COMPUTER SECURITY
Computer security
Preface
This guide will introduce you to some important techniques of computer security
including:
passwords and identification
encryption
access controls
symmetric key cryptosystems
asymmetric key cryptosystems
digital signatures
key management
hash functions
internet protocols.
Chapter 1
Security
1.1 Introduction
In this chapter, we will introduce the notion of computer security, provide some basic
definitions and discuss the features that a good security system should provide.
Supplementary reading
Chapter 1 of Computer security by Gollmann gives a good introduction to the notion of computer security.
Part 1 of Secrets and Lies by Schneier is easy to read and puts computer security into context.
After studying this chapter and the additional reading, you should be able to:
Recognise the need for computer security and describe how computer security
differs from security in the traditional sense.
Define what is meant by the terms integrity, availability, non-repudiation,
authentication, accountability and access control with regards to computer
security.
Discuss the various types of attack that may threaten a security system.
Discuss the many design considerations to take into account when designing a
security system.
1.2 What is security?
In the broadest sense security can be defined as the protection of assets. There are
three main aspects to security:
prevention
detection
reaction.
Consider security in the traditional sense – for example, securing your house against
burglary. You may take steps to prevent a burglary such as locking the doors and
windows and installing a burglar alarm. If a burglary did occur, you would be able to
detect this because items would be missing and the burglar may have caused
damage to your house while breaking in. You might react to the burglary by
reporting it to the police, working out what had been stolen and making an
insurance claim.
1
Computer security
1.2.1 How is information security different?
Although the definition of security given above still applies when we are talking
about information, there are some major differences between traditional security
and information security.
Information can be stolen – but you still have it.
If a physical item such as a car is stolen then the thief has possession of the car
and you no longer have it. If a thief steals a file from your computer, he will
probably make a copy of the file for himself and leave the original on your
computer. Hence you still have the file but it has also been stolen.
Confidential information may be copied and sold – but the theft might not be
detected.
If your car has been stolen it is not hard to detect the fact – the car is missing!
However as mentioned above, a thief who steals computer files may leave the
files on your computer and only copy them for himself. Nothing appears to have
changed on your computer so you may not be aware that anything untoward has
happened.
The criminal may be on the other side of the world.
If a thief steals your car you at least know where he was when he stole the car.
However, it is possible to hack into computer systems remotely from anywhere
in the world. This makes it very hard to know who is responsible for catching a
computer criminal. Is it the police in the country where the computer is, or the
police in the country where the criminal is?
Although there is no single definition of computer security, we can say that:
Computer security deals with the prevention and detection of
unauthorised actions by users of a computer system.
This subject deals with the theory of computer security. You should be aware that
unfortunately things that are great in theory do not always work in practice. As
Schneier says in Secrets and Lies:
Theory works best in ideal conditions and laboratory settings. We can design
idealised operating systems that are provably secure, but we can’t actually build
them to work securely in the real world. The real world involves design trade-offs,
unseen variables and imperfect implementations.
Schneier kept a log of ‘security events’ for the first week of March 2000. He recorded
approximately 100 events during this time including hackers launching
denial-of-service attacks, leakage of personal data from supposedly secure websites,
email worms and viruses, and websites being defaced. Most of these attacks and
vulnerabilities were the result of the perpetrator bypassing the security mechanism,
or exploiting a weakness in the system such as an overflowing buffer.
2
Features of a security system
Learning activity
The following cartoon by Randall Munroe is taken from [Link].
Note: This work is licensed under a Creative Commons Attribution Non-Commercial 2.5 License.
Do an Internet search on SQL injection vulnerabilities to find out why this is funny!
1.3 Features of a security system
In order to prevent and detect unauthorised actions by its users a good security
system should provide (some of) the following features:
confidentiality
integrity
availability
non-repudiation
authentication
access controls
accountability.
We will look at each of these features in turn. Note that different authors on
computer security disagree as to which of these features are the most important. It
will depend on the main purpose of the system – is confidentiality paramount or is
the prevention of denial of service attacks more important? This will depend on the
system in question. For example a computer system which holds personal medical
records must certainly provide access controls in order to ensure that personal
information does not fall into the wrong hands, and integrity to ensure that the
information stored is accurate. Other features such as non-repudiation and
availability may not be so important in this case. On the other hand, it is essential
for a computer system which transfers money electronically to guarantee
non-repudiation and accountability in order to prevent and/or detect dishonest
transactions occurring.
In this context, the term unauthorised implies not only malicious or criminal, but
could also be accidental. For example, a breach of confidentiality arises maliciously
if a spy deliberately hacks into a computer and looks at confidential material stored
there. It happens accidentally if the material is left out on a desk and is seen by the
office cleaner.
3
Computer security
1.3.1 Confidentiality
Confidentiality is the prevention of unauthorised disclosure of information.
In other words, confidentiality means keeping information private or safe.
Confidentiality may be important for military, business or personal reasons.
Confidentiality may also be known as privacy or secrecy.
1.3.2 Integrity
Integrity is the prevention of unauthorised writing or modification of information.
Integrity in a computer system means that there is an external consistency in the
system – everything is as it is expected to be. Data integrity means that the data
stored on the computer is the same as what is intended.
1.3.3 Availability
Availability is the prevention of unauthorised with-holding of information.
Information should be accessible and usable upon appropriate demand by an
authorised user. Denial of service attacks are a common form of attack against
computer systems whereby authorised users are denied access to the computer
system. Such an attack may be orchestrated by the attacker flooding the system with
requests until it cannot keep up and crashes. Authorised users are unable to access
the system. Consider the damage that such an attack may cause to an electronic
commerce site such as an internet shop.
1.3.4 Non-repudiation
Non-repudiation is the prevention of either the sender or the receiver denying a
transmitted message.
A computer security system must be able to prove that certain messages were sent
and received, who sent the message, who received the message and perhaps what
the message said. For example, suppose a dishonest trader sends an electronic
message to a stock broker telling him to buy £2,000 worth of shares in CryptoCom.
The next day the price of CryptoCom shares soars. The trader now pretends that his
original message said to buy £20,000 worth of shares. Conversely if the share price
fell he might pretend that the original message said to buy shares in KryptoCom
instead. Non-repudiation means that the trader is not able to deny his original
message.
Non-repudiation is often implemented by using digital signatures (see section 7.3).
4
Security attacks
1.3.5 Authentication
Authentication is proving a claim – usually that you are who you say you are, where
you say you are, at the time that you say it is.
Authentication may be obtained by the provision of a password or by a scan of your
retina for example. See Chapter 2 for further methods of authentication.
1.3.6 Access controls
Access controls provide the limitation and control of access to authorised users
through identification and authentication.
A system needs to be able to identify and authenticate users for access to data,
applications and hardware. In a large system there may be a complex structure
determining which users and applications have access to which objects. See
Chapter 3 for further details on access control models.
1.3.7 Accountability
Accountability means that the system is able to provide audit trails of all transactions.
The system managers are accountable to scrutiny from outside the system and must
be able to provide details of all transactions that have occurred. Audit trails must be
selectively kept (and protected to maintain their integrity) so that actions affecting
security can be traced back to the responsible party.
Learning activity
Consider the following scenario and think about the questions at the end.
A student suspects there is a vulnerability on a system in a university public access laboratory. She tests
this by trying to exploit the vulnerability. She succeeds, and obtains privileges that she would not normally
have. She reports both the hole and her exploiting it to the system staff, who in turn report it to the manager
of the laboratory. The manager files charges of breaking into the computing system against the student.
The student has to appear before the Student Judicial Authority – she is in trouble!
1. Did the student act ethically by testing the system for the security hole before reporting it?
2. Did the manager act ethically by filing charges against the student?
3. The manager told the system staff not to bother fixing the hole, because the action taken by the SJA
would deter any further break-ins through the hole. Was the manager’s action appropriate?
1.4 Security attacks
There are a number of ways in which an attacker can disrupt communications.
Normally, information goes from the source to the destination.
5
Computer security
Source Destination
Communication is interrupted if the attacker does not allow the information to reach
the destination.
Source Destination
Attacker
Communication is intercepted if the attacker interrupts the communication and
receives the source information.
Destination
Modification occurs when the attacker intercepts the communication, alters it in
some way, and then sends it on to the destination. The attacker intends to deceive
the destination into thinking that the modified communication has come directly
from the source. This is also known as a Man-in-the-middle attack.
An attacker may also make up a communication and send it to the destination
pretending that it has come from the source. This is called fabrication.
Source
1.5 Security systems
A computer security system is not just a computer package. It also requires security
conscious personnel who respect the procedures and their role in the system. For
example, an access control system may be rendered worthless by employee Fred
Smith who chooses user-name Fred and password Smith and therefore leaves the
system open to abuse by password hackers (see section 2.3.1). Conversely, a good
security system should not rely on personnel having security expertise.
6
Security systems
1.5.1 Risk analysis
When designing or implementing a computer security system it is very important to
bear in mind the level of risk involved and the value of the information that is to be
protected. As an illustration, consider that you may be willing to leave £50 in a
changing room locker, but you would not be likely to leave £5,000 unattended. You
would assess the risk involved before deciding whether to leave the money or not.
On the other hand, it would be foolish to pay someone, say £20, to look after your
£50, but this might be a good investment in the case of the £5,000 (assuming that
you totally trust the person charged with keeping your money safe of course!).
In terms of computer security, the disadvantages of security systems are that they are
time consuming, costly, often clumsy, and impede management and the smooth
running of the system. Risk analysis is the study of the cost of a particular system (in
terms of effort and time as well as cost) against the benefits of the system (the level
of security offered).
Learning activity
Think about your own circumstances and where you might be affected by computer security. For example,
do you use a password or PIN for any purpose? Are there medical or employment records about you? What
features of a security system are involved with each example?
Consider a computer system that you are familiar with; for example, perhaps you have a networked system
where you work or study, or a PC at home that is used by more than one person. How good is the security
of the system? How easy is it to access other people’s files or to read their emails? How difficult would it be
to add extra security to the system?
1.5.2 Design considerations
There are a number of questions which need to be considered when designing a
security system. We will pose five design questions here. See Gollmann, Chapter 1
for further discussion of these questions.
Does the system focus on the data, operations or users of the system?
For example, is it more important to have a data focused rule such as: Only data
of type A can be inserted in data box A or a user focused rule such as: Only section
managers are able to access the information in data box A?
What level should the security system operate from?
The security system may consist of a software package that runs on top of the
operating system, such as Norton Internet Security which runs on top of
Windows. Alternatively, it may be part of the hardware and have physical
control over the data such as where it is stored and how it is manipulated, for
example Security Enhanced Linux (SELinux).
Should the security system be simple or sophisticated?
As discussed above, there are disadvantages to having a security system, not
least in terms of time and cost. The more sophisticated a system the costlier it is
likely to be. On the other hand, a system which is too simple may not provide
the necessary level of security. It is obviously not a good idea to spend millions
7
Computer security
of dollars on a state of the art security system which is to be used to protect data
that is not of high importance or value.
In a distributed system should the security be centralised or spread?
Should a security manager have ultimate control, for example over access
control issues (this will make it easier to achieve a consistent and rigorous
approach, but may cause time delays if the security manager has to be applied to
for every change of access rights)? Alternatively, should individual users be
allowed to choose who has access to their files? See section 3.3.3 for a
description of how SELinux implements mandatory access control.
How do you secure the levels below the level of the security system?
An attacker may manage to gain access to the operating system and from there
make alterations to access control limitations giving themselves access to other
parts of the system. The logical access controls of the system may be by-passed
by gaining direct access to the physical memory. It is therefore important to
ensure that physical security measures are in place as well as the logical
computer security mechanisms.
1.6 Security models
Computer security protects the computer system and the data it processes. Success
depends on the implementation of security controls designed for the system. A
security model is a means of formally expressing the rules of the security policy. The
model should:
be easy to comprehend
be without ambiguity
be possible to implement
reflect the policies of the organisation.
Different systems require different models. We will look at the theoretical
Bell-LaPadula security model and the practical Unix security model in Chapter 3.
Learning activity
Do an Internet search for some examples of definitions of security concepts. A good starting point is the
web site of the UK National Technical Authority for Information Assurance:
[Link] Other governments have similar sites, and many major IT companies
also have pages discussing security.
1.7 Summary
In this chapter we have introduced some important concepts and definitions
regarding computer security. We have discussed features that a computer security
system may provide including confidentiality, integrity, availability, non-repudiation,
authentication, accountability and access controls. We have also looked at the
different ways in which an attacker may threaten a security system including
8
Sample examination questions
interrupting, intercepting, modifying and fabricating communications. We have
discussed the many design questions that need to be taken into account when
designing a security system.
1.8 Learning outcomes
After studying this chapter and the additional reading, you should be able to:
Recognise the need for computer security and describe how computer security
differs from security in the traditional sense.
Define what is meant by the terms integrity, availability, non-repudiation,
authentication, accountability and access control with regards to computer
security.
Discuss the various types of attack that may threaten a security system.
Discuss the many design considerations to take into account when designing a
security system.
1.9 Sample examination questions
Question 1
a) The following are seven features that may be provided by a security system. For
each write a sentence describing what is meant by the feature:
i. confidentiality
ii. integrity
iii. availability
iv. non-repudiation
v. authentication
vi. access control
vii. accountability.
[7]
b) A University department has a file called exam marks which contains a list of
examination marks indexed by student names in alphabetical order. A student
manages to access the exam marks file. The student cannot read the file since it
is encrypted. However they can work out the position of their own mark making
use of the fact that the students are listed in alphabetical order. The student
swaps their mark with that of the student who is always ‘top of the class’.
Write a paragraph discussing which of the security features listed in part a) have
been breached.
[5]
9
Sample examination questions
Question 2
Three aspects of security are prevention, detection and reaction. Write a paragraph
explaining why methods used for the prevention of, detection of and reaction to,
theft of physical property may not be appropriate when the crime involves the theft
of digital information.
[6]