• Module:7 – Application Security

– Security Architectures and Models- Email security-

PGP and SMIME, Web Security, Database Security-
Wireless Network Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 1

 Vulnerable Software
• Buffer overflows
• Insecure running environment
• Insecure temporary files
• Insecure program calls
• Weak encryption
• Poor programming
• “If people built buildings the way that programmers
write software, the first woodpecker to come along
would destroy civilization.”

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95-752:8-2

 Handling Vulnerabilities
• Locating
• Dealing with vendors
• Applying patches
• Disabling services
• Reconfiguring software/services

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95-752:8-3

 Viruses
• Pieces of code that attach to existing programs
• Not distinct program
• No beneficial use – VERY destructive
• Countermeasures
– Virus detection/disinfection software

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95-752:8-4

 Structure of a Virus
• Marker: determine if a potential carrier
program has been previously infected
• Infector: Seeks out potential carriers and
infects
• Trigger check: Establishes if current conditions
are sufficient for manipulation
• Manipulation: Carry out malicious task

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95-752:8-5

 Types of Viruses
• Memory-resident
• Hardware
• Buffered
• Hide-and-seek
• Live-and-die
• Boot segment
• Macro

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95-752:8-6

 Worms
• Stand-alone programs that copy
themselves from system to system
• Some use in network computation
• Examples:
– Dolphin worm (Xerox PARC)
– Code Red (2001, $12B cost)
– Morris Worm (1988, $20M cost)
• Countermeasures
– Sandboxing
– Quick patching: fix holes, stop worm

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95-752:8-7

 Trojan Horses
• Programs that have malicious covert purpose
• Have been used for license enforcement
• Examples:
– FIX2001
– AOL4FREE
– RIDBO
• Countermeasures
– Sandboxing
– Code reviews

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95-752:8-8

 Greedy Programs

• Programs that copy themselves

• Core wars
• Have been used in destructive web pages,
standalone programs
• Can be very difficult to show deliberate usage
• Countermeasures:
– CPU quotas on process families
– Process quotas
– Review of imported software & web pages

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95-752:8-9

 Bot Networks
• Collections of compromised machines
• Typically, compromised by scripts
• Respond to commands, perhaps encrypted
• Examples:
Leaves
Code Red II
• Countermeasures: Vul patching, Integrity
checks

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95-752:8-10

 Cyber Security
• Security traditionally has been about CIA (Confidentiality, Integrity, Availability)
• Security now also includes areas like Trustworthiness, Quality, Privacy
• Dependability includes Security, Reliability and Fault Tolerance
• Initially the term used was Computer Security (Compusec); it then evolved into
Infosec – Information security – to include data and networks – now with web its
called Cyber Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 11

 C. I.A.
• Confidentiality: Preventing from unauthorized disclosure
• Integrity: Preventing from unauthorized modification
• Availability: Preventing denial of service

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 12

 Security Architecture and Design
• Computer Architecture
• Systems Architecture
• Security Models
• Security Modes of Operation
• Systems Evaluation Methods
• Open vs. Closed Systems
• Enterprise Architecture
• Security Threats

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 13

 Physical and Environmental Security
• What is Physical Security
• Planning Process
• Protecting assets
• Internal Support Systems
• Perimeter Security
• Other aspects

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 14

 Telecommunications and Network
Security
• Open Systems Interconnection Reference Model
• TCP/IP
• Types of Transmission
• LAN Networking
• Routing Protocols
• Networking Devices
• Networking services and protocols
• Intranets and Extranets
• Metropolitan Area networks
• Remote access
• Wireless technologies
• Rootkits

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 15

 Cryptography
• History, Definitions and Concepts
• Types of Ciphers
• Methods of Encryption
• Type of Asymmetric Systems
• Message Integrity
• PKI
• Key Management
• Link / End-to-end Encryption
• Email standards
• Internet security
• Attacks

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 16

 Legal Regulation and Compliance
Investigation
• Cyber law and Cyber crime
• Intellectual property law
• Privacy
• Liability and Ramifications
• Digital Forensics and Investigations
• Ethics

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 17

 Applications Security
• Database Security
• Software and applications security issues
• Secure systems development
• Application development and security
• Object-oriented systems and security
• Distributed computing and security
• Expert systems and security
• Web security
• Mobile code
• Patch management

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 18

 Operations Security
• Role of the Operations Department
• Administrative Management
• Assurance Levels
• Configuration management
• Media Controls
• Data Leakage
• Network and Resource Availability
• Mainframes
• Email Security
• Vulnerability testing

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 19

 Information Governance and Risk
Management
• Security Management, Administration and Governance
• Policies, Standards, Guidelines, Procedures
• Information Classification
• Roles and Responsibilities
• Risk Management and Analysis
• Best Practices

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 20

 Roles and Responsibilities
• Internal Roles
– Executive Management; Information System Security Professionals; Owners:
Data and System Owners; Custodians
– Operational Staff; Users; Legal, Compliance and Privacy Officers; Internal
Auditors; Physical Security Officers
• External Roles
– Vendors and Supplies; Contractors; Temporary Employees; Customers;
Business Partners; Outsourced Relationships; Outsourced Security
• Human Resources
– Employee development and management; Hiring and termination; Signed
employee agreements; Education

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 21

 Risk Management and Analysis
• Risk is the likelihood that something bad will happen that causes harm to an
informational asset (or the loss of the asset). A vulnerability is a weakness that
could be used to endanger or cause harm to an informational asset. A threat is
anything (man made or act of nature) that has the potential to cause harm.
• The likelihood that a threat will use a vulnerability to cause harm creates a risk.
When a threat does use a vulnerability to inflict harm, it has an impact. In the
context of information security, the impact is a loss of availability, integrity, and
confidentiality, and possibly other losses (lost income, loss of life, loss of real
property). It should be pointed out that it is not possible to identify all risks, nor is
it possible to eliminate all risk. The remaining risk is called residual risk.

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 22

 Risk Managementg and Analysis
• A risk assessment is carried out by a team of people who have knowledge of
specific areas of the business. Membership of the team may vary over time as
different parts of the business are assessed.
• The assessment may use a subjective qualitative analysis based on informed
opinion (scenarios), or where reliable dollar figures and historical information is
available, the analysis may use quantitative analysis
• For any given risk, Executive Management can choose to accept the risk based
upon the relative low value of the asset, the relative low frequency of occurrence,
and the relative low impact on the business. Or, leadership may choose to mitigate
the risk by selecting and implementing appropriate control measures to reduce the
risk. In some cases, the risk can be transferred to another business by buying
insurance or out-sourcing to another business.

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 23

 Risk Management and Analysis
• Identification of assets and estimating their value. Include: people, buildings,
hardware, software, data supplies.
• Conduct a threat assessment. Include: Acts of nature, accidents, malicious acts
originating from inside or outside the organization.
• Conduct a vulnerability assessment, and for each vulnerability, calculate the
probability that it will be exploited. Evaluate policies, procedures, standards,
training, physical security, - - -
• Calculate the impact that each threat would have on each asset. Use qualitative
analysis or quantitative analysis.
• Identify, select and implement appropriate controls. Provide a proportional
response. Consider productivity, cost effectiveness, and value of the asset.
• Evaluate the effectiveness of the control measures. Ensure the controls provide
the required cost effective protection without discernible loss of productivity.

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 24

 Security Architectures and Models

• The security architecture of an information

system is fundamental in enforcing an
organization’s information security policy.

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 25

 Security Architectures and Models

• The Security Architecture of the OSI

Reference Model (ISO 7498-2) considers five
main classes of security services
1. Authentication
2. Access control
3. Confidentiality
4. Integrity
5. Non-repudiation

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 26

 Security Architectures and Models

• An important concept in the design and analysis of secure

systems is the security model, because it incorporates the
security policy that should be enforced in the system.
• A model is a symbolic representation of a policy.
• It maps the desires of the policy makers into a set of rules that
are to be followed by a computer system.
• Security policy represents the objectives and goals a system
must meet and accomplish to be deemed secure and
acceptable.

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 27

 Security Architectures and Models

• Email Security
• Web Security
• Database Security
• Wireless Network Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 28

 Email Security
• Email is one of the most widely used and regarded
network services
• Currently message contents are not secure
– May be inspected either in transit
– Or by suitably privileged users on destination system

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 29

 Email Security

• Confidentiality
– Protection from disclosure
• Authentication
– Of sender of message
• Message integrity
– Protection from modification
• Non-repudiation of origin
– Protection from denial by sender

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 30

 Email Security

• Encrypt and decrypt email

• Authenticate messages with digital signatures

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 31

 Pretty Good Privacy (PGP)
• widely used de facto secure email
• developed by Phil Zimmermann
• selected best available crypto algs to use
• integrated into a single program
• available on Unix, PC, Macintosh and Amiga
systems
• originally free, now have commercial versions
available also
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 32
 Summary of PGP Services

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 33

 PGP Operation – Authentication
1. sender creates a message
2. SHA-1 used to generate 160-bit hash code of
message
3. hash code is encrypted with RSA using the sender's
private key, and result is attached to message
4. receiver uses RSA or DSS with sender's public key to
decrypt and recover hash code
5. receiver generates new hash code for message and
compares with decrypted hash code, if match,
message is accepted as authentic

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 34

 PGP Operation – Confidentiality
1. sender generates message and random 128-bit
number to be used as session key for this message
only
2. message is encrypted, using CAST-128 / IDEA/3DES
with session key
3. session key is encrypted using RSA with recipient's
public key, then attached to message
4. receiver uses RSA with its private key to decrypt and
recover session key
5. session key is used to decrypt message

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 35

 PGP Operation – Confidentiality &
Authentication
• uses both services on same message
– create signature & attach to message
– encrypt both message & signature
– attach RSA encrypted session key

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 36

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 37
 PGP Operation – Compression
• by default PGP compresses message after
signing but before encrypting
– so can store uncompressed message & signature
for later verification
– & because compression is non deterministic
• uses ZIP compression algorithm

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 38

 PGP Operation – Email Compatibility
• when using PGP will have binary data to send
(encrypted message etc)
• however email was designed only for text
• hence PGP must encode raw binary data into
printable ASCII characters
• uses radix-64 algorithm
– maps 3 bytes to 4 printable chars
– also appends a CRC
• PGP also segments messages if too big
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 39
 PGP Session Keys
• need a session key for each message
– of varying sizes: 56-bit DES, 128-bit CAST or IDEA,
168-bit Triple-DES
• uses random inputs taken from previous uses
and from keystroke timing of user

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 40

 PGP Public & Private Keys
• since many public/private keys may be in use,
need to identify which is actually used to
encrypt session key in a message
– could send full public-key with every message
– but this is inefficient
• rather use a key identifier based on key
– is least significant 64-bits of the key
– will very likely be unique

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 41

 PGP Key Rings
• each PGP user has a pair of keyrings:
– public-key ring contains all the public-keys of
other PGP users known to this user, indexed by
key ID
– private-key ring contains the public/private key
pair(s) for this user, indexed by key ID & encrypted
keyed from a hashed passphrase

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 42

 S/MIME (Secure/Multipurpose Internet
Mail Extensions)
• S/MIME is an acronym for Secure/Multipurpose Internet Mail
Extensions. It references a type of public encryption and
signing of MIME data to verify a sender’s identity. With
S/MIME, it is possible to send and receive encrypted emails.
• security enhancement to MIME email
– original Internet RFC822 email was text only
– MIME provided support for varying content types and
multi-part messages
– S/MIME added security enhancements

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 43

 S/MIME Functions
• In terms of general functionality, S/MIME is
very similar to PGP. Both offer the ability to
sign and/or encrypt messages.

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 44

 Functions
• S/MIME provides the following functions.

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 45

 S/MIME Cryptographic Algorithms
• hash functions: SHA-1 & MD5
• digital signatures: DSS & RSA
• session key encryption: ElGamal & RSA
• message encryption: Triple-DES, RC2/40, AES

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 46

Web Security
Secure yourself on the web
 Web Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 48

 Web Security

• Hacker
• Viruses
• Worms
• Trojan Horses
• Key lockers
• Firewall,…
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 49
 Web Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 50

 Web Security
Firewall
 Web Security
• Web now widely used by business,
government, individuals
• but Internet & Web are vulnerable
• have a variety of threats
– integrity
– confidentiality
– denial of service
– authentication
• need added security mechanisms

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 52

 Web Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 53

 Web Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 54

 Web Security
Phishing
 Web Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 56

 Web Security
• DoS

• DDoS

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 57

 Web Security

• Solution

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 58

 Web Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 59

 Web Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 60

 Databases
• Collection of
– Interrelated data and
– Set of programs to access the data
• Convenient and efficient processing of data
• Database Application Software

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 61

 Database Security
• Database security refers to the range of tools,
controls, and measures designed to establish and
preserve
– Database confidentiality
– Integrity
– Availability

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 62

 Security Objectives
Prevent/detect/deter improper
Disclosure of information

Prevent/detect/deter Secrecy
Improper modification
of information

Integrity Availability

Prevent/detect/deter improper
Denial of access to services

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 63

 Database Security

Need:
• Data will be easily corrupted
• Restrict access to database from
unauthorized users

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 64

 Database Security
• Protect Sensitive Data from
– Unauthorized disclosure
– Unauthorized modification
– Denial of service attacks

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 65

 Database Security
Confidentiality
 Database Security

Integrity
 Database Security
Availability
 Database Security
• Security Controls
• Security Policy
• Access control models
• Integrity protection
• Privacy problems
• Fault tolerance and recovery
• Auditing and intrusion detection

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 69

 Access Control
 Ensures that all direct accesses to object are
authorized

 Protects against accidental and malicious

threats by regulating the read, write and
execution of data and programs

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 70

 Access Control

Requires:
- Proper user identification
- Information specifying the access rights
is protected form modification

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 71

 Access Control Policies

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 72

 Discretionary Access Control (DAC)
 Grant and Revoke

 Problems:

- Propagation of access rights

- Revocation of propagated access rights

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 73

 DAC by Grant and Revoke

GRANT SELECT ON Employee GRANT SELECT ON Employee

TO Black TO Red
WITH GRANT OPTION Black Red
?
Brown revokes grant
given to Black
?
Brown does not want
Brown (owner) Red to access the
Employee relation
GRANT UPDATE(Salary) ON
Employee TO White

White
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 74
 Access Control Mechanisms

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 75

 Security Through Views

 Assign rights to access predefined views

CREATE VIEW Outstanding-Student
AS SELECT NAME, COURSE, GRADE
FROM Student
WHERE GRADE > B

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 76

 Stored Procedures

P
P
w

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 77

 Grant and Revoke

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 78

 Grant and Revoke

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 79

 Non-cascading Revoke
B E
A D

C F
A revokes D’s privileges
B E

C F

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 80

 Cascading Revoke
B E
A D

C F
A revokes D’s privileges
B
A

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 81

Positive and Negative Authorization

-
B E
+
+ D
A

- Problem:
Contradictory authorizations
C
• GRANT <privilege> ON X TO <user>
• DENY <privilege> ON X TO <user>

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 82

 Negative Authorization
-
B E
+ -
+ D
A
+
-
C F

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 83

 Query Modification

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 84

 Database
Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 85

 Relational Databases
• Constructed from tables of data
– Each column holds a particular type of data
– Each row contains a specific value
– Ideally has one column where all values are
unique, forming an identifier/key for that row
• Has multiple tables linked by identifiers
• Use a query language to access data items
meeting specified criteria

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 86

 Relational Database Elements
• relation / table / file
• tuple / row / record
• attribute / column / field
• primary key
– uniquely identifies a row
• foreign key
– links one table to attributes in another
• view / virtual table
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 87
 Relational Database
Elements

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 88

 Database Access Control
• DBMS provide access control for database
• Assumes that user has been authenticated
• DBMS provides specific access rights to portions of
the database
– e.g. create, insert, delete, update, read, write
– to entire database, tables, selected rows or columns
– possibly dependent on contents of a table entry
• can support a range of policies:
– centralized administration
– ownership-based administration
– decentralized administration
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 89
 SQL Access Controls
• two commands:
– GRANT { privileges | role } [ON table] TO { user | role |
PUBLIC } [IDENTIFIED BY password] [WITH GRANT
OPTION]
• e.g. GRANT SELECT ON ANY TABLE TO ricflair
– REVOKE { privileges | role } [ON table] FROM { user |
role | PUBLIC }
• e.g. REVOKE SELECT ON ANY TABLE FROM ricflair
• typical access rights are:
– SELECT, INSERT, UPDATE, DELETE, REFERENCES

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 90

 Inference

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 91

 Inference Example

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 92

 Inference Countermeasures
• Inference detection at database design
– Alter database structure or access controls
• Inference detection at query time
– By monitoring and altering or rejecting queries
• Need some inference detection algorithm
– A difficult problem
– Much current research on this aspect of security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 93

 Protecting Against Inference

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 94

 Database
Encryption
• Databases typical a valuable info resource
– Protected by multiple layers of security: firewalls,
authentication, O/S access control systems, DB access
control systems, and database encryption
• Can encrypt
– Entire database - very inflexible and inefficient
– Individual fields - simple but inflexible
– Records (rows) or columns (attributes) - best
• Also need attribute indexes to help data retrieval
• Varying trade-offs
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 95
 Database
Encryption

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 96

 SQL
Injection
• SQL injection
– Most common threat to database system
• Other common threats
– Unauthorized privilege escalation
– Privilege abuse
– Denial of service
– Weak authentication

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 97

Wireless Network Security

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 98

 Why Wireless is Insecure?
 Channel: Broadcast  Eavesdropping, Jamming, Active
attacks on protocols
 Mobility: Portable devices  Not physically secured
 Resources: Limited memory and processing resources
 Need simpler security
 Accessibility: May be left unattended

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 99

 Wireless Network Threats
1. Accidental Association: Overlapping networks
 unintentionally connect to neighbors
[Link] Association: Malicious access points (Free public
WiFi) can steal passwords
3. Ad-Hoc Networks: Two computers can exchange data
4. Nontraditional Networks: Bluetooth can be used to eavesdrop
[Link] Spoofing: Change MAC address to match a privileged
computer
[Link]-In-The-Middle Attacks: Using rogue access point
between the user and the real access point
7. Denial of Service (DoS): Keep the media busy
8. Network Injection: Spoof routing/management messages
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 100
 Countermeasures
 Turn-off SSID broadcast
 Use Cryptic SSID names
 Reduce signal strength
 Locate APs away from boundary
 Use encryption
 Use IEEE 802.1x network access control
 Change the router’s user ID from default
 Change the router’s password from default
 MAC Filtering: Only specific MAC address connect

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 101

 Mobile Device Security
Mobile  Dynamic/no boundary  Cloud
1. Lack of Physical security: Mobiles cannot be locked
2. Not all devices can be trusted
3. Untrusted networks between device and the organization
4. Wide variety of contents on mobiles than on other computers
(music, video, games, …)
5. Apps from untrusted vendors
6. Data may get on unsecured device
7. Location information may be used for attack

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 102

 Wi-Fi Operation

Station Access Point

 Access Points (APs) periodically broadcast a beacon with SSID
(service set ID) and security level
 Subscriber stations listen to these beacons, measure signal
strength and determine which AP to join
 Subscribers can also send a “Probe” to find AP’s in the
neighborhood
 AP authenticates the subscriber station using shared keys
 Subscriber stations and AP exchange encrypted packets
 Subscriber station send a “Disassociate” message and log off

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 103

 IEEE 802.11 Architecture
Server
Distribution System
IBSS
Access Access Ad-hoc
Point Point Station
Station
Ad-hoc
Station Station Station
Station
Basic Service Set 2nd BSS Ad-hoc
network
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 104
 IEEE 802.11 Architecture
 Basic Service Area (BSA) = Cell
 Each BSA may have several access points (APs)
 Basic Service Set (BSS)
 = Set of stations associated with one AP
 Distribution System (DS) - wired backbone
 Extended Service Area (ESA) = Multiple BSAs interconnected
via a distribution system
 Extended Service Set (ESS)
 = Set of stations in an ESA
 Independent Basic Service Set (IBSS): Set of computers in ad-
hoc mode. May not be connected to wired backbone.
 Ad-hoc networks coexist and interoperate with infrastructure-
based networks
Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 105
 IEEE 802.11 Services
 Association: A STA connecting with an AP.
 Disassociation: Termination of association.
 Re-association: Transfer of association from one AP to
another. Mobility within BSS, within ESS, between two ESSs.
 MSDU Delivery: Interchange of packets between STAs
 Distribution: Delivery of packets between STAs possibly via
the backbone distribution system
 Integration: Interchange of packets between STAs and wired
stations connected to LANs on the distribution system
 Authentication: The station is authenticated
 De-authentication
 Privacy: Encryption

Sunday, April 9, 2023 Instructor: Dr. Kovendan AKP 106