept wanted, or reject dangerous, input.

11.8 When using the Unicode character set a further issue concerns multiple, alternative, redundant encodings of the input data which Unicode allows. Given the possibility of multiple encodings, the input data must first be transformed (canonicalized) into a single, standard, minimal representation. This involves replacing alternate, equivalent encodings by one common value. Then the input data can be compared to a single representation of acceptable input values.

11.9 “Input fuzzing” is a software testing technique that uses very large amounts of randomly generated data as inputs to a program, to determine whether the program or function correctly handles all such abnormal inputs, or whether it crashes or otherwise fails to respond appropriately. The major advantage of fuzzing is its simplicity, low cost, and its freedom from assumptions about the “expected” input to any program, service or function. It ought to be deployed as a component of any reasonably comprehensive testing strategy, especially in relation to commonly deployed software.

-76-

11.10 Key software security concerns associated writing safe program code include whether the implemented algorithm correctly solves the specified problem, whether the machine instructions executed correctly represent the high-level algorithm specification, and whether the manipulation of data values in variables, as stored in machine registers or memory, is valid and meaningful.

11.11 A race condition can occur when several processes, or threads within a process, simultaneously access the same shared memory without suitable synchronization. The result can be that the shared memory values may be corrupted, or changes lost, due to overlapping access, use and replacement of the shared values.

11.12 Environment variables are a collection of string values inherited by each process from its parent, that can affect the way a running process behaves. The operating system includes these in the processes memory when it is constructed. Well known environment variables include the variable PATH which specifies the set of directories to search for any given command, IFS which specifies the word boundaries in a shell script, and LD_LIBRARY_PATH which specifies the list of directories to search for dynamically loadable libraries. All of these have been used to attack programs, and especially privileged shell scripts. The attacker changes the values of one or more of these, then calls a script running with other (higher) privileges, which is then “tricked” into running a program or loading a library of the attackers choice as a result.

11.13 The principle of least privilege states that programs should execute with the least amount of privileges needed to complete their function.

11.14 There are several issues associated with the correct creation and use of a lockfile. Firstly it is purely advisory, since all programs using this form of synchronization must cooperate. A more serious flaw can occur in its implementation, if it fails to atomically both check that the lockfile does not exist, and also then create it.

11.15 There are several issues associated with the correct creation and use of a temporary file in a shared directory, as they must be both unique, and not accessed by other processes. An attacker may attempt to guess the temporary filename a privileged program will use, and then attempt to create their own version in the interval between the program checking the file does not exist, and subsequently creating it. Secure temporary file creation and use requires the use of a random temporary filename, and its checking -77-

and creation using an atomic system primitive, similar to the creation of a lockfile.

11.16 Problems that may result from a program sending unvalidated input from one user to another user if the output does not conform to the expected form and interpretation by the recipient. A program may accept input from one user, save it, and subsequently display it to another user. If this input contains content that alters the behavior of the program or device displaying this data, and it is not adequately sanitized by the program, then an attack on the user is possible.

Examples include embedding terminal (e.g.. VT100) “escape sequences”, or Javascript script code in an XSS attack.

ANSWERS TO PROBLEMS 11.1 Information on writing regular expressions or patterns may be found in just about any good text on using UNIX systems. The Wikipedia page on “Regular_expression” provides a reasonable amount of detail, and pointers to other references. Texts on languages with regular expression support, such as perl, php or python, should be consulted for the variants they accept.

11.2 Meta-characters used by the Linux/UNIX Bourne shell include: ; & | ( ) { } < > * ? [ ] ~ ! “ ‘ \ `

In particular the ‘; && || |’ characters are variously used to separate commands, and would most likely be seen in any attack. Other common shells such as BASH or CSH have the same interpretation of these characters, although they treat others differently. Hence input validation checks to prevent command injection attacks for all of these shells must typically reject the same characters (although as noted in the text, it is much better to write patterns to accept known good input values, which typically are alphanumeric plus limited punctuation).

-78-

11.3 Rewritten, extended version of perl script shown in Figure 11.2 (see bold lines): #!/usr/bin/perl # finger.cgi - finger CGI script using Perl5 CGI module use CGI; use CGI::Carp qw(fatalsToBrowser); $q = new CGI; # display HTML header print $q->header, $q->start_html('Finger User'), $q->h1('Finger User'); # get and validate the name of user $user = $q->param("user"); showError("The specified user '$user' contains illegal characters!") unless (("$user" =~ /^\w[-+%\w\t ]*\w$/) || ("$user" =~ /^\w$/)); # obtain desired finger information (including error messages) print "<pre>"; print `/usr/bin/finger -sh "$user" 2>&1`; # display HTML footer print "</pre>"; print $q->end_html; exit(0); # -----------------------------------------------------------# subroutine showError(reason) - build HTML error response sub showError { local ($msg) = $_[0]; # description of error print "<h1>Error</h1>\n"; print "$msg"; print "<p>Unable to safely obtain finger information.\n"; print "<p>Please go back and correct the input supplied.\n"; print $q->end_html; exit(0); }

11.4 There are a number of deficiencies in the script shown in Figure 11.10a. Despite an attempt to quote the values of the supplied form fields subject, from, body, if any of these include a “ character, the shell will assume it’s the end of the quoted string, and interpret any shell meta-characters in the remainder. This can allow the execution of arbitrary commands, with out being displayed in the response web form. For example, including a value for “Your Email Address” like: user@some.domain”; whoami; ls –al; echo “

will result in the response including the output from the commands: whoami; ls –al -79-

A better version of this script, shown in Figure 11.2, with more stringent input checking (though the email address checking is simplified, and the body cannot contain “ characters) is: #!/usr/bin/perl # comment.cgi - send comment to webmaster # specify recipient of comment email $to = "webmaster"; use CGI; use CGI::Carp qw(fatalsToBrowser); $q = new CGI; # create query object # display HTML header print $q->header, $q->start_html('Comment Sent'), $q->h1('Comment Sent'); # retrieve form field values and send comment to webmaster $subject = $q->param("subject"); $from = $q->param("from"); $body = $q->param("body"); # validate the input information # subject MUST NOT contain " or multiple lines showError("The subject '$subject' contains illegal characters!") if ("$subject" =~ m:["\r\n]:); # from MUST only contain characters valid in an email address showError("The from address '$from' contains illegal characters!") unless ("$from" =~ m:^[-_.=/\w][- _.=%!/@\w]*[-_.=%\w]$:); # body MUST NOT contain " showError("The body '$body' contains illegal characters!") if ("$body" =~ m:":); # generate and send comment email system("export REPLYTO=\"$from\"; echo \"$body\" | mail -s \"$subject\" $to"); # indicate to user that email was sent print "Thankyou for your comment on $subject."; print "This has been sent to $to."; # display HTML footer print $q->end_html; exit(0); # -----------------------------------------------------------# subroutine showError(reason) - build HTML error response due to reason sub showError { local ($msg) = $_[0]; # description of error print "<h1>Error</h1>\n"; print "$msg"; print "<p>Unable to safely send comment.\n"; print "<p>Please go back and correct the input supplied.\n"; print $q->end_html; exit(0); }

-80-

To remove the limitation on the contents of the mail body, the script would need to be further rewritten to open a pipeline to the mail program, and explicitly write the body contents into this pipeline, so they are not interpreted by the shell.

11.5 No short answer is available, as it depends on the scripting language chosen.

11.6 No short answer is available, as it depends on the scripting language chosen.

11.7 No short answer is available, as it requires research to determine the current state of this field. Information on some fuzzing tools is available from the Fuzz Testing of Application Reliability (http://www.cs.wisc.edu/~bart/fuzz/) site.

11.8 No short answer is available, as it requires research to determine the current state of this field.

11.9 No detailed answer is available, as it depends on the system and shell used. The value of all environment variables can be displayed using the “env” command. A variable can be changed temporarily by changing the value of the corresponding shell variable, and then exporting it (details vary depending on the shell used). To change a value permanently for all subsequent logins on the system, the relevant shell startup file, either system-wide, or for a specific user, must be changed. Again the name and location of these files varies depending on the shell and system used.

11.10 No short answer is available, as this question requires experimentation with the supplied scripts.

-81-

CHAPTER 12 OPERATING SYSTEM SECURITY ANSWERS TO QUESTIONS 12.1 The basic steps needed in the process of securing a system are: •assess risks and plan the system deployment •secure the underlying operating system and then the key applications •ensure any critical content is secured •ensure appropriate network protection mechanisms are used •ensure appropriate processes are used to maintain security 12.2 The aim of the specific system installation planning process is to maximize security whilst minimizing costs, which is best done before implementation. It needs to determine the security requirements for the system, its applications and data, and of its users.

12.3 The basic steps needed to secure the base operating system are: •install and patch the operating system •harden and configure the operating system to adequately address the identified security needs of the system by: removing unnecessary services, applications, and protocols configuring users, groups and permissions configuring resource controls •install and configure additional security controls, such as anti-virus, •host-based firewalls and IDS, if needed •test the security of the basic operating system to ensure that the •steps taken adequately address its security needs 12.4 Keeping all software as up to date as possible so important due to the continuing discovery of software and other vulnerabilities for commonly used operating systems and applications.

12.5 Automated patching: Pros: minimizes window of opportunity for attackers when new vulnerabilities are found; is convenient, especially if automated.

Cons: patches sometimes introduce instability, especially on change controlled systems.

-82-

12.6 The point of removing unnecessary services, applications and protocols is to minimize the amount of software that can run, since if less software is available to run, then the risk that it may contain vulnerabilities is reduced.

12.7 Additional security controls that may be used to secure the base operating system include: anti-virus software, host-based firewalls, IDS or IPS software, and to white-list applications.

12.8 Additional steps are used to secure key applications are: •to install and patch each application to the most recent supported secure version •to perform application specific configuration •enable encryption and generate keys and certificates if required 12.9 The steps are used to maintain system security are: •monitoring and analyzing logging information •performing regular backups •recovering from security compromises •regularly testing system security •using appropriate software maintenance processes to patch and •update all critical software, and to monitor and revise configuration as needed 12.10 Configuration of applications and services on Unix and Linux systems is most commonly implemented using separate text files for each application and service. System wide configuration details are generally located in either the /etc directory, or in the installation tree for a specific application. Where appropriate, individual user configuration that can override the system defaults, are located in hidden “dot” files in each user’s home directory.

12.11 Unix and Linux systems implement discretionary access control (DAC) to all file system resources, including not only files and directories, but devices, processes, memory and indeed most system resources.

12.12 Access is specified as granting read, write, and execute permissions to each of owner, group and others, for each resource, as shown in figure 4.6.

12.13 These extended access rights on Unix and Linux systems are typically set and displayed using the getfacl and setfacl commands.

12.14 Programs that set user (setuid) to some user (even root, the superuser), or set group (setgid) to some group on Unix and Linux -83-

systems execute with the specified user’s rights, or with access to resources belonging to the group, no matter which user executes them.

12.15 Linux systems primarily now use the iptables program to configure the netfilter kernel module. This provides comprehensive, though complex, stateful packet filtering, monitoring and modification capabilities.

12.16 Logging can generate significant volumes of information. A suitable automatic log rotation and archive system can be configured to assist in managing the overall size of the logging information.

12.17 Unix and Linux systems provide a mechanism to run services in a chroot jail, which restricts the servers view of the file system to just a specified portion, and helps contain the effects of a given service being compromised or hijacked.

12.18 Users and groups in Windows systems may be stored and used locally, on a single system, in the Security Account Manager (SAM).

It may also be centrally managed for a group of systems belonging to a domain, with the information supplied by a central Active Directory (AD) system using the LDAP protocol. Most organizations with multiple systems will manage them using domains.

12.19 There are major differences between the implementations of the discretionary access control models on Unix and Linux systems verses Windows systems. Unix and Linux systems use a small number of access rights for subjects being owner/group/other across nearly all resources/objects – this means it is a simple model, but because the same rights are used everywhere, their meaning can differ for different objects, and sometimes it is hard or impossible to specify some desired complex requirements. Windows systems use a much larger set of access rights, which differ for different types of objects – a more complex model, which can be harder to master, but which may allow better specification of some desired complex requirements.

12.20 The mandatory integrity controls used for in Windows systems label all objects, such as processes and files, and all users, as being of low, medium, high or system integrity level. Then whenever data is written to an object, the system first ensures that the subject’s integrity is equal or higher than the object’s level, implementing a form of the Biba Integrity model.

-84-

12.21 On Windows, the privilege that overrides all ACL checks is the ability to backup the computer, which requires over-riding the normal access controls to obtain a complete backup.

12.22 On Windows systems, much of the application and service configuration information is centralized in the Registry, which forms a database of keys and values that may be queried and interpreted by applications on these systems.

12.23 Virtualization refers to a technology that provides an abstraction of the computing resources used by some software, which thus runs in a simulated environment called a virtual machine (VM).

12.24 Full virtualization, which allows multiple full operating system instances to execute on virtual hardware, supported by a hypervisor that manages access to the actual physical hardware resources.

Specifically we discuss securing both native and hosted virtualization variants of this.

12.25 The main security concerns with virtualized systems are: •guest OS isolation, ensuring that programs executing within a guest OS may only access and use the resources allocated to it, and not covertly interact with programs or data in either other guest OS’s or in the hypervisor.

•guest OS monitoring by the hypervisor, which has privileged access to the programs and data in each guest OS, and must be trusted as secure from subversion and compromised use of this access •virtualized environment security, particularly as regards image and snapshot management, which attackers may attempt to view or modify 12.26 The basic steps to secure virtualized systems are: •carefully plan the security of the virtualized system •secure all elements of a full virtualization solution, including the hypervisor, guest O/S’s, and virtualized infrastructure; and maintain their security •ensure that the hypervisor is properly secured •restrict and protect administrator access to the virtualization solution

ANSWERS TO PROBLEMS -85-

12.1 If a process running as root is compromised, then any child-processes the attacker spawns (such as a remote shell) will also run as root. If such a process can be used to read data, it will be able to read any local file. If such a process spawns a process that listens on UDP or TCP ports, that process can be bound to privileged ports (TCP 22, TCP 80, and all other TCP/UDP ports lower than 1024). If such a process is merely sloppily coded, the impact of bug behavior may be much greater than if the process didn’t run as root (overwriting important files, interfering with other processes, etc.).

12.2 The 'find' command allows for searches on the permissions, using the 'perm' option, '-perm +4000' will find all files with the SUID bit set.

The full command, with output to file, is: find / -perm +4000 > somelogfile To find both SUID and SGID files (and to show the symbolic form of perms) you can use: find / -perm +u+s -o -perm +g+s > somelogfile Once a list of files has been generated, the system operator can check the modification time and other statistics (like size, owner) to ensure the file is the genuine article. However, this is still a manual process, prone to human error. System Security Tools (like "tripwire") could be applied to the files in the list to actively monitor for modifications.

12.3 Filesystem permissions are important because practically everything in Linux is represented by some sort of file. They specify whether a given user or group-member (subject) can read, write, or execute (actions) a given file, directory, special file, symbolic link, or other filesystem element (objects).

12.4 drwxr-x---rw-rw----

2 ahmed staff 1 ahmed staff

0 Jul 21 07:58 stuff 0 Jul 21 08:00 ourstuff

NOTE: it’s acceptable (albeit redundant) for the sticky bit to be set on “stuff,” so long as the write bit is not. If you don’t want group-users to either create or delete files in a directory, it’s sufficient to simply turn off the write bit.

12.5 Assets: website availability, system availability, local network integrity (integrity of other systems the attacker may reach via compromised web server), corporate data, customer data, website availability, ecommerce business activity (immediate revenue), company reputation (future revenue) Vulnerability: buffer-overflow in Apache Attack-vector: the worm “WorminatorX” (that multiple exploits may target the same vulnerability -- this is just the one we know about) -86-

Attackers: competitors, thieves, identity thieves, website defacers (vandals), disgruntled ex-employees, the Byelorusan mob, etc. -public web sites can be prey to any Internet-connected type of attacker Likelihood of Occurrence: High (or synonyms thereof) -- Internet worms spread very far very quickly Likely Impact: High -- complete exposure/loss of any or all affected assets to any potential attacker Plausible Mitigations: Patch the Apache vulnerability; if no patch is available, protect Apache with SELinux or AppArmor; or run Apache in a chroot jail (Note that Apache already runs as an unprivileged user, by default -- presumably the WorminatorX vulnerability depends on some other privilege-escalation vulnerability) 12.6 Logs provide audit trails of system and application events, and are useful for identifying problems, analyzing security breaches, analyzing system/application failures. (Bonus points if student mentions that in regulated or otherwise controlled environments, logs are usually mandated by industry or governmental auditors.) Logs may even, if monitored closely, provide an early warning of failures or attacks in progress. But logs only capture the level of detail 12.7 'Normal' behavior would generally involve users creating, using or deleting files belonging to either the individual user or to a group to which they belong. Normal behavior would not involve attempting to gain superuser or root privileges or in any other way altering the operating system or attempting to perform what could be considered administrator functions. In particular the rules should watch for: •bad or repeated login attempts •copying large numbers of files to either external media or remote locations •attempts to access system files or log files; •accessing directories, files or programs that are not usually accessed; •changing security settings.

•attempts to become a superuser using the su or sudo commands.

A couple of SWATCH examples are: # watchfor /failed/ # echo bold # mail addressess=root,subject=Failed Authentication # watchfor /su:/ # echo bold # mail addresses=root,subject=Someone sued to root access 12.8 The key advantage of file integrity checking tools is that they can precisely locate potentially damaging changes in a filesystem arising from deviations in expected system behavior, without the need to explicitly codify the kinds of events that might produce such changes.

-87-

In the context of intrusion detection, this means that an attempted attack can be flagged by its effect on the integrity of particular system files and not by any a priori knowledge of the behavioral characteristics of the attack. Such information is required to create an meaningful attack signature in signature-based intrusion detection systems, and since new attack patterns cannot be detected until they have been codified, the corpus of known signatures needs to be continually updated. Further, integrity based tools can also detect aberrant system behavior that has nothing to do with malicious activity, such as misbehaving programs and inadvertent user actions that damage files and directories.

The problem with the file-integrity tools (and indeed all anomalybased systems) is that it is often very difficult to characterize normal system conditions with sufficient accuracy to allow intrusive or aberrant activity to be clearly distinguished. For usability, the rate of false alarms needs to be low, or system administrators will be continually responding to normal or unusual activity that is otherwise perfectly legitimate. The other problem is that integrity checking only provides evidence of malicious or aberrant activity after the fact. It does nothing to prevent it, and you still need effective recovery strategies as an adjunct to the intrusion detection process.

In general, it is desirable that executables (especially those in /bin and /usr/sbin) and critical system information resources (e.g. password files, configuration files for core services, and so on) be stringently monitored. These should not change except as a result of authorized system administrative action. Similarly, logfiles should be monitored to ensure that they are not modified or truncated.

Directories, such as /root and /home should be carefully monitored for unauthorized changes, such as additions or modification to permissions. However, it is simply not sensible or feasible to monitor all files in this way, particularly those that change frequently as shared documents and user home accounts.

12.9 Unix and Linux systems use a small number of access rights for subjects being owner/group/other across nearly all resources/objects – this means it is a simple model, but because the same rights are used everywhere, their meaning can differ for different objects, and sometimes it is hard or impossible to specify some desired complex requirements.

Windows systems use a much larger set of access rights, which differ for different types of objects – a more complex model, which can be harder to master, but which may allow better specification of some desired complex requirements.

An increase in security features is desirable provided the system administrator is competent and completely understands the purpose -88-

I

and use of each of the security features, how they interact with each other, and which feature is best used in specific circumstances. f the administrator was not as familiar with all the complex security features then there would be a benefit in having less security features available. This is because having less to understand means less chance of making mistakes.

12.10 When using BitLocker on a laptop, the laptop should not use standby mode, rather it should use hibernate mode. This is because Hibernate writes memory to the computer’s disk drive, which means the computer's memory content, is protected by bitlocker. Standby (aka sleep) simply keeps the computer in a very low power state, and memory is maintained and not protected by BitLocker.

-89-

TABLE OF CONTENTS

Chapter 13 Chapter 14 Chapter 15 Chapter 16 Chapter 17 Chapter 18 Chapter 19 Chapter 20 Chapter 21 Chapter 22 Chapter 23 Chapter 24 Chapter 25

Cloud and IoT Security ............................................. 5 IT Security Management and Risk Assessment ............ 8 IT Security Controls, Plans, and Procedures ............... 15 Physical and Infrastructure Security .......................... 20 Human Resources Security ...................................... 24 Security Auditing .................................................... 29 Legal and Ethical Aspects ........................................ 33 Symmetric Encryption & Message Confidentiality ........ 41 Public-Key Cryptography & Message Authentication .... 50 Internet Security Protocols & Standards .................... 54 Internet Authentication Applications.......................... 58 Wireless Network Security ....................................... 64 Trusted Computing and Multilevel Security ................ 68

-4-

CHAPTER 13 CLOUD AND IOT SECURITY ANSWERS TO QUESTIONS 13.1 A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

13.2 Software as a service (SaaS): Provides service to customers in the form of software, specifically application software, running on and accessible in the cloud.

Platform as a service (PaaS): Provides service to customers in the form of a platform on which the customer's applications can run.

Infrastructure as a service (IaaS): Provides the customer access to the underlying cloud infrastructure.

13.3 The NIST cloud computing reference architecture focuses on the requirements of “what” cloud services provide, not a “how to” design solution and implementation. The reference architecture is intended to facilitate the understanding of the operational intricacies in cloud computing. It does not represent the system architecture of a specific cloud computing system; instead it is a tool for describing, discussing, and developing a system-specific architecture using a common framework of reference.

13.4 Abuse and nefarious use of cloud computing: For many CPs, it is relatively easy to register and begin using cloud services, some even offering free limited trial periods. This enables attackers to get inside the cloud to conduct various attacks, such as spamming, malicious code attacks, and denial of service.

Insecure interfaces and APIs: CPs expose a set of software interfaces or APIs that customers use to manage and interact with cloud services. The security and availability of general cloud services is dependent upon the security of these basic APIs. From authentication and access control to encryption and activity monitoring, these interfaces must be designed to protect against both accidental and malicious attempts to circumvent policy.

-5-

Malicious insiders: Under the cloud computing paradigm, an organization relinquishes direct control over many aspects of security and, in doing so, confers an unprecedented level of trust onto the CP. One grave concern is the risk of malicious insider activity. Cloud architectures necessitate certain roles that are extremely high-risk.

Shared technology issues: IaaS vendors deliver their services in a scalable way by sharing infrastructure. Often, the underlying components that make up this infrastructure (CPU caches, GPUs, etc.) were not designed to offer strong isolation properties for a multitenant architecture. CPs typically approach this risk by the use of isolated virtual machines for individual clients. This approach is still vulnerable to attack, by both insiders and outsiders, and so can only be a part of an overall security strategy.

Data loss or leakage: For many clients, the most devastating impact from a security breach is the loss or leakage of data. We address this issue in the next section.

Account or service hijacking: Account and service hijacking, usually with stolen credentials, remains a top threat. With stolen credentials, attackers can often access critical areas of deployed cloud computing services, allowing them to compromise the confidentiality, integrity, and availability of those services.

Unknown risk profile: In using cloud infrastructures, the client necessarily cedes control to the cloud provider on a number of issues that may affect security. Thus the client must pay attention to and clearly define the roles and responsibilities involved for managing risks. For example, employees may deploy applications and data resources at the CP without observing the normal policies and procedures for privacy, security, and oversight.

13.5 OpenStack is an open source software project of the OpenStack Foundation that aims to produce an open source cloud operating system.

13.6 The Internet of things (IoT) is a term that refers to the expanding interconnection of smart devices, ranging from appliances to tiny sensors 13.7 Sensor: A sensor measures some parameter of a physical, chemical, or biological entity and delivers an electronic signal proportional to the observed characteristic, either in the form of an analog voltage level or a digital signal. In both cases, the sensor output is typically input to a microcontroller or other management element.

Actuator: An actuator receives an electronic signal from a controller and responds by interacting with its environment to produce an effect on some parameter of a physical, chemical, or biological entity.

-6-

Microcontroller: The "smart" in a smart device is provided by a deeply embedded microcontroller.

Transceiver: A transceiver contains the electronics needed to transmit and receive data. Most IoT devices contain a wireless transceiver, capable of communication using Wi-Fi, ZigBee, or some other wireless scheme.

Radio-Frequency Identification (RFID): (RFID) technology, which uses radio waves to identify items, is increasingly becoming an enabling technology for IoT. The main elements of an RFID system are tags and readers. RFID tags are small programmable devices used for object, animal, and human tracking. They come in a variety of shapes, sizes, functionalities, and costs. RFID readers acquire and sometimes rewrite information stored on RFID tags that come within operating range (a few inches up to several feet). Readers are usually connected to a computer system that records and formats the acquired information for further uses.

13.8 The billions of IoT devices have various security vulnerabilities and there is no effective way to patch these in a timely manner.

13.9 Cisco has developed a framework for IoT security that serves as a useful guide to the security requirements for IoT. 13.10 MiniSec is an open-source security module that is part of the TinyOS operating system.

-7-

CHAPTER 14 IT SECURITY MANAGEMENT AND RISK ASSESSMENT ANSWERS TO QUESTIONS 14.1 IT security management is a process used to achieve and maintain appropriate levels of confidentiality, integrity, availability, accountability, authenticity and reliability. IT security management functions include: determining organizational IT security objectives, strategies and policies; determining organizational IT security requirements; identifying and analyzing security threats to IT assets within the organization; identifying and analyzing risks; specifying appropriate safeguards; monitoring the implementation and operation of safeguards that are necessary in order to cost effectively protect the information and services within the organization; developing and implementing a security awareness program; detecting and reacting to incidents.

14.2 The three fundamental questions IT security management tries to address are: 1. What assets do we need to protect?

2. How are those assets threatened?

3. What can we do to counter those threats?

14.3 IT security management consists of a process that starts by first determining a clear view of an organization’s IT security objectives and general risk profile. Next an IT security risk assessment is needed for each asset in the organization that requires protection to answer the three key questions The process continues by selecting suitable controls, and then writing plans and procedures to ensure these necessary controls are effectively implemented. That implementation needs to be monitored, to determine if the security objectives are met.

The whole process must be iterated, and the plans and procedures kept up-to-date, because of the rapid rate of change in both the technology and the risk environment.

-8-

14.4 Key national and international standards that provide guidance on IT security management and risk assessment include: the ISO27000 series including ISO27001, ISO27002 (previously ISO17799), & ISO27005; ISO31000; ISO13335; NIST Special Publications including SP800-30 & SP800-53.

14.5 The four steps in the iterative security management process are to: Plan – to establish security policy, objectives, processes and procedures relevant to managing risk and improving information security to deliver results in accordance with an organization’s overall policies and objectives.

Do – is to implement and operate the security policy, controls, processes and procedures.

Check – is to assess and, where applicable, measure process performance against security policy, objectives and practical experience and report the results to management for review.

Act – to take corrective and preventive actions, based on the results of the internal security audit and management review or other relevant information, to achieve continual improvement of the security management process.

14.6 Organizational security objectives identify what IT security outcomes are desired. Some questions that help clarify these issues are: • What key aspects of the organization require IT support in order to function efficiently?

• What tasks can only be performed with IT support?

• Which essential decisions depend on the accuracy, currency, integrity or availability of data managed by the IT systems?

• What data created, managed, processed and stored by the IT systems needs protection?

• What are the consequences to the organization of a security failure in their IT systems?

14.7 The four approaches to identifying and mitigating IT risks are the: • baseline approach, which implements a basic general level of security controls on systems using baseline documents, codes of practice, and “industry best practice”.

• informal approach, which involves conducting some form of informal, pragmatic risk analysis for the organization’s IT systems.

• detailed risk analysis process, which involves a detailed risk assessment of the organization’s IT systems, using a formal structured process, providing the greatest degree of assurance that all significant risks are identified and their implications considered.

• combined approach, which combines elements of the baseline, informal, and detailed risk analysis approaches.

-9-

14.8 ISO13335 suggest that for most organizations, in most circumstances, the combined approach for identifying and mitigating IT risks is the most cost effective.

14.9 The steps in the detailed security risk analysis process include: 1. Prepare for assessment 2. Conduct risk analysis (which includes Identify threat sources and events, Identify vulnerabilities and predisposing conditions, Determine likelihood of occurrence, Determine magnitude of impact, Determine risk) 3. Communicate results 4. Maintain assessment 14.10 Possible definitions are: Asset: A system resource or capability of value to its owner that requires protection.

Control: Management, operational and technical processes and procedures that act to reduce the exposure of the organization to some risks.

Threat: A potential for a threat source to exploit a vulnerability in some asset, which if it occurs may compromise the security of the asset and cause harm to the asset’s owner.

Risk: The potential for loss computed as the combination of the likelihood that a given threat exploits some vulnerability to an asset, and the magnitude of harmful consequence that results to the asset’s owner.

Vulnerability: A flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by some threat.

14.11 Key information on determining what are key assets requires the expertise of people in the relevant areas of the organization. In contrast, identifying possible threats and threat sources requires the use of a variety of sources, along with the experience of the risk analyst. The risk analyst takes the descriptive asset and threat/vulnerability details, and in the light of the organizations overall risk environment and existing controls, decides the appropriate likelihood rating. The determination of the consequence, should any asset be compromised, relies upon the judgment of the asset’s owners, and the organization’s management, rather than the opinion of the risk analyst.

14.12 Two key questions which help identify threats and risks for an asset are: 1 - Who or what could cause it harm? and 2 - How could this occur? Answering the first of these questions involves identifying -10-

potential threats to assets, which can be natural or man-made, accidental or deliberate. Answering the second of these questions involves identifying flaws or weaknesses in the organization’s IT systems or processes, which could be exploited by a threat source to cause harm.

14.13 consequence: indicates the impact on the organization should some particular threat actually eventuate. likelihood: the probability that an identified threat could occur and cause harm to some asset.

14.14 The simple equation for determining risk is: Risk = Probability that threat occurs × Cost to organization It is not commonly used in practice because it is often extremely hard to determine accurate probabilities, realistic cost consequences, or both. Hence most risk analyses use qualitative, rather than quantitative, ratings for both these items.

14.15 The items typically specified in the risk register for each asset/threat identified are: Asset, Threat/Vulnerability, Existing Controls, Likelihood, Consequence, Level of Risk, and Risk Priority 14.16 Five alternatives for managing identified risks are: • risk acceptance: choosing to accept a risk level greater than normal for business reasons, typically due to excessive cost or time needed to treat the risk. Management must then accept responsibility for the consequences to the organization should the risk eventuate.

• risk avoidance: not proceeding with the activity or system that creates this risk. This usually results in loss of convenience or ability to perform some function that is useful to the organization.

The loss of this capability is traded off against the reduced risk profile.

• risk transferal: sharing responsibility for the risk with a thirdparty. This is typically achieved by taking out insurance against the risk occurring, by entering into a contract with another organization, or by using partnership or joint venture structures to share the risks and costs should it eventuate.

• reduce consequence: by modifying the structure or use of the assets at risk to reduce the impact on the organization should the risk occur. This could be achieved by implementing controls to enable the organization to quickly recover should the risk occur.

• reduce likelihood: by implementing suitable controls to lower the chance of the vulnerability being exploited. These could include technical or administrative controls that aim to improve the security -11-

of the asset, making it harder for an attack to succeed by reducing the vulnerability of the asset.

ANSWERS TO PROBLEMS 14.1 There is no simple answer to this problem, as it depends on the relevant organization’s IT Security Policy. However any answer should consider all the topics listed in section 14.2, and should explicitly refer to any relevant privacy or corporate governance legislation.

14.2 Possible values for the risk register for this asset and threat are: Asset integrity of /customer and financial data files on desktop systems

Threat/ Vulnerability corruption of these files due to import of a worm/virus onto system

Existing Controls anti-virus program

Likelihood

Consequence

Level of Risk

Almost Certain

Major

Extreme

Given limited IT support, it is likely that the systems and A/V programs are not current, hence given the high rate of worm/virus incidents, infection is almost certain. Similarly, it is likely that such an organization does not regularly backup their data, hence such an infection could cause loss of critical customer/financial data, with serious impact on the organizations functions. Clearly changing these assumptions will change the ratings.

14.3 Possible values for the risk register for this asset and threat are: Asset integrity of the accounting records on the server

Threat/ Vulnerability financial fraud by employee, disguised by altering the accounting records

Existing Controls monthly account audit

Likelihood

Consequence

Level of Risk

Possible

Moderate

High

The chance of insider fraud can be very hard to predict, but is clearly possible. Depending on how long it takes for the fraud to be identified, there could be significant impact on the organizations finances.

Assuming there is a regular monthly audit check of the firm’s cashflow, -12-

it is likely the fraud will be detected relatively quickly, which suggests a moderate consequence rating. Again changing these assumptions will change the ratings.

14.4 Possible values for the risk register for this asset and threat are: Asset integrity of the organizatio n’s web server

Threat/ Vulnerability hacking and defacement of the web server

Existing Controls -

Likelihood

Consequence

Level of Risk

Possible

Minor

Medium

Assuming that their website uses common CGI programs such as guestbook or blog software, then given the rate of remotely exploitable bugs found in such program, exploit is possible (and is very dependent on both how carefully their IT support tracks reports of such bugs and patches when found, and bad luck in being identified and targeted by an attacker). However whilst defacement of their site may well cause embarrassment and adverse publicity, it ought not affect the actual production work. It is also fairly easy to correct.

Hence assume a minor consequence. Changing these assumptions will change the ratings.

14.5 Possible values for the risk register for this asset and threat are: Asset confidentiality of techniques used to conduct penetration tests on customers, and the results of conducting such tests for clients, which are stored on the server

Threat/ Vulnerability theft/breach of this confidential and sensitive information by either an external or internal source

Existing Controls risk assessed, hardened O/S, automated patching, IDS

Likelihood

Consequence

Level of Risk

Unlikely

Catastrophic

Extreme

Given that the main file server belongs to an IT security consultancy firm it is reasonable to assume that it is managed according to current best practice, having undergone a risk assessment, and using a hardened O/S with automated patching and an IDS. Nonetheless, given that zero-day exploits continue to be found, successful external exploit is conceivable, if unlikely. As noted in the answer to problem 14.3, insider attack is also conceivable, if very hard to predict. Should this attack occur, the damage to the firm is likely to be serious, as it attacks -13-

the core of their reputation and intellectual property. Hence assume a catastrophic consequence. Changing these assumptions will change the ratings.

14.6 Possible values for the risk register for this asset and threat are: Asset confidentiality of personnel information in a copy of a database stored unencrypted on the laptop

Threat/ Vulnerability theft of personal information, and its subsequent use in identity theft caused by the theft of the laptop

Existing Controls insurance

Likelihood

Consequence

Level of Risk

Possible

Major

Extreme

Given the very high report rate of laptop theft (e.g. the 2006 CSI/FBI survey shows 47% of respondents suffered from this), if the data stored on the laptop is not encrypted (as is still common), then the chances of it being accessed and used in identity theft is possible – depending on the motivations and skills of the thief. Hence assume a rating of possible for this specific threat. A number of large government departments and agencies have been embarrassed, and suffered significant financial penalties, as a result of such a theft in recent years. Hence assume a consequence of major. Changing these assumptions will change the ratings.

14.7 Possible threat sources can be grouped as Adversarial (Individual, Group, Organization, Nation-State), Accidental, Structural (IT Equipment, Controls, Software), and Environmental (Natural Or ManMade Disaster, Unusual Natural Event, Infrastructure Failure/Outage).

14.8 NIST SP 800-30 (2002) Tables 3-4 to 3-7 use a 3 level scale of high/medium/low for each of likelihood, consequence and risk, while our Tables 14.2 to 14.4 use 5, 6, and 4 levels respectively. This means that assessments using our ratings can use a finer level of granularity, and potentially better separate different asset/threat items, than assessments done using the NIST tables. However having a greater number of levels means that it can be harder to determine the most appropriate rating (although some small changes do not alter the final resultant risk level).

-14-

CHAPTER 15 IT SECURITY CONTROLS, PLANS, AND PROCEDURES ANSWERS TO QUESTIONS 15.1 Security controls or safeguards are practices, procedures or mechanisms that may protect against a threat, reduce a vulnerability, limit the impact of an unwanted incident, or detect unwanted incidents and facilitate recovery.

15.2 The three broad classes of controls are: • management control: focus on security policies, planning, guidelines and standards which then influence the selection of operational and technical controls to reduce the risk of loss and to protect the organization’s mission.

• operational control: address the correct implementation and use of security policies and standards, ensuring consistency in security operations, and correcting identified operational deficiencies.

• technical controls: involve the correct use of hardware and software security capabilities in systems.

In turn, each of these control classes may include: • supportive controls: pervasive, generic, underlying technical IT security capabilities that are interrelated with, and used by many other controls.

• preventative controls: focus on preventing security breaches from occurring, by inhibiting attempts to violate security policies or exploit a vulnerability.

• detection and recovery controls: focus on the response to a security breach, by warning of violations or attempted violations of security policies or the identified exploit of a vulnerability, and by providing means to restore the resulting lost computing resources.

15.3 To list a specific example of each of three broad classes of controls from those given in Table 15.3, first use Table 15.1 which classifies the control families into the relevant class, then select any suitable entry from a suitable control family in Table 15.3 for each. If further details are wanted, consult [NIST09] for detailed information on each item.

-15-

15.4 The steps we discuss for selecting and implementing controls are shown in Figure 15.1: 1. Prioritize risks (management review of risk register) 2. Respond to risks (determine risk response, evaluate recommended control options, select controls, develop implementation plan and implement selected controls) 3. Monitor risks 15.5 Implementing a new or enhanced control can reduce the residual level of risk as a result of the reduction in threat likelihood from either reducing vulnerabilities/flaws/weaknesses in the system, or by reducing the capability and motivation of the threat source; or from a reduction in consequence by reducing the magnitude of the adverse impact of the threat occurring on the organization.

15.6 The items that should be included in an IT Security Implementation Plan include: risks (asset/threat/vulnerability combinations); recommended controls (from the risk assessment); action priority for each risk; selected controls (on the basis of the cost-benefit analysis); required resources for implementing the selected controls; responsible personnel; target start and end dates for implementation; maintenance requirements and other comments.

15.7 The elements that form the “Implementation of Controls” phase of IT security management include: • implementation of the security plan (where the identified personnel undertake the tasks needed to implement the new or enhanced controls).

• security training (of the personnel responsible for the development, operation and administration of the system being installed or enhanced) • security awareness (training for all personnel in an organization to assist it in meeting the security objectives).

15.8 The organizational security officer checks that • The implementation costs and resources used stay within identified bounds.

• The controls are correctly implemented as specified in the plan, in order that the identified reduction in risk level is achieved.

• The controls are operated and administered as needed.

15.9 The elements that form the “Implementation Follow-up” phase of IT security management are: • maintenance of security controls (to ensure their continued correct functioning and appropriateness) -16-

• •

•

security compliance checking (an audit process to review the organization’s security processes to verify compliance with the security plan) change and configuration management (the process used to review proposed changes to systems for implications of both security related and wider operational aspects, on the organization’s systems and use) incident handling (procedures used to respond to a security incident).

15.10 Because changes can affect security, the general process of change and configuration management overlaps IT security management and must interact with it.

ANSWERS TO PROBLEMS 15.1 To manage the risk to "integrity of customer and financial data files on system" from "corruption of these files due to import of a worm/virus onto system (exercise 14.2), some suitable specific controls from Table 15.3 could include: Security Awareness training, Access Restrictions for Change, Periodic and Timely Systems Maintenance, Malicious Code Protection, Intrusion Detection Tools and Techniques, Spam and Spyware Protection. The most cost-effective controls are likely to include Malicious Code Protection and Spam and Spyware Protection to identify and block infections, along with Periodic and Timely Systems Maintenance to keep the system patched.

15.2 To manage the risk to "integrity of the accounting records on the server" from "financial fraud by an employee, disguised by altering the accounting records " (exercise 14.3), some suitable specific controls from Table 15.3 could include: Separation of Duties, Access Control Supervision and Review, Audit Monitoring, Analysis, and Reporting, Audit Reduction and Report Generation, User Identification and Authentication, Personnel Screening. The most cost-effective controls are likely to include Separation of Duties to ensure that significant financial transactions must be authorized by multiple staff, along with Access Control Supervision and Review to help detect fraud should it occur.

15.3 To manage the risk to "integrity of the organization’s web server" from "hacking and defacement of the web server” (exercise 14.4), some suitable specific controls from Table 15.3 could include: Access Restrictions for Change, Periodic and Timely Systems Maintenance, Flaw Remediation, Incident Handling, Vulnerability Scanning, Intrusion Detection Tools and Techniques, Security Alerts and Advisories. The -17-

most cost-effective controls are likely to include Periodic and Timely Systems Maintenance and Flaw Remediation to try and reduce the likelihood of the web server running buggy software, along with good Incident Handling processes to react and correct the system should the threat occur.

15.4 To manage the risk to "confidentiality of techniques for conducting penetration tests on customers, and the results of these tests, which are stored on the server" from "theft/breach of this confidential and sensitive information" (exercise 14.5), some suitable specific controls from Table 15.3 could include: Account Management, Access Enforcement, Separation of Duties, Least Privilege, Audit Monitoring, Analysis, and Reporting, Audit Reduction and Report Generation, User Identification and Authentication, Periodic and Timely Systems Maintenance, Flaw Remediation, Personnel Screening, Personnel Sanctions, Intrusion Detection Tools and Techniques. Given the seriousness of the consequences, controls should focus on reducing the likelihood of this threat occurring, hence the most cost-effective controls are likely to include Personnel Screening, Personnel Sanctions, User Identification and Authentication, Access Enforcement, and Separation of Duties to help manage insider threats; and Periodic and Timely Systems Maintenance, Flaw Remediation, and Intrusion Detection Tools and Techniques to help manage external threats.

15.5 To manage the risk to “confidentiality of personnel information in a copy of a database stored unencrypted on the laptop" from "theft of personal information, and its subsequent use in identity theft caused by the theft of the laptop" (exercise 14.6), some suitable specific controls from Table 15.3 could include: Access Control for Portable and Mobile Systems, Security Awareness Training, Physical Access Control, Personnel Sanctions, Use of Validated Cryptography. The most costeffective controls are likely to include the Use of Validated Cryptography and Access Control for Portable and Mobile Systems to ensure any sensitive information is encrypted and hence cannot be accessed as a result of the theft, along with Security Awareness Training and Personnel Sanctions to help limit the transfer of sensitive information to such devices, and to adjust behavior to reduce the chance of such thefts occurring.

15.6 In managing the risks identified in the assessment of a small public service agency (exercise 14.7), clearly a very wide range of controls are applicable. Depending on assumptions made and the current environment, what are considered the most critical risks can vary considerably. However these would likely include the common natural environmental threats (fire, flood, failure of power/water/air conditioning). Against these, suitable contingency planning and -18-

physical and environmental protection controls should be chosen.

Critical risks would also include those due to accidental insider actions such as operational errors, and the input of invalid information.

Against these controls from the awareness and training and audit and accountability sections should be chosen. In the case of deliberate insider threats (fraud, sale of information etc), audit and accountability and personnel controls could be used. Lastly for external attacks, controls relating to access controls, configuration management, contingency planning and incident response can be used.

-19-

CHAPTER 16 PHYSICAL AND INFRASTRUCTURE SECURITY ANSWERS TO QUESTIONS 16.1 (1) Room temperature too hot or too cold for equipment. (2) Internal equipment temperature too hot. (3) Humidity too high or too low.

16.2 The direct threat is the damage caused by the fire itself. The indirect threats are from heat, release of toxic fumes, water damage from fire suppression, and smoke damage.

16.3 Undervoltage, overvoltage, and noise.

16.4 Dealing with this problem is primarily a matter of having environmental-control equipment of appropriate capacity and appropriate sensors to warn of thresholds being exceeded. Beyond that, the principal requirement is the maintenance of a power supply.

16.5 1. Choice of site to minimize likelihood of disaster. Few disastrous fires originate in a well-protected computer room or IS facility. The IS area should be chosen to minimize fire, water, and smoke hazards from adjoining areas. Common walls with other activities should have at least a one-hour fire-protection rating.

2. Air conditioning and other ducts designed so as not to spread fire.

There are standard guidelines and specifications for such designs.

3. Positioning of equipment to minimize damage.

4. Good housekeeping. Records and flammables must not be stored in the IS area. Tidy installation if IS equipment is crucial.

5. Hand-operated fire extinguishers readily available, clearly marked, and regularly tested.

6. Automatic fire extinguishers installed. Installation should be such that the extinguishers are unlikely to cause damage to equipment or danger to personnel.

7. Fire detectors. The detectors sound alarms inside the IS room and with external authorities, and start automatic fire extinguishers after a delay to permit human intervention.

-20-

8. Equipment power-off switch. This switch must be clearly marked and unobstructed. All personnel must be familiar with power-off procedures.

9. Emergency procedures posted.

10. Personnel safety. Safety must be considered in designing the building layout and emergency procedures.

11. Important records stored in fireproof cabinets or vaults.

12. Records needed for file reconstruction stored off the premises.

13. Up-to-date duplicate of all programs stored off the premises.

14. Contingency plan for use of equipment elsewhere should the computers be destroyed.

15. Insurance company and local fire department should inspect the facility.

16.6 Prevention and mitigation measures for water threats must encompass the range of such threats. For plumbing leaks, the cost of relocating threatening lines is generally difficult to justify. With knowledge of the exact layout of water supply lines, measures can be taken to locate equipment sensibly. The location of all shutoff valves should be clearly visible or at least clearly documented, and responsible personnel should know the procedures to follow in case of emergency. To deal with both plumbing leaks and other sources of water, sensors are vital.

Water sensors should be located on the floor of computer rooms, as well as under raised floors, and should cut off power automatically in the event of a flood.

16.7 To deal with brief power interruptions, an uninterruptible power supply (UPS) should be employed for each piece of critical equipment. The UPS is a battery backup unit that can maintain power to processors, monitors, and other equipment for a period of minutes. UPS units can also function as surge protectors, power noise filters, and automatic shutdown devices when the battery runs low. For longer blackouts or brownouts, critical equipment should be connected to an emergency power source, such as a generator. For reliable service, a range of issues need to be addressed by management, including product selection, generator placement, personnel training, testing and maintenance schedules, and so forth.

ANSWERS TO PROBLEMS 16.1 The World Bank checklist specifically mentions the following items not covered by the Security Policy: biometric and smart card access control techniques; checking audit trails; storage of backup data securely; unused ports turned off; use of surveillance cameras; fire suppression equipment; humidity controls; ceiling reinforcement. The -21-

Security Policy is general but goes into more detail than the checklist on procedures and general areas of concern. It is interesting to note that in fact there are quite a few areas covered in each document that are not covered in the other. Both are meant as guidelines but clearly neither is exhaustive.

16.2 The chapter generally covers all of the areas mentioned in the two documents.

16.3 The Security Policy covers in general terms the areas that are covered in more detail in Sections 16.1 through 16.3 of this chapter. It does not cover the material in Sections 16.4, 16.5, and 16.7. The scope of this chapter is broader.

-22-

16.4 There is no unique set of answers to this question. The following is one set.

Boundary type (what constitutes the perimeter)

Standards

IT Security Complex boundaries that combine hardware, software and networks (VPN, Web browsing, database, wireless) Customers demand interoperability; equal mix of standards-based and proprietary systems

Maturity

Rapid evolution of products

Frequency of attacks

High: attacks often scale quickly, with active communities discussing wellknown attacks Effective patch management and update mechanisms

Attack responses (types of responses) Risk to attackers Evidence of compromise

Few: hard to trace sophisticated attacks Varies, hard to tell if data were copied

-23-

Physical Security Discrete, well-defined boundaries (vaults, building walls, containers) Some infrastructure uses commodity parts, but systems are generally proprietary and not interoperable Industry has 100-plus years of processes and response system; longer product cycles Low: attacks tend to be localized and repeated less often Security fixes and firmware updates applied in nonuniform fashion High: adversary risks physical arrest/capture Stolen items are noticed missing.

CHAPTER 17 HUMAN RESOURCES SECURITY ANSWERS TO QUESTIONS 17.1 • Improving employee behavior • Increasing the ability to hold employees accountable for their actions • Mitigating liability of the organization for an employee's behavior • Complying with regulations and contractual obligations 17.2 In general, a security awareness program seeks to inform and focus an employee's attention on issues related to security within the organization. A security training program is designed to teach people the skills to perform their IS-related tasks more securely.

17.3 Improving employee behavior Increasing the ability to hold employees accountable for their actions Mitigating liability of the organization for an employee's behavior Complying with regulations and contractual obligations 17.4 Hiring: to ensure that employees, contractors, and third-party users understand their responsibilities and are suitable for the roles they are considered for, and to reduce the risk of theft, fraud, or misuse of facilities.

During employment: to ensure that employees, contractors, and third-party users are aware of information security threats and concerns and their responsibilities and liabilities with regard to information security and are equipped to support organizational security policy in the course of their normal work and to reduce the risk of human error.

Terminating employment: to ensure that employees, contractors, and third-party users exit an organization or change employment in an orderly manner, and that the return of all equipment and the removal of all access rights are completed.

17.5 ISO 27002 is a comprehensive set of controls comprising best practices in information security. It is essentially an internationally recognized generic information security standard.

-24-

17.6 E-mail and Internet access for most or all employees is common in office environments and is typically provided for at least some employees in other environments, such as a factory. This widespread use dictates the need for a security policy.

17.7 1. Significant employee work time may be consumed in non-workrelated activities, such as surfing the Web, playing games on the Web, shopping on the Web, chatting on the Web, and sending and reading personal e-mail.

2. Significant computer and communications resources may be consumed by such non-work-related activity, compromising the mission that the IS resources are designed to support.

3. Excessive and casual use of the Internet and e-mail unnecessarily increases the risk of introduction of malicious software into the organization's IS environment.

4. The non-work-related employee activity could result in harm to other organizations or individuals outside the organization, thus creating a liability for the organization.

5. E-mail and the Internet may be used as tools of harassment by one employee against another.

6. Inappropriate online conduct by an employee may damage the reputation of the organization.

17.8 The benefits of developing an incident response capability include: responding to incidents systematically so that the appropriate steps are taken; helping personnel to recover quickly and efficiently from security incidents, minimizing loss or theft of information, and disruption of services; using information gained during incident handling to better prepare for handling future incidents and to provide stronger protection for systems and data; and dealing properly with legal issues that may arise during incidents.

17.9 The broad categories of security incidents include various forms of unauthorized access to a system, and various forms of unauthorized modification of information on the system.

17.10 Some types of tools used to detect and respond to incidents are: system integrity verification tools, log analysis tools, network and host intrusion detection systems, and intrusion prevention systems.

17.11 Following the immediate response to an incident, there is a need to identify what vulnerability led to its occurrence, and how this might be addressed to prevent it occurring in future. Details of the incident, and the response taken are recorded for future reference. The impact on the organization’s systems, and their risk profile must also be reconsidered as a result of the incident.

-25-

ANSWERS TO PROBLEMS 17.1 Awareness deals with what the security threats are. Training deals with how to counter those threats.

17.2 a. Taking pictures of or in the worksite should be forbidden in the policy. [often overlooked these days]. The janitor should be fired. If the policy did not include this, fire the janitor for goofing off. b. Rewrite the policy to state that taking pictures is forbidden at the worksite.

17.3 You should definitely not open such an attachment, as the email has a number of characteristics of a SPAM email phishing for information, including the awkward grammar and suspect attachment file extension. Depending on your organization’s policy is for suspect communications, you would either delete such emails immediately, or report it to your IT security personnel. If you thought there was any possibility of it being valid, you could ring your organization’s personnel section, and ask for confirmation of its validity, though you would certainly want to query the suspicious file extension.

17.4 The ISO 27002 security objective with respect to termination of employment: “to ensure that employees, contractors, and third-party users exit an organization or change employment in an orderly manner, and that the return of all equipment and the removal of all access rights are completed” has clearly not been followed, since Lynsay still has access rights to the company IT systems, and physical access to the office. These access rights should have been revoked as part of the termination process.

17.5 Provided that your organization has an e-mail and Internet use policy covering issues such as those listed in section 17.3, and that all employees are asked to read and sign their agreement to such policies when starting employment, then this forms the basis for management to act in these circumstances. In this instance, Greg has very likely violated areas such as “Standard of Conduct” and “Company Policy” on harassing or discriminatory communications, leading to the prospect of “Disciplinary Action” as a consequence.

17.6 All security administrators should check search engines on a regular basis for the words MyCompanySucks or My Company Sucks. The policy should also address blogs as they are becoming popular. All employees should sign agreement to notify company of any preexisting blogs or future blogs and must agree not to discuss company stuff in a general or specific way in the blog. Security personnel should -26-

be reading the blogs of every employee who has one to ensure that the blogs are in line with confidentiality and security procedures. If the company has company blogs, only specific employees would be allowed to post to them and those posts must be preapproved. Phil must agree to remove the offending link, is not entitled to keep a blog during work time (even if it is during his breaks) on a work computer.

Phil's willingness to link to a CompanySucks blog points to a larger problem of employee morale. Could be that he is either immature or resentful and he should be given an older man mentor (who is not his boss) to develop a relationship with to further his career growth, and maybe will be a role model to him also.

17.7 In the incident response policy for the small accounting firm (exercises 14.2 and 15.1), in response to the detection of an email worm infecting some of the company systems and producing large volumes of email spreading the propagation, if the indications are that the infection is seriously compromising the external network connections, and the risk of further infection is high, then disconnecting the firm’s systems from the Internet to limit further spread is a reasonable policy. Whilst recognizing this will impact email/web communications and hence the firm’s operations, it is still likely the better option than contributing to the further spread of the infection. The policy would most likely also recommend reporting the incident to the appropriate Computer Emergency Response Team (CERT), but not as a matter of urgency (if it is large enough, they will know about it). It would not recommend reporting it to law enforcement authorities, since its unlikely that legal action in response is possible.

17.8 In the incident response policy for the small legal firm (exercises 14.3 and 15.2), in response to the detection of significant financial fraud by an employee, initial actions should include isolating the suspected staff member from any access to the firm’s systems, and arranging for a forensic copy to be made of all relevant data, especially audit records of actions taken on the system, in the event of future legal action. This incident should be reported to the relevant law enforcement authorities to allow them to respond and collect evidence needed.

Ideally it should also be reported in general terms to the relevant Computer Emergency Response Team (CERT) to allow them to compile accurate statistics of computer crime incidents.

17.9 In the incident response policy for the web design company (exercises 14.4 and 15.3), in response to the detection of hacking and defacement of their web server, it would most likely NOT recommend disconnecting the system from the Internet to limit damaging publicity, but rather immediately restoring the defaced pages from backups, and initiating action to identify the vulnerability exploited to -27-

allow the attack, and taking immediate steps to block access to it (which may involve removing some functionality from the system pending further analysis and corrective action). This is more likely an appropriate response than complete disconnection, as the web site is needed to promote the company’s operations. The policy would most likely also recommend immediately reporting the incident to the appropriate Computer Emergency Response Team (CERT), as they may be able to advise whether it is part of a larger coordinated attack, and perhaps supply additional information on countering it. It would not recommend reporting it to law enforcement authorities unless there is evidence identifying the attacker, since otherwise it is unlikely that legal action in response is possible.

17.10 In the incident response policy for the large government department (exercises 14.6 and 15.5), in response to the report of theft of a laptop containing a large number of sensitive personnel records, the policy will likely be bound by legal requirements which increasingly mandate contacting the personnel whose records have been stolen, and most likely requiring the government to provide monitoring of their credit records for some period. Assuming the department has policies concerning the circumstances under which sensitive information can be transferred to laptops, if these were not followed then the relevant sanctions should be imposed against the employee whose laptop was stolen. If the department does not have such policies, this lack should be highlighted as a consequence of the development of this policy, and management warned that serious adverse publicity and financial costs are possible should this risk occur. Legal requirements increasingly mandate that the incident should be reported to the relevant law enforcement authorities, and/or government security agency, to allow them to respond appropriately. Ideally it should also be reported in general terms to the relevant Computer Emergency Response Team (CERT) to allow them to compile accurate statistics of computer crime incidents.

-28-

CHAPTER 18 SECURITY AUDITING ANSWERS TO QUESTIONS 18.1 An event discriminator is a logical module that detects security-relate event. Each such event triggers a security audit message to an audit recorder. Thus the message simply causes the detected event to be recorded. If the event requires some defensive action, the event discriminator sends a security alarm on this even to an alarm processor to trigger the action. Thus a security alarm results in an action.

18.2 • Event discriminator: The is logic embedded into the software of the system that monitors system activity and detects security-related events that it has been configured to detect.

• Audit recorder: For each detected event, the event discriminator transmits the information to an audit recorder. The model depicts this transmission as being in the form of a message. The audit could also be done by recording the event in a shared memory area.

• Alarm processor: Some of the events detected by the event discriminator are defined to be alarm events. For such events an alarm is issued to an alarm processor. The alarm processor takes some action based on the alarm. This action is itself an auditable event and so is transmitted to the audit recorder.

• Security audit trail: The audit recorder creates a formatted record of each event and stores it in the security audit trail.

• Audit analyzer: The security audit trail is available to the audit analyzer, which, based on a pattern of activity, may define a new auditable event that is sent to the audit recorder and may generate an alarm.

• Audit archiver: This is a software module that periodically extracts records from the audit trail to create a permanent archive of auditable events.

• Archives: The audit archives are a permanent store of securityrelated events on this system.

• Audit provider: The audit provider is an application and/or user interface to the audit trail.

• Audit trail examiner: The audit trail examiner is an application or user who examines the audit trail and the audit archives for historical trends, for computer forensic purposes, and for other analysis.

-29-

• Security reports: The audit trail examiner prepares human-readable security reports.

18.3 • Data generation: Identifies the level of auditing, enumerates the types of auditable events, and identifies the minimum set of auditrelated information provided. This function must also deal with the conflict between security and privacy and specify for which events the identity of the user associated with an action is included in the data generated for an event.

• Event selection: Inclusion or exclusion of events from the auditable set. This allows the system to be configured at different levels of granularity to avoid the creation of an unwieldy audit trail.

• Event storage: Creation and maintenance of the secure audit trail.

The storage function includes measures to provide availability and to prevent loss of data from the audit trail.

• Automatic response: Defines reactions taken following detection of events that are indicative of a potential security violation.

• Audit analysis: Provided via automated mechanisms to analyze system activity and audit data in search of security violations. This component identifies the set of auditable events whose occurrence or accumulated occurrence indicates a potential security violation. For such events, an analysis is done to determine if a security violation has occurred; this analysis uses anomaly detection and attack heuristics.

• Audit review: As available to authorized users to assist in audit data review. The audit review component may include a selectable review function that provides the ability to perform searches based on a single criterion or multiple criteria with logical (i.e. and/or) relations, sort audit data, and filter audit data before audit data are reviewed. Audit review may be restricted to authorized users.

18.4 • Introduction of objects within the security-related portion of the software into a subject’s address space • Deletion of objects • Distribution or revocation of access rights or capabilities • Changes to subject or object security attributes • Policy checks performed by the security software as a result of a request by a subject • The use of access rights to bypass a policy check • Use of identification and authentication functions • Security-related actions taken by an operator and/or authorized user (e.g., suppression of a protection mechanism) • Import/export of data from/to removable media (e.g., printed output, tapes, disks)

-30-

18.5 System-level audit trails: captures data such as login attempts, both successful and unsuccessful, devices used, and OS functions performed Application-level audit trails: may be used to detect security violations within an application or to detect flaws in the application's interaction with the system.

User-level audit trails: traces the activity of individual users over time.

Physical access audit trails: generated by equipment that controls physical access and then transmitted to a central host for subsequent storage and analysis.

18.6 • syslog(): An application program interface (API) referenced by several standard system utilities and available to application programs • logger: A UNIX command used to add single-line entries to the system log • /etc/syslog.conf: The configuration file used to control the logging and routing of system log events • syslogd: The system daemon used to receive and route system log events from syslog() calls and logger commands.

18.7 This technique described provides for application-level auditing by creating new procedures that intercept calls to shared library functions in order to instrument the activity.

18.8 • Audit analysis: Provided via automated mechanisms to analyze system activity and audit data in search of security violations. This component identifies the set of auditable events whose occurrence or accumulated occurrence indicates a potential security violation. For such events, an analysis is done to determine if a security violation has occurred; this analysis uses anomaly detection and attack heuristics.

• Audit review: As available to authorized users to assist in audit data review. The audit review component may include a selectable review function that provides the ability to perform searches based on a single criterion or multiple criteria with logical (i.e. and/or) relations, sort audit data, and filter audit data before audit data are reviewed. Audit review may be restricted to authorized users.

18.9 SIEM software is a centralized logging software package similar to, but much more complex than, syslog. SIEM systems provide a centralized, uniform audit trail storage facility and a suite of audit data analysis programs.

ANSWERS TO PROBLEMS -31-

18.1 a. The X.800 series is specifically concerned with networking and telecommunications, so you would expect a more network-based orientation than ISO 27002, which is focused on information and computer security. This is reflected in Tables 18.2 and 18.3. For example, X.816 refers to connection-related security events, and ISO 27002 does not. b. An example of the ISO 27002 focus on computer security is the set of events related to privileged operations. X.816 has not comparable events.

18.2 a. X.816, with its orientation to the OSI model, refers to events related to the layers of that model in a way that Table 18.6 does not. The items in ISO 27002 are fairly well covered in Table 18.6. b. Table 18.6 is a lengthier and more detailed list. As such, it provides perhaps more useful guidance in developing a specific list of events.

18.3 From SP-800-92: There are advantages and disadvantages to each method. The primary advantage of the agentless approach is that agents do not need to be installed, configured, and maintained on each logging host. The primary disadvantage is the lack of filtering and aggregation at the individual host level, which can cause significantly larger amounts of data to be transferred over networks and increase the amount of time it takes to filter and analyze the logs. Another potential disadvantage of the agentless method is that the SIEM server may need credentials for authenticating to each logging host. In some cases, only one of the two methods is feasible; for example, there might be no way to remotely collect logs from a particular host without installing an agent onto it.

-32-

CHAPTER 19 LEGAL AND ETHICAL ASPECTS ANSWERS TO QUESTIONS 19.1 • Computers as targets: This form of crime targets a computer system, to acquire information stored on that computer system, to control the target system without authorization or payment (theft of service), or to alter the integrity of data or interfere with the availability of the computer or server. Using the terminology of Chapter 1, this form of crime involves an attack on data integrity, system integrity, data confidentiality, privacy, or availability.

• Computers as storage devices: Computers can be used to further unlawful activity by using a computer or a computer device as a passive storage medium. For example, the computer can be used to store stolen password lists, credit card or calling card numbers, proprietary corporate information, pornographic image files, or "warez" (pirated commercial software).

• Computers as communications tools: Many of the crimes falling within this category are simply traditional crimes that are committed online. Examples include the illegal sale of prescription drugs, controlled substances, alcohol, and guns; fraud; gambling; and child pornography.

19.2 • Real property: Land and things permanently attached to the land, such as trees, buildings, and stationary mobile homes.

• Personal property: Personal effects, moveable property and goods, such as cars, bank accounts, wages, securities, a small business, furniture, insurance policies, jewelry, patents, pets, and season baseball tickets.

• Intellectual property: Any intangible asset that consists of human knowledge and ideas. Examples include software, data, novels, sound recordings, the design of a new type of mousetrap, or a cure for a disease.

19.3 • Copyrights: Copyright law protects the tangible or fixed expression of an idea, not the idea itself.

-33-

• Trademarks: A trademark is a word, name, symbol, or device that is used in trade with goods to indicate the source of the goods and to distinguish them from the goods of others.

• Patents: A patent for an invention is the grant of a property right to the inventor.

19.4 (1) The proposed work is original. (2) The creator has put this original idea into a concrete form, such as hard copy (paper), software, or multimedia form.

19.5 • Reproduction right: Lets the owner make copies of a work • Modification right: Also known as the derivative-works right, concerns modifying a work to create a new or derivative work • Distribution right: Lets the owner publicly sell, rent, lease, or lend copies of the work.

• Public-performance right: Applies mainly to live performances • Public-display right: Lets the owner publicly show a copy of the work directly or by means of a film, slide, or television image 19.6 The DMCA, signed into law in 1998, is designed to implement World Intellectual Property Organization (WIPO) treaties, signed in 1996. In essence, DMCA strengthens the protection of copyrighted materials in digital format.

19.7 Digital Rights Management (DRM) refers to systems and procedures that ensure that holders of digital rights are clearly identified and receive the stipulated payment for their works.

19.8 • Content provider: Holds the digital rights of the content and wants to protect these rights. Examples are a music record label and a movie studio.

• Distributor: Provides distribution channels, such as an online shop or a Web retailer. For example, an online distributor receives the digital content from the content provider and creates a Web catalog presenting the content and rights metadata for the content promotion.

• Consumer: Uses the system to access the digital content by retrieving downloadable or streaming content through the distribution channel and then paying for the digital license. The player/viewer application used by the consumer takes charge of initiating license request to the clearinghouse and enforcing the content usage rights.

• Clearinghouse: Handles the financial transaction for issuing the digital license to the consumer and pays royalty fees to the content provider and distribution fees to the distributor accordingly. The clearinghouse is also responsible for logging license consumptions for every consumer.

-34-

19.9 • Notice: Organizations must notify individuals what personal information they are collecting, the uses of that information, and what choices the individual may have.

• Consent: Individuals must be able to choose whether and how their personal information is used by, or disclosed to, third parties. They have the right not to have any sensitive information collected or used without express permission, including race, religion, health, union membership, beliefs, and sex life.

• Consistency: Organizations may use personal information only in accordance with the terms of the notice given the data subject and any choices with respect to its use exercised by the subject.

• Access: Individuals must have the right and ability to access their information and correct, modify, or delete any portion of it.

• Security: Organizations must provide adequate security, using technical and other means, to protect the integrity and confidentiality of personal information.

• Onward transfer: Third parties receiving personal information must provide the same level of privacy protection as the organization from whom the information is obtained.

• Enforcement: The Directive grants a private right of action to data subjects when organizations do not follow the law. In addition, each EU member has a regulatory enforcement agency concerned with privacy rights enforcement.

19.10 The Common Criteria specification is primarily concerned with the privacy of an individual with respect to that individual's use of computer resources, rather than the privacy of personal information concerning that individual.

19.11 Consent: ensuring participants can make informed decisions about their participation in the research Privacy and confidentiality: privacy is the control that individuals have over who can access their personal information. Confidentiality is the principle that only authorized persons should have access to information.

Ownership and authorship: addresses who has responsibility for the data, and at what point does an individual give up their right to control their personal data.

Data sharing – assessing the social benefits of research: that result from data matching and re-use of data from one source or research project in another Governance and custodianship: oversight and implementation of the management, organization, access, and preservation of digital data.

-35-

19.12 1. A code can serve two inspirational functions: as a positive stimulus for ethical conduct on the part of the professional, and to instill confidence in the customer or user of an IS product or service. However, a code that stops at just providing inspirational language is likely to be vague and open to an abundance of interpretations.

2. A code can be educational. It informs professionals about what should be their commitment to undertake a certain level of quality of work and their responsibility for the well being of users of their product and the public, to the extent the product may affect nonusers. The code also serves to educate managers on their responsibility to encourage and support employee ethical behavior and on their own ethical responsibilities.

3. A code provides a measure of support for a professional whose decision to act ethically in a situation may create conflict with an employer or customer.

4. A code can be a means of deterrence and discipline. A professional society can use a code as a justification for revoking membership or even a professional license. An employee can use a code as a basis for a disciplinary action.

5. A code can enhance the profession's public image, if it is seen to be widely honored.

ANSWERS TO PROBLEMS 19.1 Article 2 Illegal access: This is a general threat the could fall into any of the three categories, depending on what use is made of the access.

Article 3 Illegal interception: Computer as target, attack on data confidentiality.

Article 4 Data interference: Computer as target, attack on data integrity.

Article 5 System interference: Computer as target, various attack types.

Article 6 Misuse of devices: Primarily computer as communications tool.

Article 7 Computer-related forgery: Computer as target, data integrity or privacy.

Article 8 Computer-related fraud: Computer as communications tool Article 9 Offenses related to child pornography: Computer as communications tool.

Article 10 Infringements of copyright and related rights: Computer as communications tool.

-36-

Article 11 Attempt and aiding or abetting: Computer as communications tool.

19.2 Theft of intellectual property: Computer as target, attack on data confidentiality.

Theft of other (proprietary) info including customer records, financial records, etc.: Computer as target, attack on privacy.

Denial of service attacks: Computer as target, attack on availability.

Virus, worms or other malicious code: This is a general threat the could fall into any of the three categories, depending on what use is made of the attack.

Fraud (credit card fraud, etc.): Computer as communications tool.

Identity theft of customer: Computer as communications tool.

Illegal generation of spam e-mail. Computer as communications tool.

Phishing: Computer as target, attack on privacy.

Unauthorized access to/use of information, systems or networks: This is a general threat the could fall into any of the three categories, depending on what use is made of the attack.

Sabotage: deliberate disruption, deletion, or destruction of information, systems, or networks: Computer as target, attack on availability.

Extortion: Computer as communications tool.

Web site defacement: Computer as target, attack on data integrity.

Zombie machines on organization’s network/bots/use of network by BotNets: Computer as communications tool.

Intentional exposure of private or sensitive information: Computer as target, attack on privacy.

Spyware (not including adware): Computer as communications tool.

19.3 There is no simple answer to this problem, as it depends on which survey is reviewed, given that the details do change from year to year and region to region. Any answer should note significant changes in the types of crime reported, and differences between the survey results and those shown in Table 19.2.

19.4 There is no single answer to this problem. However a web search on ‘DeCSS’ should be done. Two key current sites are the Gallery of CSS Descramblers at CMU (http://www.cs.cmu.edu/~dst/DeCSS/Gallery/) and the Wikipedia DeCSS page which both provide many details and further links on the case. Given the very large number of items in the Gallery of CSS Descramblers (http://www.cs.cmu.edu/~dst/DeCSS/Gallery/) it is fair to conclude that the MPAA failed to suppressing details of the DeCSS descrambling algorithm.

-37-

19.5 If a person purchases a track from the iTunes store, protected by Apple's FairPlay DRM, by an EMI artist, then the DRM component roles shown in Figure 19.3 in this case are: Content Provider is EMI, Distributor and Clearinghouse are both handled by the iTunes Store, and the Consumer is the person purchasing the track.

19.6 EU calls out the need for notice. This proactive measure is worthwhile.

OECD mentions collection limitation, not explicitly called out in the EU list. Again, a worthwhile principle.

19.7 There is no simple answer to this problem, as it depends on the relevant organization’s Privacy Policy. However any answer should consider all the principles listed in section 19.3, and should also refer to any relevant privacy legislation that applies to the chosen organization.

19.8 There is considerable overlap in spirit. The guidelines in the problem are perhaps more oriented to specific management action. They serve as a useful supplement to the standardized checklist of items in the Standard of Good Practice.

19.9 In this scenario, the administrator has very likely broken the law (though it depends on the jurisdiction applying), and breached company policy (provided they actually had one), even if for potentially altruistic reasons. The actions likely violated several of the potential ethical dilemmas listed in Table 19.3 including employee monitoring (in checking their passwords), hacking (in accessing the password files from other sections), and even internal privacy (knowing other user’s passwords gives access to their data that you otherwise do not have authorization for). You might defend yourself by arguing that as a systems administrator you were authorized to access the password file. Unfortunately you are not the administrator for the section whose password file was cracked, and it will be difficult to argue that you had authority to do so. You would also have to argue that you had no intent to use that data to break any law, that your motives were not malicious and that they were in the interests of the organization and its employees. You might support these arguments by referring to item 2.5 (analysis of risks) in the ACM code, and item 7 (correct errors) in the IEEE code. The counter argument is that you failed to obey for example item 2.8 (authorized access) in the ACM code. Clearly the outcome would have been more satisfactory if the administrator had raised the issue of password security with senior management, and been granted permission to conduct the survey of current password security in a manner consistent with the law and company policy.

-38-

19.10 Assume appropriate section and subsection numbering for AITP. ACM dignity and worth of people personal integrity responsibility for work confidentiality of information public safety, health, and welfare participation in professional societies knowledge about technology related to social power.

IEEE

AITP

1.2

8, 9

—

Section 2 Section 2

2, 3, 4 1

2.1, 3.6 1.3

1.7, 1.8

—

3.1, 4.5

1.1, 1.2

1

3.3

—

—

—

2.7

5

4.8

19.11 a. EC1.2, EC2.2, and EC4.1 seem designed more to protect ACM's reputation than to focus on the professionals ethical responsibility and so can reasonably be excluded. EC 2.3 and EC 3.1 are not explicit in the 1997 Code and perhaps should be. They are covered implicitly however. b. In a number of areas, the 1997 Code is more detailed and more explicit, which provides better guidance to the professional. For example, the 1997 Code includes references to being aware of the legal responsibilities of professionals and managerial obligations.

19.12 a. I.3 refers to adequate compensation; this does not seem to be on target for an ethics code. II.b refers to disseminating information.

Even though this is qualified with respect to legal and proprietary restraints, it seems better not to include this in the Code. II.e seems designed more for IEEE's benefit than the individual's.

Section III, on responsibilities to employers and clients, is not explicit in the 2006 Code and perhaps should be. b. Nothing new in the 2006 Code not covered in the older Code.

-39-

19.13 a. ACM Code. The Software Engineering Code (SEC) specifically calls out responsibilities to client and employer. Perhaps ACM Code should as well. In general SEC is more detailed; this has the benefit of covering more ground in more detail but the disadvantage of discouraging professionals from reading the whole code. b. IEEE Code. SEC specifically calls out responsibilities to client and employer. SEC specifically addresses confidentiality. Both should probably be addressed in IEEE code. c. AITP Code. SEC refers to the quality of the products of the professional. AITP does not specifically call this out.

-40-

CHAPTER 20 SYMMETRIC ENCRYPTION & MESSAGE CONFIDENTIALITY ANSWERS TO QUESTIONS 20.1 Plaintext, encryption algorithm, secret key, ciphertext, decryption algorithm.

20.2 Permutation and substitution.

20.3 One secret key.

20.4 A stream cipher is one that encrypts a digital data stream one bit or one byte at a time. A block cipher is one in which a block of plaintext is treated as a whole and used to produce a ciphertext block of equal length.

20.5 Cryptanalysis and brute force.

20.6 In some modes, the plaintext does not pass through the encryption function, but is XORed with the output of the encryption function. The math works out that for decryption in these cases, the encryption function must also be used.

20.7 With triple encryption, a plaintext block is encrypted by passing it through an encryption algorithm; the result is then passed through the same encryption algorithm again; the result of the second encryption is passed through the same encryption algorithm a third time.

Typically, the second stage uses the decryption algorithm rather than the encryption algorithm.

20.8 There is no cryptographic significance to the use of decryption for the second stage. Its only advantage is that it allows users of 3DES to decrypt data encrypted by users of the older single DES by repeating the key.

-41-

20.9 With link encryption, each vulnerable communications link is equipped on both ends with an encryption device. With end-to-end encryption, the encryption process is carried out at the two end systems. The source host or terminal encrypts the data; the data in encrypted form are then transmitted unaltered across the network to the destination terminal or host.

20.10 For two parties A and B, key distribution can be achieved in a number of ways, as follows: 1. A can select a key and physically deliver it to B. 2. A third party can select the key and physically deliver it to A and B. 3. If A and B have previously and recently used a key, one party can transmit the new key to the other, encrypted using the old key.

4. If A and B each has an encrypted connection to a third party C, C can deliver a key on the encrypted links to A and B. 20.11 A session key is a temporary encryption key used between two principals. A master key is a long-lasting key that is used between a key distribution center and a principal for the purpose of encoding the transmission of session keys. Typically, the master keys are distributed by noncryptographic means.

20.12 A key distribution center is a system that is authorized to transmit temporary session keys to principals. Each session key is transmitted in encrypted form, using a master key that the key distribution center shares with the target principal.

ANSWERS TO PROBLEMS 20.1 To see that the same algorithm with a reversed key order produces the correct result, consider the figure following this discussion, which shows the encryption process going down the left-hand side and the decryption process going up the right-hand side for a 16-round algorithm (the result would be the same for any number of rounds).

For clarity, we use the notation LEi and REi for data traveling through the encryption algorithm and LDi and RDi for data traveling through the decryption algorithm. The diagram indicates that, at every round, the intermediate value of the decryption process is equal to the corresponding value of the encryption process with the two halves of the value swapped. To put this another way, let the output of the ith encryption round be LEi||REi (Li concatenated with Ri). Then the corresponding input to the (16 – i)th decryption round is RDi||LDi. -42-

Let us walk through the figure to demonstrate the validity of the preceding assertions. To simplify the diagram, it is unwrapped, not showing the swap that occurs at the end of each iteration. But note that the intermediate result at the end of the ith stage of the encryption process is the 2w-bit quantity formed by concatenating LEi and REi, and that the intermediate result at the end of the ith stage of the decryption process is the 2w-bit quantity formed by concatenating LDi and RDi. After the last iteration of the encryption process, the two halves of the output are swapped, so that the ciphertext is RE16||LE16.

The output of that round is the ciphertext. Now take that ciphertext and use it as input to the same algorithm. The input to the first round is RE16||LE16, which is equal to the 32-bit swap of the output of the sixteenth round of the encryption process.

Now we would like to show that the output of the first round of the decryption process is equal to a 32-bit swap of the input to the sixteenth round of the encryption process. First, consider the encryption process. We see that: LE16 = RE15 RE16 = LE15 ⊕ F(RE15, K16) On the decryption side: LD1 RD1

= RD0 = LE16 = RE15 = LD0 ⊕ F(RD0, K16) = RE16 ⊕ F(RE15, K16) = [LE15 ⊕ F(RE15,K16)] ⊕ F(RE15, K16)

The XOR has the following properties: [A ⊕ B] ⊕ C = A ⊕ [B ⊕ C] D⊕D=0 E⊕0=E Thus, we have LD1 = RE15 and RD1 = LE15. Therefore, the output of the first round of the decryption process is LE15||RE15, which is the 32bit swap of the input to the sixteenth round of the encryption. This correspondence holds all the way through the 16 iterations, as is easily shown. We can cast this process in general terms. For the ith iteration of the encryption algorithm: LEi REi

= REi-1 = LEi-1 ⊕ F(REi-1, Ki) -43-

Rearranging terms: REi-1 = LEi LEi-1 = REi ⊕ F(REi-1, Ki) = REi ⊕ F(LEi, Ki) Thus, we have described the inputs to the ith iteration as a function of the outputs, and these equations confirm the assignments shown in the right-hand side of the following figure.

Finally, we see that the output of the last round of the decryption process is RE0||LE0. A 32-bit swap recovers the original plaintext, demonstrating the validity of the Feistel decryption process.

-44-

Output (plaintext)

Input (plaintext)

LE0

⊕ RE1

K1

RE15

RE16

RD 16 = LE0

K2

LE1

RD15 = LE1

⊕

⊕

RE2

K 15

LD14 = RE2

RE14

K1

LD15 = RE 1

F

K2

LD2 = RE14

F K 16

⊕

F

RD 14 = LE2

RD 2 = LE14

⊕

F LE15

RD1 = LE15

⊕

F LE16

LD16 = RE0 F

LE2

⊕

LD16 = RE 0

RE0

F

LE14

RD16 = LE0

⊕

RE16

LD1 = RE 15

F

LD0 = RE16

LE16

K 15

K 16

RD 0 = LE16

Input (ciphertext)

Output (ciphertext)

-45-

20.2 Because of the key schedule, the round functions used in rounds 9 through 16 are mirror images of the round functions used in rounds 1 through 8. From this fact we see that encryption and decryption are identical. We are given a ciphertext c. Let m' = c. Ask the encryption oracle to encrypt m'. The ciphertext returned by the oracle will be the decryption of c.

20.3 For 1 ≤ i ≤ 128, take ci ∈ {0, 1}128 to be the string containing a 1 in position i and then zeros elsewhere. Obtain the decryption of these 128 ciphertexts. Let m1, m2, . . . , m128 be the corresponding plaintexts. Now, given any ciphertext c which does not consist of all zeros, there is a unique nonempty subset of the ci’s which we can XOR together to obtain c. Let I(c) ⊆ {1, 2, . . . , 128} denote this subset.

Observe

⎛ ⎞ c = ⊕ ci = ⊕ E (mi ) = E⎜ ⊕ mi ⎟ i∈I ( c ) i∈I ( c ) ⎝ i∈I ( c) ⎠ Thus, we obtain the plaintext of c by computing

⊕ mi . Let 0 be the

i∈I ( c )

all-zero string. Note that 0 = 0 ⊕ 0. From this we obtain E(0) = E(0 ⊕ 0) = E(0) ⊕ E(0) = 0. Thus, the plaintext of c = 0 is m = 0. Hence we can decrypt every c ∈ {0, 1}128.

20.4 Use a key of length 255 bytes. The first two bytes are zero; that is K[0] = K[1] = 0. Thereafter, we have: K[2] = 255; K[3] = 254; …

K[255]= 2.

20.5 a. Simply store i, j, and S, which requires 8 + 8 + (256 × 8) = 2064 bits b. The number of states is [256! × 2562] ≈ 21700. Therefore, 1700 bits are required.

20.6 a. No. For example, suppose C1 is corrupted. The output block P3 depends only on the input blocks C2 and C3. b. An error in P1 affects C1. But since C1 is input to the calculation of C2, C2 is affected. This effect carries through indefinitely, so that all ciphertext blocks are affected. However, at the receiving end, the decryption algorithm restores the correct plaintext for blocks except the one in error. You can show this by writing out the equations for the decryption. Therefore, the error only effects the corresponding decrypted plaintext block.

-46-

20.7

If an error occurs in transmission of ciphertext block Ci, then this error propagates to the recovered plaintext blocks Pi and Pi+1.

20.8 a. If the IVs are kept secret, the 3-loop case has more bits to be determined and is therefore more secure than 1-loop for brute force attacks. b. For software implementations, the performance is equivalent for most measurements. One-loop has two fewer XORs per block. three-loop might benefit from the ability to do a large set of blocks with a single key before switching. The performance difference from choice of mode can be expected to be smaller than the differences induced by normal variation in programming style.

For hardware implementations, three-loop is three times faster than one-loop, because of pipelining. That is: Let Pi be the stream of

input plaintext blocks, Xi the output of the first DES, Yi the output of the second DES and Ci the output of the final DES and therefore the whole system's ciphertext.

In the 1-loop case, we have: Xi = DES( XOR( Pi, Ci-1 ) ) Yi = DES( Xi ) Ci = DES( Yi ) [where C0 is the single IV] If P1 is presented at t=0 (where time is measured in units of DES operations), X1 will be available at t=1, Y1 at t=2 and C1 at t=3. At t=1, the first DES is free to do more work, but that work will be: X2 = DES( XOR( P2, C1 ) ) but C1 is not available until t=3, therefore X2 can not be available until t=4, Y2 at t=5 and C2 at t=6.

In the 3-loop case, we have: Xi = DES( XOR( Pi, Xi-1 ) ) Yi = DES( XOR( Xi, Yi-1} ) ) Ci = DES( XOR( Yi, Ci-1 ) ) -47-

[where X0, Y0 and C0 are three independent IVs] If P1 is presented at t=0, X1 is available at t=1. Both X2 and Y1 are available at t=4. X3, Y2 and C1 are available at t=3. X4, Y3 and C2 are available at t=4. Therefore, a new ciphertext block is produced every 1 tick, as opposed to every 3 ticks in the single-loop case.

This gives the three-loop construct a throughput three times greater than the one-loop construct.

20.9 Instead of CBC [ CBC ( CBC (X))], use ECB [ CBC ( CBC (X))]. The final IV was not needed for security. The lack of feedback loop prevents the chosen-ciphertext differential cryptanalysis attack. The extra IVs still become part of a key to be determined during any known plaintext attack.

20.10 Mode

Encrypt

ECB

Cj = E(K, Pj)

CBC

C1 = E(K, [P1 ⊕ IV])

j = 1, …, N

Cj = E(K, [Pj ⊕ Cj–1]) …, N CFB

OFB

CTR

Decrypt Pj = D(K, Cj)

j = 1, …, N

P1 = D(K, C1) ⊕ IV j = 2,

Pj = D(K, Cj) ⊕ Cj–1 N

j = 2, …,

C1 = P1 ⊕ Ss(E[K, IV])

P1 = C1 ⊕ Ss(E[K, IV])

Cj = Pj ⊕ Ss(E[K, Cj–1])

Pj = Cj ⊕ Ss(E[K, Cj–1])

C1 = P1 ⊕ Ss(E[K, IV])

P1 = C1 ⊕ Ss(E[K, IV])

Cj = Pj ⊕ Ss(E(K, [Cj–1 ⊕ Pj–1]))

Pj = Cj ⊕ Ss(E(K, [Cj–1 ⊕ Pj–1]))

Cj = Pj ⊕ E[K, Counter + j – 1]

Pj = Cj ⊕ E[K, Counter + j – 1]

20.11 After decryption, the last byte of the last block is used to determine the amount of padding that must be stripped off. Therefore there must be at least one byte of padding.

20.12 a. Assume that the last block of plaintext is only L bytes long, where L < 2w/8. The encryption sequence is as follows (The description in RFC 2040 has an error; the description here is correct.): 1. Encrypt the first (N – 2) blocks using the traditional CBC technique.

2. XOR PN–1 with previous ciphertext block CN–2 to create YN–1.

3. Encrypt YN–1 to create EN–1.

-48-

4. Select the first L bytes of EN–1 to create CN. 5. Pad PN with zeros at the end and exclusive-OR with EN–1 to create YN. 6. Encrypt YN to create CN–1.

The last two blocks of the ciphertext are CN–1 and CN. b. PN–1 = CN–2 ⊕ D(K, [CN || X]) PN || X = (CN || 00…0) ⊕ D(K, [CN–1]) PN = left-hand portion of (PN || X) where || is the concatenation function 20.13 a. Assume that the last block (PN) has j bits. After encrypting the last full block (PN–1), encrypt the ciphertext (CN–1) again, select the leftmost j bits of the encrypted ciphertext, and XOR that with the short block to generate the output ciphertext. b. While an attacker cannot recover the last plaintext block, he can change it systematically by changing individual bits in the ciphertext. If the last few bits of the plaintext contain essential information, this is a weakness.

20.14 Nine plaintext characters are affected. The plaintext character corresponding to the ciphertext character is obviously altered. In addition, the altered ciphertext character enters the shift register and is not removed until the next eight characters are processed.

20.15 The CBC mode with an IV of 0 and plaintext blocks D1, D2, . . ., Dn and 64-bit CFB mode with IV = D1 and plaintext blocks D2, D3, . . ., Dn yield the same result.

20.16 The central points should be highly fault-tolerant, should be physically secured, and should use trusted hardware/software.

20.17 Yes. The eavesdropper is left with two strings, one sent in each direction, and their XOR is the secret key.

-49-

CHAPTER 21 PUBLIC-KEY CRYPTOGRAPHY & MESSAGE AUTHENTICATION ANSWERS TO QUESTIONS 21.1 The compression function is the fundamental module, or basic building block, of a hash function. The hash function consists of iterated application of the compression function.

21.2 Addition modulo 264, circular shift, primitive Boolean functions based on AND, OR, NOT, and XOR. 21.3 To replace a given hash function in an HMAC implementation, all that is required is to remove the existing hash function module and drop in the new module.

21.4 For any given code h, it is computationally infeasible to find x such that H(x) = h. A hash function with this property is referred to as oneway. This definition appeared in Chapter 2.

21.5 Two parties each create a public-key, private-key pair and communicate the public key to the other party. The keys are designed in such a way that both sides can calculate the same unique secret key based on each side's private key and the other side's public key.

ANSWERS TO PROBLEMS 21.1 a. Yes. The XOR function is simply a vertical parity check. If there is an odd number of errors, then there must be at least one column that contains an odd number of errors, and the parity bit for that column will detect the error. Note that the RXOR function also catches all errors caused by an odd number of error bits. Each RXOR bit is a function of a unique "spiral" of bits in the block of data. If there is an odd number of errors, then there must be at least one spiral that contains an odd number of errors, and the parity bit for that spiral will detect the error. b. No. The checksum will fail to detect an even number of errors when both the XOR and RXOR functions fail. In order for both to fail, the -50-

pattern of error bits must be at intersection points between parity spirals and parity columns such that there is an even number of error bits in each parity column and an even number of error bits in each spiral. c. It is too simple to be used as a secure hash function; finding multiple messages with the same hash function would be too easy.

21.2 a. It satisfies properties 1 through 3 but not the remaining properties.

For example, for property 4, a message consisting of the value h satisfies H(h) = h. For property 5, take any message M and add the decimal digit 0 to the sequence; it will have the same hash value. b. It satisfies properties 1 through 3. Property 4 is also satisfied if n is a large composite number, because taking square roots modulo such an integer n is considered to be infeasible. Properties 5 and 6 are not satisfied because –M will have the same value as M. c. 955 21.3 If you examine the structure of a single round of DES, you see that the round includes a one-way function, F, and an XOR: Ri = Li-1 ⊕ F(Ri-1, Ki) For DES, the function F is depicted in Figure 2.4. It maps a 32-bit R and a 48-bit K into a 32-bit output. That is, it maps an 80-bit input into a 32-bit output. This is clearly a one-way function. Any hash function that produces a 32-bit output could be used for F. The demonstration in the text that decryption works is still valid for any one-way function F. 21.4 The opponent has the two-block message B1, B2 and its hash RSAH(B1, B2). The following attack will work. Choose an arbitrary C1 and choose C2 such that: then so

C2 = RSA(C1) ⊕ RSA(B1) ⊕ B2 RSA(C1) ⊕ C2 = RSA(C1) ⊕ RSA(C1) ⊕ RSA(B1) ⊕ B2 = RSA(B1) ⊕ B2 RSAH(C1, C2) = RSA[RSA(C1) ⊕ C2)] = RSA[RSA(B1) ⊕ B2] = RSAH(B1, B2)

21.5 a. Two quantities are precomputed: f(IV, (K+ ⊕ ipad)) f(IV, (K+ ⊕ opad))

-51-

where f(cv, block) is the compression function for the hash function, which takes as arguments a chaining variable of n bits and a block of b bits and produces a chaining variable of n bits. These quantities only need to be computed initially and every time the key changes. In effect, the precomputed quantities substitute for the initial value (IV) in the hash function. With this implementation, only one additional instance of the compression function is added to the processing normally produced by the hash function. b. This is a more efficient implementation. This more efficient implementation is especially worthwhile if most of the messages for which a MAC is computed are short.

21.6 a. n = 33; φ(n) = 20; d = 3; C = 26. b. n = 55; φ(n) = 40; d = 27; C = 14. c. n = 77; φ(n) = 60; d = 53; C = 57. d. n = 143; φ(n) = 120; d = 11; C = 106. e. n = 527; φ(n) = 480; d = 343; C = 128. For decryption, we have 128343 mod 527 = 128256 × 12864 × 12816 × 1284 × 1282 × 1281 mod 527 = 35 × 256 × 35 × 101 × 47 × 128 = 2 mod 527 = 2 mod 257 21.7

M=5

21.8

d = 3031

21.9

Yes. If a plaintext block has a common factor with n modulo n then the encoded block will also have a common factor with n modulo n.

Because we encode blocks that are smaller than pq, the factor must be p or q and the plaintext block must be a multiple of p or q. We can test each block for primality. If prime, it is p or q. In this case we divide into n to find the other factor. If not prime, we factor it and try the factors as divisors of n.

21.10 Yes. 21.11 Consider a set of alphabetic characters {A, B, …, Z}. The corresponding integers, representing the position of each alphabetic character in the alphabet, form a set of message block values SM = {0, 1, 2, …, 25}. The set of corresponding ciphertext block values SC = {0e mod N, 1e mod N, …, 25e mod N}, and can be computed by everybody with the knowledge of the public key of Bob. Thus, the most efficient attack against the scheme described in the problem is to compute Me mod N for all possible values of M, then create a look-up table with a ciphertext as an index, and the -52-

corresponding plaintext as a value of the appropriate location in the table.

21.12 a. XA = 6 b. K = 3

-53-

CHAPTER 22 INTERNET SECURITY PROTOCOLS & STANDARDS ANSWERS TO QUESTIONS 22.1 Enveloped data: This function consists of encrypted content of any type and encrypted-content encryption keys for one or more recipients.

Signed data: A digital signature is formed by taking the message digest of the content to be signed and then encrypting that with the private key of the signer. The content plus signature are then encoded using base64 encoding. A signed data message can only be viewed by a recipient with S/MIME capability.

Clear-signed data: As with signed data, a digital signature of the content is formed. However, in this case, only the digital signature is encoded using base64. As a result, recipients without S/MIME capability can view the message content, although they cannot verify the signature.

Signed and enveloped data: Signed-only and encrypted-only entities may be nested, so that encrypted data may be signed and signed data or clear-signed data may be encrypted.

22.2 R64 converts a raw 8-bit binary stream to a stream of printable ASCII characters. Each group of three octets of binary data is mapped into four ASCII characters.

22.3 When S/MIME is used, at least part of the block to be transmitted is encrypted. If only the signature service is used, then the message digest is encrypted (with the sender's private key). If the confidentiality service is used, the message plus signature (if present) are encrypted (with a one-time symmetric key). Thus, part or all of the resulting block consists of a stream of arbitrary 8-bit octets. However, many electronic mail systems only permit the use of blocks consisting of ASCII text.

22.4 DomainKeys Identified Mail (DKIM) is a specification for cryptographically signing e-mail messages, permitting a signing domain to claim responsibility for a message in the mail stream.

-54-

22.5 SSL handshake protocol; SSL change cipher spec protocol; SSL alert protocol; SSL record protocol.

22.6 Connection: A connection is a transport (in the OSI layering model definition) that provides a suitable type of service. For SSL, such connections are peer-to-peer relationships. The connections are transient. Every connection is associated with one session. Session: An SSL session is an association between a client and a server.

Sessions are created by the Handshake Protocol. Sessions define a set of cryptographic security parameters, which can be shared among multiple connections. Sessions are used to avoid the expensive negotiation of new security parameters for each connection.

22.7 Confidentiality: The Handshake Protocol defines a shared secret key that is used for conventional encryption of SSL payloads. Message Integrity: The Handshake Protocol also defines a shared secret key that is used to form a message authentication code (MAC).

22.8 HTTPS (HTTP over SSL) refers to the combination of HTTP and SSL to implement secure communication between a Web browser and a Web server.

22.9 Access control; connectionless integrity; data origin authentication; rejection of replayed packets (a form of partial sequence integrity); confidentiality (encryption); and limited traffic flow confidentiality 22.10 An IPSec security association is a one-way relationship between a sender and a receiver that affords security services to the traffic carried on it. If a peer relationship is needed, for two-way secure exchange, then two security associations are required. Security services are afforded to an SA for the use of AH or ESP, but not both.

22.11 1. an authentication-only function referred to as Authentication Header (AH); 2. a combined authentication/encryption function called Encapsulating Security Payload (ESP).

ANSWERS TO PROBLEMS 22.1 The change cipher spec protocol exists to signal transitions in ciphering strategies, and can be sent independent of the complete handshake protocol exchange.

22.2 a. Man-in-the-Middle Attack: This is prevented by the use of publickey certificates to authenticate the correspondents. b. Password Sniffing: User data is encrypted.

-55-

c. IP Spoofing: The spoofer must be in possession of the secret key as well as the forged IP address. d. IP Hijacking: Again, encryption protects against this attack. e. SYN Flooding: SSL provides no protection against this attack.

22.3 SSL relies on an underlying reliable protocol to assure that bytes are not lost or inserted. There was some discussion of reengineering the future TLS protocol to work over datagram protocols such as UDP, however, most people at a recent TLS meeting felt that this was inappropriate layering (from the SSL FAQ).

22.4 Inbound processing proceeds as follows when a packet is received: 1. If the received packet falls within the window and is new, the MAC is checked. If the packet is authenticated, the corresponding slot in the window is marked.

2. If the received packet is to the right of the window and is new, the MAC is checked. If the packet is authenticated, the window is advanced so that this sequence number is the right edge of the window, and the corresponding slot in the window is marked.

3. If the received packet is to the left of the window, or if authentication fails, the packet is discarded; this is an auditable event.

22.5 The first mode is called transport mode, which provides protection primarily for upper-layer protocols. That is, transport mode protection extends to the payload of an IP packet. Examples include a TCP or UDP segment or an ICMP packet, all of which operate directly above IP in a host protocol stack. Typically, transport mode is used for end-to-end communication between two hosts (e.g., a client and a server, or two workstations). When a host runs AH or ESP over IPv4, the payload is the data that normally follow the IP header. For IPv6, the payload is the data that normally follow both the IP header and any IPv6 extensions headers that are present, with the possible exception of the destination options header, which may be included in the protection.

ESP in transport mode encrypts and optionally authenticates the IP payload but not the IP header. AH in transport mode authenticates the IP payload and selected portions of the IP header.

The second mode is called tunnel mode, which provides protection to the entire IP packet. To achieve this, after the AH or ESP fields are added to the IP packet, the entire packet plus security fields is treated as the payload of new "outer" IP packet with a new outer IP header.

The entire original, or inner, packet travels through a "tunnel" from one point of an IP network to another; no routers along the way are able to examine the inner IP header. Because the original packet is encapsulated, the new, larger packet may have totally different source and destination addresses, adding to the security. Tunnel mode is used -56-

when one or both ends of an SA are a security gateway, such as a firewall or router that implements IPSec. With tunnel mode, a number of hosts on networks behind firewalls may engage in secure communications without implementing IPSec. The unprotected packets generated by such hosts are tunneled through external networks by tunnel mode SAs set up by the IPSec software in the firewall or secure router at the boundary of the local network.

22.6 It certainly provides more security than a simple monoalphabetic substitution. Because we are treating the plaintext as a string of bits and encrypting 6 bits at a time, we are not encrypting individual characters. Therefore, the frequency information is lost, or at least significantly obscured.

22.7 The quoted-printable transfer encoding is useful when the data consist largely of octets that correspond to printable ASCII characters.

The base64 transfer encoding, also known as radix-64 encoding, is a common one for encoding arbitrary binary data in such a way as to be invulnerable to the processing by mail transport programs. This technique maps arbitrary binary input into printable character output.

-57-

CHAPTER 23 INTERNET AUTHENTICATION APPLICATIONS ANSWERS TO QUESTIONS 23.1 Client: wishes to authenticate itself to a server.

Server: requires authentication before granting service to client.

Authentication server: authenticates users to servers and servers to users.

Ticket-granting server: issues tickets to users who have been authenticated to the authentication server; the tickets are used to authenticate user to server.

23.2 A realm is an environment in which: 1. The Kerberos server must have the user ID (UID) and hashed password of all participating users in its database. All users are registered with the Kerberos server. 2. The Kerberos server must share a secret key with each server. All servers are registered with the Kerberos server.

23.3 Version 5 overcomes some environmental shortcomings and some technical deficiencies in Version 4, including tagging an encrypted message with an encryption algorithm identifier, support for authentication forwarding, and support for a method for inter-realm authentication that requires fewer secure key exchanges than in version 4.

23.4 The X.509 ITU-T standard, also specified in RFC 5280, is the most widely accepted format for public-key certificates. X.509 certificates are used in most network security applications, including IP security (IPSEC), secure sockets layer (SSL), secure electronic transactions (SET), and S/MIME, as well as in eBusiness applications. Each certificate links a public key with the identity of the key’s owner, with the whole block signed by a trusted third party certification authority.

23.5 Key elements in a X.509 certificate include the key owning Subject’s X.500 name and public-key information, the Period of validity dates, the CA’s Issuer name, and their Signature that binds all this information together. Current X.509 certificates use the version 3 -58-

format that includes a general extension mechanism to provide more flexibility and to convey information needed in special circumstances.

23.6 Typically, the trusted third party that signs certificates is a certificate authority (CA) that is trusted by the user community, such as a government agency, financial institution, telecommunications company, or other trusted peak organization. A user can present his or her public key to the authority in a secure manner and obtain a certificate. The user can then publish the certificate, or send it to others. Anyone needing this user’s public key can obtain the certificate and verify that it is valid by way of the attached trusted signature, provided they can verify the CA’s public key.

23.7 X.509 certificate variants include: • Conventional (long-lived) certificates: traditional CA and “end user” certificates, linking an identity with a public key, which are typically issued for validity periods of months to years.

• Short-lived certificates: are used to provide authentication for applications such as grid computing, while avoiding some of the overheads and limitations of conventional certificates, with validity periods of just hours to days, which limits the period of misuse if compromised.

• Proxy certificates: are widely used to provide authentication for applications such as grid computing, while addressing some of the limitations of short-lived certificates. They are identified by the presence of the “proxy certificate” extension. They allow an “end user” certificate to sign another certificate, which must be an extension of their existing certificate.

• Attribute certificates: which use a different certificate format, link a user’s identity to a set of attributes that are typically used for authorization and access control.

23.8 The X.509 standard defines a certificate revocation list (CRL), signed by the issuer. When an application receives a certificate, the X.509 standard states it should determine whether it has been revoked, by checking against the current CRL for its issuing CA. However, due to the overheads in retrieving and storing these lists, very few applications actually do this. A more practical alternative is to use the Online Certificate Status Protocol (OCSP) to query the CA as to whether a specific certificate is valid. This lightweight protocol is increasingly used, including in most common web browsers.

23.9 A public-key infrastructure (PKI) is the set of hardware, software, people, policies, and procedures needed to create, manage, store, distribute, and revoke digital certificates based on asymmetric -59-

cryptography. The principal objective for developing a PKI is to enable secure, convenient, and efficient acquisition of public keys.

23.10 Current X.509 PKI implementations came with a large list of CAs and their public keys, known as a “trust store.” These CAs usually either directly sign “end-user” certificates or sign a small number of Intermediate-CAs that in turn sign “end-user” certificates. Thus all the PKI hierarchies are very small, and all are equally trusted. Users and servers that want an automatically verified certificate must acquire it from one of these CAs. Alternatively they can use either a “self-signed” certificate or a certificate signed by some other CA. However, in both these cases, such certificates will initially be recognized as “untrusted” and the user presented with stark warnings about accepting such certificates, even if they are actually legitimate.

23.11 Some key problems with current public key infrastructure implementations include: • the reliance on the user to make an informed decision when there is a problem verifying a certificate.

• the assumption that all of the CAs in the “trust store” are equally trusted, equally well managed, and apply equivalent policies.

• that different implementations, in the various web browsers and operating systems, use different “trust stores,” and hence present different security views to users.

23.12 PKIX key elements are: End entity: A generic term used to denote end users, devices (e.g., servers, routers), or any other entity that can be identified in the subject field of a public-key certificate. End entities typically consume and/or support PKI-related services.

Certification authority (CA): The issuer of certificates and (usually) certificate revocation lists (CRLs). It may also support a variety of administrative functions, although these are often delegated to one or more registration authorities.

Registration authority (RA): An optional component that can assume a number of administrative functions from the CA. The RA is often associated with the end entity registration process but can assist in a number of other areas as well.

CRL issuer: An optional component that a CA can delegate to publish CRLs. Repository: A generic term used to denote any method for storing certificates and CRLs so that they can be retrieved by end entities.

ANSWERS TO PROBLEMS -60-

23.1 a.

Time = 1

Time = 2

P1

P2

IV

Time = N PN P N-1

+

+

DES Encrypt

K

+

+ K

DES Encrypt

• • •

+ K

DES Encrypt

CN-1

(a) Encryption

C1

C2

C1

C2

CN

CN CN-1

K

DES Decrypt

IV

+

K

+

DES Decrypt

+

K

• • •

+

DES Decrypt

+

PN-1 (b) Decryption

P1

P2

PN

b. On decryption, each ciphertext block is passed through the decryption algorithm. Then the output is XORed with the preceding ciphertext block and the preceding plaintext block. We can demonstrate that this scheme works, as follows: D(K, Cn) = D(K, E(K, [Cn–1 ⊕ Pn–1 ⊕ Pn])) D(K, Cn) = Cn–1 ⊕ Pn–1 ⊕ Pn Cn–1 ⊕ Pn–1 ⊕ D(K, Cn) = Pn

c. An error in C1 affects P1 because the encryption of C1 is XORed with IV to produce P1. Both C1 and P1 affect P2, which is the XOR of the encryption of C2 with the XOR of C1 and P1. Beyond that, PN–1 is one of the XORed inputs to forming PN. 23.2 Let us consider the case of the interchange of C1 and C2. The argument will be the same for any other adjacent pair of ciphertext blocks. First, if C1 and C2 arrive in the proper order: P1 = E[K, C1] ⊕ IV P2 = E[K, C2] ⊕ C1 ⊕ P1 = E[K, C2] ⊕ C1 ⊕ E[K, C1] ⊕ IV -61-

P3 = E[K, C3] ⊕ C2 ⊕ P2 = E[K, C3] ⊕ C2 ⊕ E[K, C2] ⊕ C1 ⊕ E[K, C1] ⊕ IV Now suppose that C1 and C2 arrive in the reverse order. Let us refer to the decrypted blocks as Qi. Q1 = E[K, C2] ⊕ IV Q2 = E[K, C1] ⊕ C2 ⊕ Q1 = E[K, C1] ⊕ C2 ⊕ E[K, C2] ⊕ IV Q3 = E[K, C3] ⊕ C1 ⊕ Q2 = E[K, C3] ⊕ C1 ⊕ E[K, C1] ⊕ C2 ⊕ E[K, C2] ⊕ IV The result is that Q1 ≠ P1; Q2 ≠ P2; but Q3 = P3. Subsequent blocks are clearly unaffected.

23.3 Given the X.509 certificate shown: a. key elements are: • owner’s name (Subject, Verisign Digital ID class 1 for John Doe): Subject: O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Persona Not Validated, OU=Digital ID Class 1 - Netscape CN=John Doe/Email=john.doe@adfa.edu.au

• public key (RSA key with 512 bit modulus as shown): Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (512 bit) Modulus (512 bit): 00:98:f2:89:c4:48:e1:3b:2c:c5:d1:48:67:80:53: d8:eb:4d:4f:ac:31:a9:fd:11:68:94:ba:44:d8:48: 46:0d:fc:5c:6d:89:47:3f:9f:d0:c0:6d:3e:9a:8e: ec:82:21:48:9b:b9:78:cf:aa:09:61:92:f6:d1:cf: 45:ca:ea:8f:df Exponent: 65537 (0x10001)

• validity dates (Jan 13 to Mar 13 2000): Validity Not Before: Jan 13 00:00:00 2000 GMT Not After : Mar 13 23:59:59 2000 GMT

• name of the CA that signed it (Issuer, Verisign Inc):

Issuer: O=VeriSign, Inc., OU=VeriSign Trust Network, CN=VeriSign Class 1 CA Individual - Persona Not Validated

• type (MD5 with RSA) and value of signature:

Signature Algorithm: md5WithRSAEncryption 5a:71:77:c2:ce:82:26:02:45:41:a5:11:68:d6:99:f0:4c:ce: 7a:ce:80:44:f4:a3:1a:72:43:e9:dc:e1:1a:9b:ec:64:f7:ff: 21:f2:29:89:d6:61:e5:39:bd:04:e7:e5:3d:7b:14:46:d6:eb: 8e:37:b0:cb:ed:38:35:81:1f:40:57:57:58:a5:c0:64:ef:55: 59:c0:79:75:7a:54:47:6a:37:b2:6c:23:6b:57:4d:62:2f:94: d3:aa:69:9d:3d:64:43:61:a7:a3:e0:b8:09:ac:94:9b:23:38: e8:1b:0f:e5:1b:6e:e2:fa:32:86:f0:c4:0b:ed:89:d9:16:e4: a7:77

b. it is an end-user certificate, as it has: X509v3 Basic Constraints:

-62-

CA:FALSE

this would have to be “CA:TRUE” for a CA certificate. c. the certificate is not valid as it’s validity dates are in the past. d. the other obvious problem with the algorithms used in this certificate is the use of MD5 in the signature, since research advances in creating MD5 collisions has led to the development of several techniques for forging new certificates for different identities that have the same hash, and hence can reuse the same signature, as an existing valid certificate. Any still valid certificates using MD5 should be revoked and replaced as soon as possible.

23.4 There is no single answer for this problem, as it depends on the site, and it’s X.509 certificate. To answer the questions as for 23.3, you would view the same elements of the certificate as listed above. Note that this will be an end-user certificate, as in 23.3.

23.5 There is no single answer for this problem, as it depends on the authority selected, and it’s X.509 certificate. To answer the questions as for 23.3, you would view the same elements of the certificate as listed above. Note that this will be a CA certificate, i.e. have “CA:TRUE”.

-63-

CHAPTER 24 WIRELESS NETWORK SECURITY ANSWERS TO QUESTIONS 24.1 Basic service set.

24.2 Two or more basic service sets interconnected by a distribution system.

24.3 Association: Establishes an initial association between a station and an AP. Authentication: Used to establish the identity of stations to each other. Deauthentication: This service is invoked whenever an existing authentication is to be terminated. Disassociation: A notification from either a station or an AP that an existing association is terminated. A station should give this notification before leaving an ESS or shutting down. Distribution: used by stations to exchange MAC frames when the frame must traverse the DS to get from a station in one BSS to a station in another BSS. Integration: enables transfer of data between a station on an IEEE 802.11 LAN and a station on an integrated IEEE 802.x LAN. MSDU delivery: delivery of MAC service data units. Privacy: Used to prevent the contents of messages from being read by other than the intended recipient.

Reassocation: Enables an established association to be transferred from one AP to another, allowing a mobile station to move from one BSS to another.

24.4 It may or may not be.

24.5 Mobility refers to the types of physical transitions that can be made by a mobile node within an 802.11 environment (no transition, movement from one BSS to another within an ESS, movement from one ESS to another). Association is a service that allows a mobile node that has made a transition to identify itself to the AP within a BSS so that the node can participate in data exchanges with other mobile nodes.

24.6 IEEE 802.11i addresses three main security areas: authentication, key management, and data transfer privacy.

-64-

24.7 Discovery: An AP uses messages called Beacons and Probe Responses to advertise its IEEE 802.11i security policy. The STA uses these to identify an AP for a WLAN with which it wishes to communicate. The STA associates with the AP, which it uses to select the cipher suite and authentication mechanism when the Beacons and Probe Responses present a choice.

Authentication: During this phase, the STA and AS prove their identities to each other. The AP blocks non-authentication traffic between the STA and AS until the authentication transaction is successful. The AP does not participate in the authentication transaction other than forwarding traffic between the STA and AS. Key generation and distribution: The AP and the STA perform several operations that cause cryptographic keys to be generated and placed on the AP and the STA. Frames are exchanged between the AP and STA only Protected data transfer: Frames are exchanged between the STA and the end station through the AP. As denoted by the shading and the encryption module icon, secure data transfer occurs between the STA and the AP only; security is not provided end-to-end.

Connection termination: The AP and STA exchange frames. During this phase, the secure connection is torn down and the connection is restored to the original state.

24.8 TKIP is designed to require only software changes to devices that are implemented with the older wireless LAN security approach called Wired Equivalent Privacy (WEP).

ANSWERS TO PROBLEMS 24.1 a. This scheme is extremely simple and easy to implement. It does protect against very simple attacks using an off-the-shelf Wi-Fi LAN card, and against accidental connection to the wrong network. b. This scheme depends on all parties behaving honestly. The scheme does not protect against MAC address forgery.

24.2 a. Because the AP remembers the random number previously sent, it can check whether the result sent back was encrypted with the correct key; the STA must know the key in order to encrypt the random value successfully. b. This scheme does nothing to prove to the STA that the AP knows the key, so authentication is only one way. c. If an attacker is eavesdropping, this scheme provides the attacker with a plaintext-ciphertext pair to use in cryptanalysis.

-65-

24.3 a.

CR C

Shared k ey

RC4

Data

IV

Keystream

IV

ICV

Ciphertext

b. 1. The IV value, which is received in plaintext, is concatenated with the WEP key shared by transmitter and receiver to form the seed, or key input, to RC4.

2. The ciphertext portion of the received MPDU is decrypted using RC4 to recover the Data block and the ICV. 3. The ICV is computed over the plaintext received Data block and compared to the received plaintext ICV to authenticate the Data block. c.

Shared key

CRC

Compare

R C4

Data

ICV

IV

K eystream

IV

Ciphertext

-66-

24.4 Because WEP works by XORing the data to get the ciphertext, bit flipping survives the encryption process. Flipping a bit in the plaintext always flips the same bit in the ciphertext and vice versa.

-67-

CHAPTER 25 TRUSTED COMPUTING AND MULTILEVEL SECURITY ANSWERS TO QUESTIONS 25.1 In most security models, each subject and each object is assigned a security class. In the simplest formulation, security classes form a strict hierarchy and are referred to as security levels. A subject is said to have a security clearance of a given level; an object is said to have a security classification of a given level.

25.2 no read up: A subject can only read an object of less or equal security level. This is referred to in the literature as the simple security property (ss-property). no write down: A subject can only write into an object of greater or equal security level. This is referred to in the literature as the *property. ds-property: An individual (or role) may grant to another individual (or role) access to a document based on the owner's discretion, constrained by the MAC rules. Thus, a subject can exercise only accesses for which it has the necessary authorization and which satisfy the MAC rules.

25.3 The ds-property.

25.4 The BLP model deals with confidentiality and is concerned with unauthorized disclosure of information. The Biba models deals with integrity and is concerned with the unauthorized modification of data.

25.5 Simple integrity: A subject can modify an object only if the integrity level of the subject dominates the integrity level of the object: I(S) ≥ I(O).

Integrity confinement: A subject can read on object only if the integrity level of the subject is dominated by the integrity level of the object: I(S) ≤ I(O).

Invocation property: A subject can invoke another subject only if the integrity level of the first subject dominates the integrity level of the second subject: I(S1) ≥ I(S2).

-68-

25.6 Certification rules are security policy restrictions on the behavior of Integrity Verification Procedures and Transformation Procedures.

Enforcement rules are built-in system security mechanisms that achieve the objectives of the certification rules.

25.7 The Chinese wall is a logical barrier that prevents a subject that accesses data from one side of the wall from accessing data on the other side.

25.8 No read up: A subject can only read an object of less or equal security level. No write down: A subject can only write into an object of greater or equal security level.

25.9 Complete mediation: The security rules are enforced on every access, not just, for example, when a file is opened. Isolation: The reference monitor and database are protected from unauthorized modification. Verifiability: The reference monitor's correctness must be provable. That is, it must be possible to demonstrate mathematically that the reference monitor enforces the security rules and provides complete mediation and isolation.

25.10 Roles can be defined by type of access and clearance level.

25.11 Entire database: This simple approach is easily accomplished on an MLS platform. An entire database, such as a financial or personnel database, could be classified as confidential or restricted and maintained on a server with other files.

Individual tables (relations): For some applications, it is appropriate to assign classification at the table level. In the example of Figure 25.10a, two levels of classification are defined: unrestricted (U) and restricted (R). The Employee table contains sensitive salary information and is classified restricted, while the Department table is unrestricted. This level of granularity is relatively easy to implement and enforce.

Individual columns (attributes): A security administrator may choose to determine classification on the basis of attributes, so that selected columns are classified. In the example of Figure 25.10b, the administrator determines that salary information and the identity of department managers is restricted information.

Individual rows (tuples): In other circumstances, it may make sense to assign classification levels on the basis of individual rows that match certain properties. In the example of Figure 25.10c, all rows in the Department table that contain information relating to the Accounts Department (Dept. ID = 4), and all rows in the Employee Table for which the Salary is greater than 50K are restricted.

-69-

Individual elements: The most difficult scheme to implement and manage is one in which individual elements may be selectively classified. In the example of Figure 25.10d, salary information and the identity of the manager of the Accounts Department are restricted.

25.12 In a database, insert a new row at the lower level without modifying the existing row at the higher level. This is known as polyinstantiation. This avoids the inference and data integrity problems but creates a database with conflicting entries 25.13 Authenticated boot service: The authenticated boot service is responsible for booting the entire operating system in stages and assuring that each portion of the OS, as it is loaded, is a version that is approved for use.

Certification service: Once a configuration is achieved and logged by the TPM, the TPM can certify the configuration to other parties.

The TPM can produce a digital certificate by signing a formatted description of the configuration information using the TPM's private key. Thus, another user, either a local user or a remote system, can have confidence that an unaltered configuration is in use.

Encryption service: The encryption service enables the encryption of data in such a way that the data can be decrypted only by a certain machine and only if that machine is in a certain configuration.

25.14 The aim of these standards is to provide greater confidence in the security of IT products as a result of formal actions taken during the process of developing, evaluating, and operating these products.

25.15 One of the security assurance requirements is that security functionality is not compromised during product delivery. Thus, security functionality is one of the concerns of security assurance.

25.16 •Sponsor: Usually either the customer or the vendor of a product for which evaluation is required. Sponsors determine the security target that the product has to satisfy.

•Developer: Has to provide suitable evidence on the processes used to design, implement, and test the product to enable its evaluation.

•Evaluator: Performs the technical evaluation work, using the evidence supplied by the developers, and additional testing of the product, to confirm that it satisfies the functional and assurance requirements specified in the security target. In many countries, the task of evaluating products against a trusted computing standard is delegated to one or more endorsed commercial suppliers.

•Certifier: The government agency that monitors the evaluation process and subsequently certifies that a product as been -70-

successfully evaluated. Cookies generally manage a register of evaluated products, which can be consulted by customers.

25.17 1. Preparation: Involves the initial contact between the sponsor and developers of a product, and the evaluators who will assess it. It will confirm that the sponsor and developers are adequately prepared to conduct the evaluation and will include a review of the security target and possibly other evaluation deliverables. It concludes with a list of evaluation deliverables and acceptance of the overall project costing and schedule.

2. Conduct of evaluation: A structured and formal process in which the evaluators conduct a series of activities specified by the CC. These include reviewing the deliverables provided by the sponsor and developers, and other tests of the product, to confirm it satisfies the security target. During this process, problems may be identified in the product, which are reported back to the developers for correction.

3. Conclusion: The evaluators provide the final evaluation technical report to the certifiers for acceptance. The certifiers use this report, which may contain confidential information, to validate the evaluation process and to prepare a public certification report. The certification report is then listed on the relevant register of evaluated products.

ANSWERS TO PROBLEMS 25.1 The purpose of the "no write down" rule, or *-property is to address the problem of Trojan horse software. With the *-property, information cannot be compromised through the use of a Trojan horse. Under this property, a program operating on behalf of one user cannot be used to pass information to any user having a lower or disjoint access class.

25.2 An append function only requires the ability to update the object without observing (reading) the object. The write function requires the ability to read as well.

25.3 a. The set b defines the current accesses. As long as these accesses satisfy the model properties, security is enforced. That is all that is strictly required. b. The current accesses are determined in part by the permissions defined in the access matrix M. It would be difficult to properly implement the security policy without enforcing the restrictions on M.

-71-

25.4 Figure 25.2a: Rule 7 (create object), used by both Dirk and Carla.

Figure 25.2b: Dirk reads f2 (Rule 1). Dirk creates file (Rule 7).

Figure 25.2.c: Dirk creates file (Rule 7) Figure 25.2d: Dirk downgrades a classification. This is done by a security administrator, outside the scope of the rules.

Figure 25.2e: Carla creates a file (Rule 7) and writes to the file (Rule 1).

25.5 They reflect the role ability to read down and write up.

25.6 a. allow (s, repository, browse(s)) iff label (s) ≥ class (repository) allow (s, repository, insert(s)) iff label (s) ≤ class (repository) b. In the initial state, subjects cannot browse information unless their label is MAX which is equal to class (repository) and hence no read up (NRU) is satisfied (first condition of 25.6a). Also, in the initial state, all subjects can insert information but since class (repository) is MAX, subject labels will always be less than or equal to the repository label and hence no write down (NWD) is satisfied (second condition of 25.6b).

Assuming NRU and NWD are met in the current state, it is trivial to argue that neither browse nor insert will cause the label of any subject or the label of the repository to change. As a result the NRU and NWD rules must be satisfied in any state that results from either of these actions occurring from a reachable state.

25.7 a. For all s ∈ subjects; allow (s, repository, browse(s)) iff label (s) ≤ class (repository) allow (s, repository, insert(s)) iff label (s) ≥ class (repository) b. The argument is similar to 25.6b. The first condition of 25.7a corresponds to no read down and the second condition of 25.7a corresponds to no write up.

25.8 a. Rules C1, C2, E1 b. Rules E2, C3 d. Rule C4 e. Rule C5 25.9

c. Rule E3 f. Rule E4

Drake is not authorized to read the string directly, so the no-read-up rule will prevent this. Similarly, Drake is not authorized to assign a security level of sensitive to the back-pocket file, so that is prevented as well.

25.10 Suppose the role is for top secret users. The user has the potential to read some objects at the top secret level (rts) but could then write them down to the secret level (ws), violating the *-property.

Suppose the role is for secret users. Then the rts access capability violates the simple security property.

-72-

25.11 1. Notify the user that a row with that primary key already exists and reject the insertion.

2. Replace the existing row at the lower level with the new row being inserted at the high level.

3. Insert the new row at the high level without modifying the existing row at the lower level (i.e., polyinstantiate the entity).

25.12 Few products are evaluated against the higher EAL 6 and EAL 7 Common Criteria assurance levels because the evaluation requirements of these levels require either semiformal or formal verification that the implementation conforms to a formal model of the security design requirements. The need to develop such a formal model and to prove implementation compliance seriously limits the type and complexity of products that can be so evaluated. Such products general only perform extremely limited functions (such as an optical keyboard/mouse/monitor switch, or a data diode to allow one-way data flow from a lower to higher classified network). Given the stringent model, design and verification requirements, it is unlikely that a general-purpose operating system, or database management system, could be evaluated to these levels.

-73-