Transcription
Course information INF3510 Information SecurityLecture 01:- Course info- Basic concepts in information securityUniversity of Oslo, spring 2015Course organizationPrerequisitesSyllabus and text bookLecture planHome examAssessment and examsSecurity educationAFSecurityUiO Spring 2015Course organisationL01 - INF3510 Information Security2Course Resources Course activities Learning material will be made available on:– Attend 2 hours lectures per week Lecture notes available at least one day prior to lecture– /v15/– Work on the workshop questions– lecture presentations, workshop questions, etc.– List of English security terms translated to Norwegian Will be discussed during the following week’s workshop whichfollows immediately after the 2-hour lecture Assignment topic for home exam on:– Work on the home exam– https://wiki.uio.no/mn/ifi/INF3510-2015 Topic for the assignment can be freely chosen. Various online resources Not just about facts, you also need to––––– E.g. NIST special computer security SPs.htmlunderstand conceptsapply those conceptsthink about implicationsunderstand limitationsUiO Spring 2015L01 - INF3510 Information Security3UiO Spring 2015L01 - INF3510 Information Security4
LecturerPrerequisites Prof. Audun Jøsang, Education––––– PrerequisitesBaccalaureat, Lycée Corneille, France, 1981BSc Telematics, NTH 1987MSc Information Security, Royal Holloway College, London, 1993PhD Information Security, NTNU, 1998CISSP 2005, CISM 2010, Work–––––System design engineer, Alcatel, Belgium 1988-1992Associate Professor, NTNU, 1998-1999Research Leader, DSTC, Australia 2000-2004Associate Professor, QUT, Australia, 2005-2007Professor, UiO, 2008UiO Spring 2015L01 - INF3510 Information Security5Syllabus and text book– read parts of the text book and other documents– work out answers to the workshop questions– follow the lectures.CISSP All-in-One Exam Guide6th Edition, 2013Author: Shon HarrisShon ition/dp/0071781749L01 - INF3510 Information Security––––Discrete mathematics, number theory, modular arithmeticInformation theoryProbability calculusComputer and network architectureUiO Spring 2015L01 - INF3510 Information Security6 1430 pages in total– But exclude The book covers the 10 CBK domains (Common Body of Knowledge)for the CISSP Exam (Certified Information Systems SecurityProfessional). Easy to order book from amazon.com, price: US 50UiO Spring 2015 Theoretic focus on a basic levelHow to use Harris’ CISSP book (6th ed.) The syllabus for this course consists of the material presented duringthe lectures, as described in the lecture notes. Adequate comprehension of the material requires that you also Text book:– Basic computer and network technology– Basic mathematics7Ch.1 (Becoming a CISSP)50 pages of appendix, glossary and index300 pages of tips, Q&AParts of chapters– Around 800 pages of readable material– The book is very easy to read– Sometimes long explanations and examples Each chapter has Main Sections (big font) andSubsections (small font), but no numbering, a bit confusing. Don’t read distracting comments in italics under section titlesUiO Spring 2015L01 - INF3510 Information Security8
Draft Lecture PlanWeekDate#W0419.01.20151Course Information. Basic Concepts in ISW05W0626.01.201502.02.201523IS Management, Human Factors for ISRisk Management and Business Continuity PlanningW0709.02.20154Computer 01518.05.201503.06.2015UiO Spring 2015Topic Write an essay on a security topic chosen by you Individual, or in group of 2 or 3 students Select topic and specify group on wikihttps://wiki.uio.no/mn/ifi/INF3510-2015/ Length: 5000 - 10000 words (approx. 10 – 15 pages) Due date: 08.05.2015 Assessment criteria:CryptographyKey Management and PKIDigital ForensicsUser AuthenticationIdentity Management and Access ControlNetwork SecurityEaster breakEaster break11Network Perimeter Security12Development and Application Security13Operations SecurityNo lectureNo lectureReviewNo lectureExam time: 14:30h - 18:30h (4 hours)L01 - INF3510 Information Security––––9 Course weight: 10 study points Assessment items:– Home exam: weight 0.4– Written exam: weight 0.6 Required to get a pass score on both assessment items– At least 40% on home exam and 40% on written exam– Relatively easy to get a high score on home exam– Relatively difficult to get a high score on written exam Academic dishonesty (including plagiarism and cheating) isactively discouraged See: ns/cheating/ Should be no problemL01 - INF3510 Information SecurityStructure and presentation: weight ¼Scope and depth of content: weight ¼Evidence of independent research and analysis: weight ¼Proper use of references: weight ¼UiO Spring 2015L01 - INF3510 Information Security10Statistics from previous examsAssessment and MarkingUiO Spring 2015Home 1302012342(6%)6(18%)14(41%)066(0.0%) (17.5%) )2010581(2%)15(26%)25(43%)7(12%)3(5%)7(12%)UiO Spring 2015#C(%)#D(%)#E(%)#F(%)4514923(44%) (13.5%) (4.5%) (22.5%)For the 2013 spring semester the course wascancelled due to faculty politics.L01 - INF3510 Information Security12
Other security courses at UiOWhy study information security ? UNIK4220 – Introduction to Cryptography (autumn) Being an IT expert requires knowledge about IT security– Leif Nilsen (Thales)– Imagine building architects without knowledge about fire safety UNIK4250 – Security in Distributed Systems (spring)– Josef Noll (IfI) UNIK4270 – Security in Operating Systems and Software(autumn)– Audun Jøsang (IfI) INF5150 - Unassailable IT-systems (autumn)– Ketil Stølen (SINTEF)– Often seen as a cost, but saves costs in the long term– Must compete with other disciplines in IT industry and education ITLED4230 Ledelse av informasjonssikkerhet (autumn)– Audun Jøsang– Only for professionals (fee NOK 25K)UiO Spring 2015L01 - INF3510 Information Security Building IT systems without considering security will leadto vulnerable IT systems Our IT infrastructure is vulnerable to cyber attacks IT experts without security skills are part of the problem ! Learn about IT security to become part of the solution Information security is a political issue13UiO Spring 2015L01 - INF3510 Information Security14ISACA CertificationsCertifications for IS Professionals(Information Systems Audit and Control Association) ISACA provides certification for IT professionals Many different types of certifications available– vendor neutral or vendor specific– from non-profit organisations or commercial for-profit organisations Certification gives assurance of knowledge and skills,– needed in job functions– gives credibility for consultants, applying for jobs, for promotion––––CISMCISACGITCRSIC- Certified Information Security Manager- Certified Information System Auditor- Certified in the Governance of Enterprise IT- Certified in Risk and Information Systems Control CISM is the most popular ISACA security certification IT auditors and consultants commonly have ISACAcertifications ISACA promotes IT governance framework COBIT Sometimes required– US Government IT Security jobs Knowledge domains reflect current topics in IT Security– Generally kept up-to-date(Control Objectives for Information and Related Technologies)UiO Spring 2015L01 - INF3510 Information Security15UiO Spring 2015L01 - INF3510 Information Security16
CISM: Certified Information Security ManagerCISM Exam Exams normally twice per year worldwide Next exam in Oslo (and worldwide): 13 June 2015 Focuses on 4 domains of IS management1. Information Security Governance2. Information Risk Management3. Information Security Program Development andManagement4. Information Security Incident Management–––––Deadline for registering:10 April 2015 (final deadline)Register for exam at www.isaca.orgExam fee approx. US 500Multiple choice examRequires 5 years professional experience Official prep manual published by ISACA– https://www.isaca.org/bookstore/Price: US 115 ( 85 for ISACA members)– sources.aspxUiO Spring 2015L01 - INF3510 Information Security17International Information Systems Security Certification Consortium (ISC)2 provides certification for information SLP- Certified Information Systems Security Professional- Information Systems Security Architecture Professional- Information Systems Security Management Professional- Information Systems Security Engineering Professional- Certification and Accreditation Professional- Systems Security Certified Practitioner- Certified Secure Software Lifecycle Professional CISSP is the most common IT security certification– Most IT Security Consultants are CISSPUiO Spring 2015L01 - INF3510 Information SecurityUiO Spring 2015L01 - INF3510 Information Security18CISSP Exam:Certified Information System Security Professional(ISC)2 Certifications–––––––– Yearly CISM maintenance fee approx. US 100– Requires 120 hours “practice time” per 3 years19 Many different books to prepare for CISSP exam e.g. text book used for INF3510 courseCISSP All-in-One Exam Guide6th Edition, 2013Author: Shon Harris 560 fee to sit CISSP exam Exam through http://www.pearsonvue.com/isc2/ Test Centre in Oslo: http://www.glasspaper.no/Brynsveien 12, Bryn, Oslo Most of the of the material presented in the INF3510 course is takenfrom the syllabus of the CISSP CBK (Common Body of Knowledge).UiO Spring 2015L01 - INF3510 Information Security20
Security SurveysCISSP CBK (Common Body of Knowledge)1. Access Control (userauthentication and identitymanagement)2. Telecommunications andNetwork Security3. Information SecurityManagement and RiskManagement4. Application Security(software security)5. CryptographyUiO Spring 2015 Useful for knowing the trend and current state ofinformation security threats and attacks6. Security Architecture andDesign (computer security)7. Operations Security8. Business ContinuityPlanning and DisasterRecovery Planning9. Legal Regulations,Compliance andInvestigation (forensics)10. Physical andEnvironmental SecurityL01 - INF3510 Information Security– CSI Computer Crime & Security Survey (http://gocsi.com/survey)– Verizon Data Breach Report:http://www.verizonenterprise.com/DBIR/– PWC: mationsecurity-survey/– US IC3 (The Internet Crime Complaint x– Mørketallsundersøkelsen; http://www.nsr-org.no/moerketall/ many others21UiO Spring 2015L01 - INF3510 Information SecurityAcademic Forum on SecuritySecurity AdvisoriesAFSecurity Useful for learning about new threats and vulnerabilities––––22 NorCERT: For government sector: https://www.nsm.stat.no/NorSIS: For private sector: http://www.norsis.no/US CERT: http://www.cert.org/Australia AusCERT: http://www.auscert.org.au/Monthly seminar on information t speakersNext AFSecurity:– Wednesday 11 March 2015, 14:00h– Topic:Cybersecurity Management– Speaker: Frode Hommedal (Telenor) many others All interested are welcome !UiO Spring 2015L01 - INF3510 Information Security23UiO Spring 2015L01 - INF3510 Information Security24
Good and bad translationInformation SecurityBasic ConceptsEnglishNorwegian Security Safety Certainty Sikkerhet Trygghet VisshetGood Security Safety Certainty SikkerhetBadUiO Spring 2015L01 - INF3510 Information SecurityWhat is security in generalWhat is Information Security Security is about protecting assets from damage or harm Focuses on all types of assets Information Security focuses on protectinginformation assets from damage or harm What are the assets to be protected?– Example: your body, possessions, the environment, the nation– Example: data files, software, IT equipment and infrastructure Security and related concepts––––– Covers both intentional and accidental eventsNational security (political stability)Safety (health)Environmental security (clean environment)Information securityetc.UiO Spring 2015L01 - INF3510 Information Security26– Threat agents can be people or acts of nature– People can cause harm by accident or by intent Information Security defined:– The preservation of confidentiality, integrity and availability ofinformation; in addition, other properties such as authenticity,accountability, non-repudiation and reliability can also beinvolved. (ISO27001)27UiO Spring 2015L01 - INF3510 Information Security28
Scope of information securityThe Need for Information Security IS management has as goal to avoid damage andto control risk of damage to information assets IS management focuses on: Why not simply solve all security problems once for all? Reasons why that’s impossible:– Understanding threats and vulnerabilities– Managing threats by reducing vulnerabilities or threatexposures– Detection of attacks and recovery from attacks– Investigate and collect evidence about incidents(forensics)– Rapid innovation constantly generates new technology with newvulnerabilities– More activities go online– Crime follows the money– Information security is a second thought when developing IT– New and changing threats– More effective and efficient attack technique and tools are beingdeveloped Conclusion: Information security doesn’t have a final goal,it’s a continuing processUiO Spring 2015L01 - INF3510 Information Security29Internet Storm Survival Time MeasureUiO Spring 2015L01 - INF3510 Information Security30Malware TrendThe survival time is calculated as the average timebetween attacks against average target IP address.http://isc.sans.org/survivaltime.htmlUiO Spring 2015L01 - INF3510 Information Security31UiO Spring 2015L01 - INF3510 Information Security32
Security control functional typesSecurity control categories Preventive controls:– prevent attempts to exploit vulnerabilitiesInformation Security Example: encryption of files Detective controls:– warn of attempts to exploit vulnerabilities Example: Intrusion detection systems (IDS)Physical controlsTechnical controls Facility protection Security guards Locks Monitoring Environmental controls Intrusion detection Logical access control Cryptographic controls Security devices User authentication Intrusion detection ForensicsUiO Spring 2015Administrativecontrols Policies Standards Procedures & practice Personnel screening Awareness trainingL01 - INF3510 Information Security33 Corrective controls:– correct errors or irregularities that have been detected. Example: Restoring all applications from the last knowngood image to bring a corrupted system back online Use a combination of controls to help ensure thatthe organisational processes, people, andtechnology operate within prescribed bounds.UiO Spring 2015L01 - INF3510 Information SecurityControls by Information StatesSecurity Services and Properties Information security involves protecting informationassets from harm or damage. Information is considered in one of three possible states: A security service is a high level security property The traditional definition of information security is topreserve the three CIA properties for data and services:– During storage– Confidentiality:– Integrity Information storage containers Electronic, physical, human– Availability:– During transmission Physical or electronic34DataandServicesAvailability– During processing (use) Physical or electronic The CIA properties are the three main security services Security controls for all information states are neededUiO Spring 2015L01 - INF3510 Information Security35UiO Spring 2015L01 - INF3510 Information Security36
Security services and controlsConfidentiality Security services (aka. goals or properties)– implementation independent– supported by specific controls Security controls (aka. mechanisms)– Practical mechanisms, actions, tools or procedures that are usedto provide security services The property that information is not made available ordisclosed to unauthorized individuals, entities, orprocesses. (ISO 27001) Can be divided into:– Secrecy: Protecting business data– Privacy: Protecting personal data– Anonymity: Hide who is engaging in what actionsSecurity services:e.g. Confidentiality – Integrity – Availability Main threat: Information theft Controls: Encryption, Access Control, Perimeter defencesupportSecurity controls:e.g. Encryption – Firewalls – AwarenessUiO Spring 2015L01 - INF3510 Information Security37Integrity38 The property of being accessible and usableupon demand by an authorized entity.(ISO 27001) Main threat: Denial of Service (DoS)– The prevention of authorized access to resourcesor the delaying of time critical operations Controls: Redundancy of resources, trafficfiltering, incident recovery, internationalcollaboration and policingCryptographic integrity check,Encryption,Access ControlPerimeter defenceAuditVerification of systems and applicationsUiO Spring 2015L01 - INF3510 Information SecurityAvailability Data Integrity: The property that data has not beenaltered or destroyed in an unauthorized manner. (X.800) System Integrity: The property of safeguarding theaccuracy and completeness of assets (ISO 27001) Main threat: Data and system corruption Controls:––––––UiO Spring 2015L01 - INF3510 Information Security39UiO Spring 2015L01 - INF3510 Information Security40
Authenticity (Security Service)Taxonomy of AuthenticationThe CIA properties are quite general security services.Other security services are often mentioned.Authentication is very important, with various types:Authentication User authentication:EntityAuthentication– The process of verifying a claimed identity of a (legal) userwhen accessing a system or an application.DataAuthentication Organisation authentication:MAC,DigSig&PKI– The process of verifying a claimed identity of a (legal)organisation in an online interaction/session System authentication (peer entity authentication):– The corroboration (verification) that a peer entity (system) in anassociation (connection, session) is the one claimed (X.800). Data origin authentication (message authentication):– The corroboration (verification) that the source of data receivedis as claimed (X.800).UiO Spring 2015L01 - INF3510 Information Security41User Identification and AuthenticationUserAuthenticationpasswords, tokens,OTP, biometrics, PKIUiO Spring crypto protocols,e.g. TLS, PKIcrypto protocols,e.g. IPSec, PKIL01 - INF3510 Information SecuritySystem Authentication Identification42Host AHost B Goal– Who you claim to be– Method: (user)name, biometrics– Establish the correct identity of remote hosts Main threat: User authentication––––– Prove that you are the one you claim to be Main threat: Unauthorized access Controls:Alice WonderlandD.O.B. 31.12.1985Cheshire, England– Passwords,– Personal cryptographic tokens, Controls:Student nr.33033University of Oxford OTP generators, etc.– BiometricsNetwork intrusionMasquerading attacks,Replay attacks(D)DOS attacksAuthentication token– Cryptographic authentication protocols based on hashing andencryption algorithms– Examples: TLS, VPN, IPSEC Id cards– Cryptographic security/authentication protocolsUiO Spring 2015L01 - INF3510 Information Security43UiO Spring 2015L01 - INF3510 Information Security44
Data Origin Authentication(Message authentication)Non-Repudiation(Security Service) Goal: Making sending and receiving messages undeniablethrough unforgible evidence. Goal: Recipient of a message (i.e. data) can verify thecorrectness of claimed sender identity– Non-repudiation of origin: proof that data was sent.– Non-repudiation of delivery: proof that data was received.– NB: imprecise interpretation: Has a message been received and readjust because it has been delivered to your mailbox?– But 3rd party may not be able to verify it Main threats:– False transactions– False messages and data Main threats:– Sender falsely denying having sent message– Recipient falsely denying having received message Controls:–––––Encryption with shared secret keyMAC (Message Authentication Code)Security protocolsDigital signature with private keyElectronic signature, Control: digital signature– Cryptographic evidence that can be confirmed by a third party Data origin authentication and non-repudiation are similar– Data origin authentication only provides proof to recipient party– Non-repudiation also provides proof to third parties i.e. any digital evidenceUiO Spring 2015L01 - INF3510 Information Security45Accountability– Authorization policy normally defined by humans– Issued by an authority within the domain/organisation Main threats: Authority can be delegated– Inability to identify source of incident– Inability to make attacker responsible–– Implemented in IT systems as configuration/policy Controls: Beware of confusion (also in Harris text book):Identify and authenticate usersLog all system events (audit)Electronic signatureNon-repudiation based on digital signatureForensicsL01 - INF3510 Information Security46 Authorization is to specify access and usage permissions forentities, roles or processes– Audit information must be selectively kept and protected so thatactions affecting security can be traced to the responsible party(TCSEC/Orange Book)UiO Spring 2015L01 - INF3510 Information SecurityAuthorization(Security Service) Goal: Trace action to a specific user and hold themresponsible–––––UiO Spring 2015– Correct: Harris 6th ed. p.161: "A user may be authorized to access thefiles on the file server, but until she is properly identified andauthenticated, those resources are out of reach."– Wrong: Harris 6th ed. p.161: "If the system determines that the subjectmay access the resource, it authorizes the subject".47UiO Spring 2015L01 - INF3510 Information Security48
Identity and Access Management ation Claim identityProvisioningAuthenticationAccesscontrolUiO Spring 2015 The term “authorization” is often wrongly used in thesense of “access control”TerminationphaseOperation phaseAuthorizationConfusion about AuthorizationProve claimedidentityAre youauthorized?– e.g. “If the system determines that the subject may access theresource, it authorizes the subject” (e.g. Harris 6th ed. p.161)– Common in text books and technical specifications (RFC 2196 )– Cisco AAA Server (Authentication, Authorization and Accounting)Revokeauthorization Wrong usage of “authorization” leads to absurd situations:Deactivatecredentials1. You get somebody’s password, and uses it to access account2. Login screen gives warning: “Only authorized users may accessthis system”3. You are caught and taken to court4. You say: “The text book at university said I was authorized if thesystem granted access, which it did, so I was authorized”De-registrationL01 - INF3510 Information Security49UiO Spring 2015L01 - INF3510 Information SecurityIdentity and Access Management ConceptsSystem Owner ionlog-onEnd of lectureIdIdentity ProviderSystem OwnerpolicyrequestPDP7decisionaccessSystem resource86 urce &access type5Access controlfunctionPAP: Policy Administration PointPEP: Policy Enforcement PointRegistrationPDP: Policy Decision PointIdP: Identity ProviderOperationsUiO Spring 2015L01 - INF3510 Information Security5150
CISSP is the most common IT security certification -Most IT Security Consultants are CISSP UiO Spring 2015 L01 -INF3510 Information Security 19 CISSP Exam: Certified Information System Security Professional Many different books to prepare for CISSP exam e.g. text book used for INF3510 course CISSP All-in-One Exam Guide 6thEdition .
