Final Flashcards
Risk
likelihood that a chosen action or activity
(including the choice of inaction) will lead to a
loss (un undesired outcome)
Risk Management
identification, assessment,
and prioritization of risks followed by coordinated
use of resources to monitor, control or minimize
the impact of risk-related events or to maximize
the gains.
examples: finances, industrial processes, public health
and safety, insurance, etc.
one of the key responsibilities of every manager within
an organization
Risks in Info. Security
risks which arise from an
organization’s use of info. technology (IT)
related concepts: asset, vulnerability, threat
Asset
anything that needs to be protected because it
has value and/or contributes to the successful
achievement of the organization’s objectives
Threat
any circumstance or event with the potential
to cause harm to an asset and/or result in harm
to organization
Vulnerability
a weakness in an asset that can be
exploited by threat and cause harm the
asset and/or the organization
Risk
probability of a threat acting upon a vulnerability
causing harm to an asset
Security Risk Management
process of identifying vulnerabilities in an organization’s info. system and taking steps to protect the CIA of all of its components. two major sub-processes: Risk Identification & Assessment 12 Security Risk Management Risk Control (Mitigation)
Risk Identification
Identify the Risk Areas Assess the Risks
Identify & Prioritize Assets Identify & Prioritize Threats Identify Vulnerabilities between Assets and Threats (Vulnerability Analysis)
Risk Assessment
Calculate Relative Risk ($$$)
of Each Vulnerability
Risk Control (Mitigation)
Re-evaluate the Risks Implement Risk Management Actions Develop Risk Management Plan
Identifying Hardware, Software (& Networking Assets)
Can be done automatically (using specialized software)
or manually.
Needs certain planning – e.g. which attributes of each
asset should be tracked, such as:
name – tip: naming should not convey critical info to potential attackers
asset tag – unique number assigned during acquisition process
IP address
MAC address
software version
serial number
manufacturer name
manufacturer model or part number
Identifying People, Procedures and Data Assets
Not as readily identifiable as other assets – require that experience and judgment be used. Possible attributes: people – avoid personal names, as they may change, use: ∗ position name ∗ position number/ID ∗ computer/network access privileges procedures ∗ description ∗ intended purpose ∗ software/hardware/networking elements to which it is tied ∗ location of reference-document, … data ∗ owner ∗ creator ∗ manager ∗ location,
Asset Ranking
Assets should be ranked so that most valuable assets
get highest priority when managing risks.
Questions to consider when determining asset value/rank:
1) Which info. asset is most critical for the overall operation
and success of organization?
Example: Amazon’s ranking assets
Amazon’s network consists of regular desktops and web servers.
Web servers that advertise company’s products and receive orders
24/7 - critical.
Desktops used by customer service department – not so critical.
Assets should be ranked so that most valuable assets
get highest priority when managing risks
Threat Identification
Now that assets are known, we should see if there are any known potential threats/dangers for our company that exist out there … Once we identify potential threats, next step will be to see whether they really apply to our assets …
Any organization faces a wide variety of threats.
• To keep risk management ‘manageable’ …
realistic threats must be identified and further investigated,
while unimportant threats should be set aside
Example: government surveys of types of threats/attacks
Threat Modeling/Assessment
practice of building
an abstract model of how an attack may proceed and
cause damage [attacker-, system-, or asset- centric]
Attacker-centric
starts from attackers, evaluates their
motivations and goals, and how they might achieve them
through attack tree
System-centric
starts from model of system, and
attempts to follow model dynamics and logic, looking
for types of attacks against each element of the model.
Asset-centric
starts from assets entrusted to a system,
such as a collection of sensitive personal information, and
attempts to identify how CIA security breaches can happen.
Questions used to prioritize threats:
Which threats present a realistic danger to organization’s
assets in its current environment? ( ‘pre-step’ )
Goal: reduce the risk management’s scope and cost.
Examine each category from CSI/FBI list, or as identified
through threat assessment process, and eliminate any that
do not apply to your organization.
Which threats represent the most severe danger … ?
Goal: provide a rough assessment of each threat’s potential
impact given current level of organization’s preparedness.
‘Danger’ might be a measured of:
1) probability that the threat attacks organization
2) severity, i.e. overall damage that the threat could create
Other questions used to assess/prioritize threats:
How much would it cost to recover from a successful
attack?
Which threats would require greatest expenditure
to prevent?
• Once threats are prioritized, each asset should be reviewed
against each threat to create a specific list of vulnerabilities.
Vulnerability
flaw or weakness in an info. asset, its design, implementation or security procedure that can be exploited accidentally or deliberately by a threat a known threat is a real ‘threat’ to an organization only if there is an actual vulnerability it can exploit sheer existence of a vulnerability does not mean harm WILL be caused – threat agent is required vulnerability that is easy to exploit is often a high-danger vulnerability
TVA Worksheet
at the end of risk identification procedure, organization should derive threats-vulnerabilities-assets (TVA) worksheet this worksheet is a starting point for risk assessment phase TVA worksheet combines prioritized lists of assets and threats prioritized list of assets is placed on x-axis, with most important assets on the left prioritized list of threats is placed on y-axis, with most dangerous threats at the top resulting grid enables a simplified prioritybased vulnerability assessment
Watermarking
Common Applications
verify the owner of a digital object - copyright protection
placing a (unique) watermark = placing a (unique) signature
identify illegal ‘theatrical release’ copies of a movie:
watermark prior to release to prevent movie piracy
copy control in DVD and Blu-ray player
>forensics and piracy deterrence
content filtering
Digital Fingerprinting
process of embedding unique information for each user-
-copy of a digital object in order to be able to identify
entities involved in illegal distribution of the digital object
if object with Alice’s ID is found on Bob’s computer =>
copy is illegal AND likely provided by Alice
Spheres of Information Use
information can accessed directly (people accessing hard-copies) and/or indirectly by means of computer systems (if data in digital form) Introduction multiple layers on ‘technology’ side of access sphere imply that one or more access stages may be required example: to access info stored on a system (database), the user must access / log-into the database-server example: to access info via Internet, the user must ‘go through’ local network (e.g., pass a firewall) and then access the system that hosts the info
Spheres of Protection
between each layer of use there must exist a layer of protection to prevent access to next inner layer shaded bands in the figure … (Avoidance) controls that can be applied to humans! (Avoidance) controls that can be applied to technology!
Access Controls
selective restriction of access to a physical place, computer system or other resource the act of ‘accessing’ may mean entering, using, consuming …
Stages of Access Controls = I / A / A
identification – obtain identity of an entity requesting access to a logical or physical area (obtain credentials) authentication – confirm identity of the entity seeking access … making sure user’s credentials are not false – the user ‘is’ who they claim to be authorization – determine whether the authenticated entity is permitted to access a particular system (e.g., OS, firewall, router, database, …) and its resources (e.g., system’s files) typically implemented by means of access control lists / rules
Basic steps in access control
‘Authorization profile’ of the user is matched against
‘Access profile’ of a specific/requested object.
Just because a user can authenticate to a system
it does not mean they are given access to anything and everything.
Authorization ensues that the requested object or activity on an
object is possible based on the privileges assigned to the subject.
Identification
mechanism that provides info about an unverified entity – aka supplicant – that wants to be granted access to a logical or physical area must be a unique value that can be mapped to one and only one entity within the administered domain in most organizations, identification = name OR (initial + surname)
Authentication
process of validating a person’s (supplicant’s) purported identity types of authentication mechanisms: 1) something you know password or passphrases 2) something you have cryptographic tokens or smart cards 3) something you are - static biometrics fingerprints, palm prints, iris scans, … 4) something you produce - dynamic biometrics pattern recognition of voice, signature / handwriting, typing rhythm
Authentication: Something you know
Something you know … authentication mechanisms based on use of passwords/pins and passphrases password – combination of characters that only the user should know challenge: should be simple enough to remember, and complex enough for cracking bad examples: name of spouse, child, pet passphrase – plain-language phrase typically longer but stronger than a password, from which a virtual password is derived examples: Linksys, Windows 7 and up Authentication: Something you know … CPIMFF = Cheese Pizza Is My Favorite Food
Password cracking speed
Password cracking is becoming very trivial with the vast amount of computing power readily available for anyone who desires so. At a current rate of 25$ per hour, an AWS p3.16xlarge nets you a cracking power of 632GH/s (assuming we’re cracking NTLM hashes). This means we’re capable of trying a whopping 632.000.000.000 different password combinations per second!
Authentication: Something you have
objects used for purpose of user authentication
are called ‘tokens’
token + PIN/password provides significantly
greater security than password alone
an adversary must gain physical possession of
the token (or be able to duplicate it) in addition
to ‘cracking’ the password
types of tokens:
static tokens
dynamic synchronous (one-time password) tokens
dynamic asynchronous (challenge-response) tokens
Authentication: Something you have
e.g.: swipe card, smart card, RFID tags
swipe cards - ID and ATM cards
aka ‘dumb cards’, transmit same credential
every time – the credential (base secret) is
impractical to memorize
PIN/password not on the card – ATM encrypts
PIN provided by user and sends it to a database for verification …
smart card - swipe cards with a chip
chip contains a CPU, memory blocks (RAM,
ROM, …) and on-chip encryption module
stores 100x data stored on magnetic strip:
encrypted PIN & other info about card holder
card checks user’s PIN & generates a certificate
to authorize transaction process …
Authentication: Something you have …
Synchronous (One-Time Password) Tokens
small LCD device that generates a
unique new password periodically
(e.g., every 60 seconds)
token combines ‘base secret’ with a clock
to generate new password
token and authentication server must have
their clocks synchronized – which is often
a challenge!
Asynchronous (Challenge-Response) Tokens
instead of time, token uses a challenge/nonce provided by the system to generate the password e.g., token can generate the password by 1) applying a unique hash function to (user’s base secret + nonce) 2) encrypting nonce using user’s/token’s public key
Something you are (Static / Standard Biometrics)
authentication mechanisms that takes advantage of users’ unique physical characteristics, including fingerprints facial characteristics retina iris in contrast to password/token authentic., biometric systems do not look for a 100% match – person’s characteristics are inherently ‘noisy’ pattern recognition must be involved very effective but costly if a large number of biometric readers need to be installed!
In password-based authentication, an exact (100%) match
is required
enrollment & authentication in biometric syst.
A sample of biometric reading is captured. The sample is processed into feature set. Feature set is converted into a template. enrolment stage in biometric systems is much more involved !!! it is hart if not impossible in some type of biometrics to achieve 100% match
In biometric-based authentication,
an approximate match
is required
Biometric Modality
different types of biometric
information / measurements that can be used to
discriminate between different individuals
an ideal biometric modality / information should have
the following properties
Universality – all individuals must be characterized by this
information
• Uniqueness / Distinctiveness – this information must be
as dissimilar as possible for two different individuals
• Permanency / Stability – this information should be
present during the whole life of an individual
• Collectability / Measurability – this information should be
measured in an easy manner
• Performance – this information can be used to build
accurate, fast and robust biometric/authentication systems
• Acceptability – how willing individuals are to have this
biometric information captured and assessed
Performance – this information can be used to build
accurate, fast and robust biometric/authentication systems
an ideal biometric modality / information should have
the following properties:
Resistance to Attack – how easy it is for this information
to be forged
iris scanner
Iris scanner Authentication: Something you are … IRIS - colored section of an eye scan = 2 seconds of near IR imaging subject can be at some distance alcohol consumption changes iris
Retina scanner
RETINA - cannot be seen by naked eye - the
network of blood vessels
most reliable biometrics, aside from DNA
but can be affected by eye-disease
scan = 15 seconds of low-energy IR scanning
subject has to be close to scanner
Extraction of biometrics features
many biometric systems are
based on image processing
Types of Biometric Systems
1) systems for IDENTIFICATION
perform 1:n comparison to identify a user from a database of n users
2) systems for AUTHENTICATION
perform 1:1 comparison to check whether a user matches his profile
Authentication: Something you are …
Types of Biometric Systems
something you know – to identify the user
Biometric Accuracy / Performance
in all biometrics schemes, some physical
characteristic of the individual is mapped
into digital representation
however, physical characteristics may change
facial contours and color may be influenced by
clothing, hairstyle, facial hair, …
the results of fingerprint scan may vary as a
function of: finger placement, finger swelling and
skin dryness …
multiple mappings may have to be taken
in order to create a (statistically) useful
biometric representation / profile
a biometric sensor must be able to adapt
to a broad range of appearances
Biometric Accuracy
statistical distribution of ‘match score’ between user’s new scan and user’s stored profile/record unfortunately, range of scores/features for any particular user is likely to overlap with scores/ /features of other users by moving the ‘decision threshold’, sensitivity of biomet. system changes move t to left ⇒ system more tolerant to noise , but also system more likely to accept wrong person
False Reject Rate (FRR), aka False Negative
% of authorized users who are denied access
false negatives do not represent a threat to security
but an annoyance to legitimate users
False Accept Rate (FAR), aka False Positive
% of unauthorized / fraudulent users who are allowed
access to system
represent serious security breach
\convenience
1-FR
the higher the FR, the less
convenient an application is
because more subjects are
incorrectly rejected …
security
1-FA
the lower the FA, the fewer
imposter users (adversaries) are
incorrectly accepted into the
system
Crossover Error Rate (CER), aka Equal
Error Rate
point at which FRR = FAR – Operating Point of choice
for most biometric systems – provides balance between
sensitivity & performance (i.e., convenience & security)
techniques with 1% CER superior to 5% CER
as threshold moves to the left, system
becomes ‘less sensitive’ and
the value of FRR decreases but the
value of FAR increases
as threshold moves to the right, system
becomes ‘more sensitive’ and
the value of FRR increases but the
value of FAR decreases
Example: biometric accuracy
Assume a system where each airport passenger is
identified with a unique frequent flyer number and
then verified with a fingerprint sample.
The systems false reject (FR) rate for finger is:
0.03 (= 3%).
5000 people / hour are requesting access to the
airport during a 14 hour day.
How many people will fail to be verified in a day?
# rejected passengers =
= (5000 * 0.03) [rejects / hour] * 14 [hours] =
= 150 [rejects / hour] * 14 [hours] =
= 2100 [rejects]
Something you produce: Dynamic Biometrics
authentication mechanisms that makes
use of something the user performs or
produces:
signature recognition
voice recognition
keystroke recognition
less costly than ‘what you are’ systems,
but not as reliable
signature, voice, keystroke pattern may change
significantly with time and under different
circumstances
Dynamic / behavioral biometrics
Authentication that examines normal actions performed by the user, e.g. keystroke dynamics. measure/observe various time-related parameters during a user’s interaction with a keyboard
keystroke dynamics
With keystroke dynamics the biometric template used to identify an individual is based on the typing pattern, the rhythm and the speed of typing on a keyboard. The raw measurements used for keystroke dynamics are dwell time and flight time.
Dwell time is the time duration that a key is pressed
Flight time is the time duration in between releasing a key and pressing the next key
When typing a series of characters, the time the subject needs to find the right key (flight time) and the time he holds down a key (dwell time) is specific to that subject, and can be calculated in such a way that it is independent of overall typing speed. The rhythm with which some sequences of characters are typed can be very person dependent. For example someone used to typing in english will be quicker at typing certain character sequences such as ‘the’ than a person with french roots.
There exists software which combines keystroke dynamics with other interactions the user has with the computer, such as mouse movements (acceleration time, click frequency).
Biometrics accuracy vs. acceptance
Organizations implementing biometrics must carefully balance
a system’s effectiveness against its perceived intrusiveness and
acceptability to users …
Attacks on password-based authenticat. systems
breaking (try to ‘get into’ the system by using a legitimate password) disabling (prevent legitimate user from getting into the system)
Standard vs. Targeted DoS Attacks
Standard DoS Attack Attacker’s goal is to prevent victimserver from providing access/service to all legitimate user. Targeted DoS Attack Attacker’s goal is to prevent one particular victim-user from obtaining access/service from a server. Most systems ‘lock-out’ a user after multiple login attempts using false password ….
Single- and multi- factor authentication
Systems that use one authentication credential (e.g. something
you know) are known as one-factor authentication systems.
Most computer systems / applications are one-factor
authentication systems – they rely on passwords only.
Systems that require strong protection typically combine
multiple authentication mechanisms – e.g. something you
have and something you know. They are known as two-factor
authentication systems.
For example, access to a bank’s ATM requires a banking
card + a personal identification number (PIN).
Attacks on biometrics-based authenticat. systems
Spoof biometric data
as someone else.
Modify the signal
processing unit to
(e.g.) cause DoS on
legitimate users.
Spoof the signal between the sensor and signal processing unit. (e.g. replay voice)
Alter the content of
the template
database.
Alter the matching
process / software.
Password
a secret word/string of characters used to
authenticate a user into a system
critical (often only) defense against intruders
ideal password: easy to remember, hard to
‘crack’
Google frequently releases lists of common
password types which are insecure as they
are too easy to guess / get off social media
name of a pet, child, family member, spouse
names of birthplaces, favorite sports teams
birthdays, anniversary dates
overly complex passwords are as dangerous
as very simple ones
the user likely to write it down or to reuse it
How are passwords stored
in a computer/system???
\storing in plane text is bad idea
passwords in a system
in most systems, passwords are stored in a protected (hash) form ⇒ snooper that gains internal access to system cannot easily retrieve/steal passwords every time a user logs in, password handling software runs the hash algorithm if (new hash = stored hash), access is granted
account creation stage:
storing hash instead
of password
logging into an existing account:
testing a password against stored hash
online cracking
try every password at login prompt in real time
very slow!
8-character password of 76 possible characters
(upper & lower case, digits, common symbols) =
1.1x1015 possibilities
2 to 3 passwords a second ⇒ 5,878,324 years
to guess a password
extremely noisy!
most systems block the victim account after
several failed login attempts
off-line cracking
assumes the possession of passwd/hash file
Password Management Windows
password hashes are stored in Security Account Manager (SAM) file stored in C:\Windows\System32\config or HKEY_LOCAL_MACHINE\SAM registry - neither of them can be opened/copied on normal boot-up of the OS (i.e., while computer running) – file used by OS
Accesing SAM windows
Accessing SAM – requires administrative privileges
File in Windows to be copied / dumped
SAM file
Copy of SAM file is now stored on C drive as a file named ‘sam’. However, this file is encrypted using SysKey!!! So, a dump of SYSTEM hive/file is also needed!
SAM and sys key
The SAM file is encrypted with the SysKey which is stored in
%SystemRoot%\system32\config\system file.
During the boot-time of Windows the hashes from the SAM file get decrypted using the
SysKey and these hashes are then loaded to the registry and used for authentication
purpose.
Both system and SAM files are unavailable (i.e., locked by kernel) during Windows’
runtime.
Tools like mimikatz (on Windows) and samdump2 (on Linux) can be used
to extract hashes from SAM
Accessing Hash file in unix
text file: /etc/shadow (/etc/passwd)
readable by system administrator
(root) only
getent shadow admin
When a new user is created in Linux it affects 4 files
/etc/passwd
/etc/group
/etc/shadow
/etc/gshadow
/etc/passwd file is essentially the user account database in which Linux stores
valid accounts and related information about these accounts; typically has file
system permissions that allow it to be readable by all users of the system
When a new user is created in Linux it affects 4 files
/etc/passwd
/etc/group
/etc/shadow
/etc/gshadow
/etc/shadow file contains hashed passwords and bookkeeping information;
accessible only by the super user
structure of passwd file
etc/passwd Format
From the above image:
Username: It is used when user logs in. It should be between 1 and 32 characters in length. Password: An x character indicates that encrypted password is stored in /etc/shadow file. Please note that you need to use the passwd command to computes the hash of a password typed at the CLI or to store/update the hash of the password in /etc/shadow file. User ID (UID): Each user must be assigned a user ID (UID). UID 0 (zero) is reserved for root and UIDs 1-99 are reserved for other predefined accounts. Further UID 100-999 are reserved by system for administrative and system accounts/groups. Group ID (GID): The primary group ID (stored in /etc/group file) User ID Info (GECOS): The comment field. It allow you to add extra information about the users such as user’s full name, phone number etc. This field use by finger command. Home directory: The absolute path to the directory the user will be in when they log in. If this directory does not exists then users directory becomes / Command/shell: The absolute path of a command or shell (/bin/bash). Typically, this is a shell. Please note that it does not have to be a shell. For example, sysadmin can use the nologin shell, which acts as a replacement shell for the user accounts. If shell set to /sbin/nologin and the user tries to log in to the Linux system directly, the /sbin/nologin shell closes the connection.
structure of shadow file
Username : It is your login name.
Password : It is your encrypted password. The password should be minimum 8-12 characters long including special characters, digits, lower case alphabetic and more. Usually password format is set to $id$salt$hashed, The $id is the algorithm used On GNU/Linux as follows:
$1$ is MD5
$2a$ is Blowfish
$2y$ is Blowfish
$5$ is SHA-256
$6$ is SHA-512
Last password change (lastchanged) : Days since Jan 1, 1970 that password was last changed
Minimum : The minimum number of days required between password changes i.e. the number of days left before the user is allowed to change his/her password
Maximum : The maximum number of days the password is valid (after that user is forced to change his/her password)
Warn : The number of days before password is to expire that user is warned that his/her password must be changed
Inactive : The number of days after password expires that account is disabled
Expire : days since Jan 1, 1970 that account is disabled i.e. an absolute date specifying when the login may no longer be used.
longer allowed size of the
password => more
combinations have to be tried
In the case of brute-force password cracking, there is no particular strategy when generating password guesses. The entire possible space of passwords is explored.
Password cracking (guessing)
a method of gaining unauthorized access to a computer system by trying different passwords cracking difficulty ∼ size of password space & ‘diversity’ of password characters
brute force password cracking
aka exhaustive password search entire password space is ‘tried’ starts by using simple combinations of characters, and then gradually moves to more complex/longer ones (may be) effective for passwords of small size, but too time consuming for long passwords examples of brute-force crackers Cryptool Cain and Able John the Ripper Ophcrack
What is Password Search Space in Brute-Force Attacks?
a) On 26-letter alphabet, password of length exactly 1/2/n
S1-Letter= 261 S2-Letter= 26*26 = 262 Sn-Letter= 26*26*…*26 = 26n
b) On A-character alphabet (lett. + numb.), passw. of length n:
Sn-character= A^n = 36^n
c) On A-character alphabet, passwords up-to n characters
Brute-Force Password Search Space
Tina has to create a password for the security of a software program file. She wants to use a password with 3 letters. How many passwords are allowed if no letter is repeated and the password is not case sensitive? L1 L2 L3 : A (B-Z) (C-Z) 26*25*24 = 15,600 Password Cracking (cont.) 26 25 24
Brute-Force Password Search Space (3)
A system allows passwords consisting of 4 lower-case letters followed
by 3 digit numbers.
How many passwords are possible if there are no restrictions.
L1 L2 L3 L4 D1 D2 D4
264 *103 = 456,976,000
Biased attack
the search space is further reduced by focusing on most likely combinations of words and/or numbers … Attack Example: Biased Attack on 4-Digit Pins Assume a system requires that access passwords be comprised of 4 digits. Total unbiased search space: Many people use some important personal dates to generate 4-digit passwords. Biased search space: any number between 0000 – 9999 (10,000) only 366 possible combinations!
Dictionary Attack
users often create passwords using
common dictionary words
instead of trying every password, dictionary
attack probes only common dictionary words
faster than brute force, as it uses smaller
(more likely) search space
still might take considerable time, and might
fail in the end
Dictionary Attacks in Real World
Many studies on effectiveness of dictionary attack have been
conducted.
Not 100% effective, but enough passwords were cracked to make
the use of this attack worthwhile.
Pre-Computed Dictionary Attacks
achieves TIME-SPACE tradeoff by pre-computing a list of hashes of dictionary words pre-computed hashes are compared against those in a stolen password file rainbow tables 1) pregenerated sets/lists of hashes – n*Gbyte size!!! 2) allow extremely rapid searching
Password Salting
adding a unique random value to each password before hashing both the hash and salt are stored does not fully prevent against password cracking, but makes it harder / more time consuming
It is hard, if not impossible, to prevent users from choosing ‘weak’ passwords So, ideally, the system would additionally ‘strengthen’ user passwords.
hello Found in most attack
dictionaries and rainbow
tables!
hello3ab9
Cannot be found in
common dictionaries or
rainbow tables
account creation stage
storing hash & salt
instead of password
logging into an existing account:
testing a password against stored hash
Attack on salted passwords
For every word in a dictionary (or an ‘extended’ dictionary):
1) add the User’s salt
2) hash
3) compare
Password Salting Benefits
in case of a compromised
Password File
(simple) dictionary and rainbow attacks impossible to perform
prevents duplicate passwords from being visible in password file
becomes impossible to find out whether a person has used the
same password on multiple systems
Password policies – which one is better?!
Company A requires that its employees pick 6-character passwords
made up of combinations of lowercase letters, uppercase letters, and
digits (62 possibilities). No other characters are allowed, and a given
user’s password must not use any character twice.
Example: ab98CD
Company B requires that its employees pick 12-character passwords,
where each of the 12 can be any of 100 possible characters. Unlike for
Company A, Company B’s employees can reuse characters in their
passwords. However, Company B finds that users often make mistakes
with these long passwords, so if an authentication attempt fails, the
login server helps the user by telling them how many of the initial letters
were correct. For example, if a password entered was ‘abcdefgij’ and the
server replies “Wrong, but the first 4 letters were correct”, then ‘abcd’
are correct, ‘e’ is wrong, and nothing is revealed about the correctness
of the letters after ‘e’.
Suppose an attacker is trying to guess/crack the password of user
U1 at Company A, and user U2 at Company B. Both usernames are valid
at the respective companies, and the users have chosen passwords that
conform with the policy.
a) Write down an expression for the # of attempts the attacker
needs for guessing the password of user U1 at Company A.
Solution:
Example: ab98CD
Total # of allowed characters = 26 + 26 + 10 = 62
Total # of possible passwords = 6261605958*57 =
= 4.4 * 1010
Example: Password policies – which one is better?!
b) Write down an expression for the # of attempts the attacker
needs for guessing the password of user U2 at Company B.
Solution:
The key for this part of the problem is that the attacker can use
feedback provided by the login process to speed up the ‘cracking’
process.
To start, the attacker can try 100 passwords that each differ in
their first character. One of these must succeed. In addition, when
it succeeds, in the worst case the attacker is told that the second
character in the attempted password is incorrect. Therefore, once
the attacker learns that the first character is correct, they also can
eliminate 1 of the possibilities for the second character.
Password: bszi1289AMLK
1st round of 100 guesses: aa, ba, ca, da, …
2nd round of 99 guesses: bba, bca, bda, bea, …, bsa, bta, …
At this point, they make another 100 − 1 = 99 guesses, each of
which uses the first character learned in the previous step, and
tries a different second character (excluding the character that the
attacker has already learned is not correct for the second
position).
This process continues until they try candidates for all 12
positions, requiring at worst a total of:
# of possible passwords = 100+99+99+ … + 99 =
= 100 + 99 · 11 = 1189 38
Password Example (cont.)
b is correct, a is not.
In the next round, do
not check a
Summary of Vulnerability Analysis
Damage
must be
quantifiable!
Threat has
to be real
(probable)!
Threat Vulnerability Asset People Procedure Data Software Hardware Networking Act of human error or failure Deliberate act of trespass Deliberate act of extortion Deliberate act of sabotage Deliberate software attacks Technical software failures Technical hardware failures Forces of nature Etc
sheer existence of a vulnerability
does NOT mean there is an actual
RISK (i.e., harm will be caused
Risk Assessment
provides relative numerical risk ratings/scores for each vulnerability in risk management, it is not the presence of a vulnerability that really matters, but the associated risk!
(Security) Risk – quantifies:
1) possibility that a threat acts upon a vulnerability
AND is successful
2) how severe the consequences would be
R = P * V
P = probability of risk-event occurrence V = value lost / cost to organization
Extended Risk Formula v.1.
R = Pa ⋅ Ps ⋅ V
Pa = probability that an attack/threat (against a
vulnerability) takes place
Ps = probability that the attack successfully exploits
the vulnerability
V = value lost / cost to organization
Extended Risk Formula v.2.
R = Pa ⋅ (1-Pe) ⋅ V Pe = probability that the system’s security measures effectively protect against the attack (reflection of system’s security effectiveness) R = Pa ⋅ (1-Pe) ⋅ V Ps Ps = probability that the attack is successfully executed (i.e., system defences are NOT effective) Pe = probability that the attack is NOT successfully executed (i.e., system defences are effective)
Extended Whitman’s Risk Formula *
R = P ⋅ V – CC ⋅ (P ⋅ V) + UK ⋅ (P ⋅ V)
LE = Loss Expectancy
(i.e. Potential Loss / Risk before Control is Applied)= P ⋅ V ⋅ [ 1 – CC + UK ]
P = probability that certain vulnerability (affecting a
particular asset) gets exploited – equivalent to Pa
V = value of information asset ∈ [1, 100]
CC = current control = percentage/fraction of risk already
mitigated by current control
UK = uncertainty of knowledge = fraction of risk that is not
fully known
Risk determination
Asset A
Has a value of 50.
Has one vulnerability, with a likelihood of 1.0.
No current control for this vulnerability.
Your assumptions and data are 90% accurate.
Asset B
Has a value of 100.
Has two vulnerabilities:
* vulnerability #2 with a likelihood of 0.5, and
a current control that addresses 50% of its risk;
* vulnerability #3 with a likelihood of 0.1 and
no current controls.
Your assumptions and data are 80% accurate.
Which asset/vulnerability should be dealt with first ?!
Example: Risk determination
The resulting ranked list of risk ratings for the three
vulnerabilities is as follows:
Asset A:
Vulnerability 1 rated as 55 = 50 * 1 * (1.0 - 0 + 0.1)
Asset B:
Vulnerability 2 rated as 35 = 100 * 0.5 * (1 - 0.5 + 0.2)
Asset B:
Vulnerability 3 rated as 12 = 100 * 0.1 * (1 – 0 + 0.2)
• Documenting Results – 5 types of documents of risk assesment
ideally created
1) Information asset inventory worksheet
2) Weighted asset worksheet
3) Weighted threat worksheet
4) TVA worksheet
5) Ranked vulnerability risk worksheet
extension of TVA worksheet, showing only the assets
and relevant vulnerabilities
assigns a risk-rating ranked value for each uncontrolled
asset-vulnerability pair
Risk Control Strategies
Once all vulnerabilities/risks are evaluated, the company has to decide
on the ‘course of action’ – often influenced by
1) risk level ($$$)
2) cost of treatment ($$$) …
Basic Strategies to Control Risks
Avoidance
do not proceed with the activity or system that creates this risk
Reduced Likelihood (Control) - implement
by implementing suitable controls, lower the chances of the
vulnerability being exploited
Transference
share responsibility for the risk with a third party
Mitigation
reduce impact should an attack still exploit the vulnerability
Acceptance - do not implement
understand consequences and acknowledge risks without any
attempt to control or mitigate
Avoidance
strategy that results in complete abandonment of activities or systems due to overly excessive risk usually results in loss of convenience or ability to preform some function that is useful to the organization the loss of this capacity is traded off against the reduced risk profile
• Avoidance – strategy that results in complete
abandonment of activities or
systems due to overly excessive risk
usually results in loss of convenience or
ability to preform some function that is
useful to the organization
the loss of this capacity is traded off
against the reduced risk profile
Recommended for vulnerabilities with
very high risk factor
that are very costly to fix.
Reduced Likelihood (Control)
Risk control strategy that attempts to prevent exploitation of vulnerability by means of following techniques: application of technology implementation of security controls & safeguards, such as: anti-virus software, firewall, secure HTTP and FTP servers, etc. policy e.g. insisting on safe procedures training and education change in technology and policy must be coupled with employee’s training and education Likelihood (Control) Recommended for vulnerabilities with high risk factor that are moderately- to low- costly to fix.
Transference
risk control strategy that attempts
to shift risk to other assets, other
processes or other organizations
if organization does not have adequate
security experience, hire individuals or
firms that provide expertise
‘stick to your knitting’!
e.g., by hiring a Web consulting firm, risk
associated with domain name registration,
Web presence, Web service, … are passed
onto organization with more experience
Recommended for vulnerabilities with
high risk factor that are moderately costly to fix
if employing outside expertise.
Mitigation
Risk control strategy that attempts to
reduce the significance of impact caused
by a vulnerability – includes 3 plans:
Risk Control Strategies (cont.)
• Mitigation – risk control strategy that attempts to
reduce the significance of impact caused
by a vulnerability – includes 3 plans:
Recommended for vulnerabilities that are
low (but not zero) risk and moderately to high costly to fix
Acceptance
assumes NO action towards protecting an
an information asset – accept outcome …
should be used only after doing all of the
following
assess the probability of attack and likelihood
of successful exploitation of a vulnerability
approximate annual occurrence of such an attack
estimate potential loss that could result from
attacks
perform a thorough cost-benefit analysis
assuming various protection techniques
determine that particular asset did not
justify the cost of protection!
steps
to be
discussed
Risk Control Strategies (cont.)
Recommended when vulnerability risk «_space;cost of any control.
Risk Tolerance
Risk that organization is willing to
accept after implementing risk-
mitigation controls
Residual Risk
Risk that has not been completely removed, reduced or planned for, after (initial) risk-mitigation controls have been employed goal of information security is not to bring residual risk to 0, but to bring it in line with companies risk tolerance risk-mitigation controls may (have to) be reinforced until residual risk falls within tolerance
Risk Assessment
‘Spotting’ the most significant
vulnerabilities in the sea of potential vulnerabilities.
Quantitative Risk Analysis
predicts level of monetary loss for each threat, and monetary benefit of controlling the treat each element is quantified and entered into equations, e.g.: asset value threat likelihood/frequency/probability severity of vulnerability damage impact safeguard cost
Challenges of – define likelihood & impact values
in a manner that would allow the same scale to be used across multiple risk assessments Quantitative Analysis
Quantitative risk analysis
is the standard way of measuring risk in
many fields, such as finance and insurance, but it is not commonly used
to measure risk in information systems.
Two of the reasons claimed for this are:
1) the difficulties in identifying and assigning a value to assets, and
2) the lack of statistical information that would make it possible to
determine frequency.
Thus, many of the risk assessment tools that are used today for
information systems are measurements of qualitative risk.”
Qualitative Risk Analysis
scenario based approach - uses
labels & relative values (high/low)
rather than numbers; blends in
experience & personal judgment
Example: threat likelihood/frequency (i.e., vulnerability
exploitation) categories
Qualitative Analysis
• Requires simple (if any) calculations. • Considers hands-on opinions of individuals who know the process best
Quantitative Analysis
Easier to automate and evaluate. • Very useful in performance tracking - enables credible cost/benefit analysis.
Cost-Benefit Analysis
aka economic feasibility study - quantitative decision-making process in which for each high-risk vulnerability: determine the loss in value if the asset (with this vulnerability) remained unprotected determine the cost(s) of protecting the asset using various approaches compare available alternatives and arrive at a decision with best financial outcome …
Company should not spend more
to protect an asset than the asset is worth!
Asset Value (AV)
combination of the following: cost of buying/developing hardware, software, service cost of installing, maintaining, upgrading hardware, software, service cost to train and re-train personnel as well as the direct profit gained from the utilization of the asset !
Exposure Factor (EF)
Exposure – percentage loss that would occur from
a given vulnerability being exploited
by a given threat
Factor (EF)
Single Loss
Expectancy
(SLE)
most likely loss (in value) from an attack
SLE = AV * EF
Example: A Web-site’s SLE due to a DDoS Attack
Estimated value of a Web-site: AV = $ 1,000,000.
A DDoS on the site would result in 10% losses of the site
value (EF=0.1).
SLE for the site: AV * EF = $ 100,000.
Quantitative Risk Analysis (cont.)
Would it be worth investing in anti-DDoS system that costs
$150,000 a year?
Annulized Rate of Occurence (ARO)
indicates how often an attack is expected to successfully occur in a year (e.g., 2x a year => ARO=2) if an attack occurs once every 2 years ⇒ ARO = 0.5
Annualized Loss
Expectancy
(ALE)
Annualized Loss – overall loss incurred by an attack (i.e. by exploiting a vulnerability) in each year Expectancy (ALE)
Example: Determining ALE to Occur from Risks
A widget manufacturer has installed new network servers,
changing its network from P2P, to client/server-based network.
The network consists of 200 users who make an average of
$20 an hour, working on 200 workstations.
Previously, none of the workstations involved in the network
had an anti-virus software installed on the machines. This was
because there was no connection to the Internet and the
workstations did not have USB/disk drives or Internet
connectivity, so the risk of viruses was deemed minimal.
One of the new servers provides a broadband connection to
the Internet, which employees can now use to send and receive
email, and surf the Internet.
Example: Determining ALE to Occur from Risks (cont.)
- 200 employees
- 200 workstations
- $20 hour
One of the managers read in a trade magazine that other widget companies have reported an annual 75% chance of virus infection after installing T1 lines, and it may take up to 3 hours to restore the system. A vendor will sell licensed copies of antivirus for all servers and the 200 workstations at a cost of $4,700 per year. The company has asked you to determine the annual loss that can be expected from viruses, and whether it is cost effective to purchase licensed copies of anti-virus software.
Based on the provided data:
Very simplistic scenario. Other losses
could be: erased (IP) documents, lost
emails, impact on reputation, etc.
ARO = 0.75
SLE = 200 user * ($ 20 / user-hour)
* 3 hours = $ 12,000
ALE = ARO * SLE = $ 9,000
ACS = $ 4,700
Because the ALE is $9,000, and the cost of the software that
will minimize this risk is $4,700 per year, this means the
company would save $4,300 per year by purchasing the
software ($9,000 - $4,700 = $4,300).
Cost-Benefit Analysis Formula
– expresses cost benefit of a
safeguard – i.e., determines
whether a particular control
is worth its cost
safeguard is justified
if it results in
NRRB>0
GROSS risk reduction benefit
NRRB = [ALE(prior) - ALE(post)] – ACS
NET Risk Reduction Benefit
(money saved)
ALE(prior) – ALE before implementing control
ALE(post) – ALE after implementing control
ACS – annual cost of safeguard
Example: Determining NRRB
Your organization has decide to centralize anti-virus support on a
server which automatically updates virus signatures on user’s PCs.
When calculating risk due to viruses, the annualized loss expect.
(ALEprior) is $145,000. The cost of this anti-virus countermeasure
Is estimated to $24,000/year, and it will lower the ALEpost to
$65,000.
Is this a cost-effective countermeasure? Why or why not?
ALE (prior) = $145 k
ALE (post) = $65 k
ACS = $24 k
NRRB = ALE (prior) – ALE (post) – ACS =
= $145 k - $65 k - $24 k =
= $56 k, so there are + cost benefits of this solution
Example: Cert. Info. Sys. Sec. Prof. (CISSP) Exam
ALE (prior) = AVEFARO = $106 0.10.2 = $20,000
ALE (post) = $0 (best case scenario - safeguard 100% eff.)
ACS = ?
For NRRB ≥ 0, safeguard of up to $20,000 acceptable.
Example
Cost-benefit analysis in case of 100% effective safeguard Quantitative Risk Analysis (cont.) Time ALE ALE(prior) before safeguards GRRB gross risk reduction benefit ALE(post) after safeguards ACS annual. cost of safeguards NRRB net risk reduction benefit
Other Feasibility Measures
• Quantitative cost-benefit analysis determines whether
a security control measure is feasible economically.
• Other factors and ‘measures of feasibility’, when
evaluating a security control, should be considered:
NRRB = [ALE(prior) - ALE(post)] – ACS
=AROpost
*AVpost
*EFpost
Organizational Feasibility
– examines how well a proposed security control will contribute to organization’s strategic objectives e.g. a firewall might be a good security safeguard, but may prevent effective flow of multimedia data
Behavioral Feasibility
– examines user’s and management’s acceptance and support of a proposed security control e.g. if users do not accept a new policy/ technology/program, it will inevitably fail most common methods for obtaining user acceptance are: communication – affected parties must know the purpose and benefits of the proposed change education – affected parties must be educated on how to work under the new constraints involvement – affected parties must be given a chance to express what they want and what they will tolerate from the system
Technical Feasibility
– determine whether organization has or can acquire technology and/or necessary technical expertise to implement and support a control e.g. use of VPN may require special software hardware support / installation on all computers
Political
– determines what can and cannot be done based on consensus and relationship between different departments … IT and Info. Sec. department might have to compete for same resources Feasibility
Relative Risk Analysis
Rather than using quantitative or qualitative risk analysis
an organization may resort to relative risk analysis of a
control, including:
• Benchmarking – study practices used in other
organizations that obtain results
you would like to duplicate
• Due Care or – implement a minimum level of
security
failure to maintain a standard of due
care can open an organization to legal
liability – especially important if dealing
with customer data
Benchmarking
study practices used in other
organizations that obtain results
you would like to duplicate
Due Care or Due Diligence
implement a minimum level of security failure to maintain a standard of due care can open an organization to legal liability – especially important if dealing with customer data
• Best Practices – implement entire set of security
controls as recommended for your
industry / general public
‘best practices’ according to Microsoft: use antivirus software use strong passwords verify your software security setting update product security build personal firewalls back up early and often protect against power surges and losses
Gold Standard
implement controls beyond best
practices – for those that strive to
be ‘the best of the best’
Cryptography
process/technique(s) of converting
data into unintelligible form in order to ensure:
confidentiality, data integrity, and authentication
requirement 1: no data should be lost during encryption
requirement 2: decryption should ensure perfect data
recovery
plaintext
original message that should be ‘protected’
encryption algorithm
performs various substitutions,
permutations and transformations on plaintext
key
variable data that is input into encryption algorithm
together with plaintext
determines exact substitutions, permutations and
transformations performed on plaintext
