AMBO UNIVERSITY

SCHOOL OF TECHNOLOGY AND INFORMATICS

DEPARTMENT OF COMPUTER SCIENCE

Computer Security Module (Course Code: (COSC4171)) DISTANCE

EDUCATION COORDINATION OFFICE (DECO)

Prepared By:Mr. Diriba Merera ([Link].)

August 2024 G.C

Ambo, Ethiopia
Table contents
TABLE CONTENTS........................................................................................................................................... I
COURSE DESCRIPTION................................................................................................................................... 1
COURSE GOALS OR LEARNING OUTCOMES.................................................................................................... 1
CHAPTER ONE............................................................................................................................................... 2
INTRODUCTION............................................................................................................................................. 2
1.1. TERMINOLOGY.................................................................................................................................. 3
1.2. KEY SECURITY CONCEPTS............................................................................................................................3
1.3. THREAT MODELS......................................................................................................................................5
1.4. COMPUTER SECURITY TERMINOLOGIES..........................................................................................................6
1.5. THREAT CONSEQUENCES.............................................................................................................................7
1.6. SCOPE OF COMPUTER SECURITY...................................................................................................................9
1.7. SECURITY FUNCTIONAL REQUIREMENT.........................................................................................................10
1.8. SECURITY TAXONOMY..............................................................................................................................11
1.9. COMPUTER SECURITY STRATEGY................................................................................................................12
1.10. REVIEW QUESTION..................................................................................................................................13
CHAPTER TWO............................................................................................................................................ 15
BASIC CRYPTOGRAPHY................................................................................................................................ 15
2.1. INTRODUCTION............................................................................................................................... 16
2.2. BASIC CRYPTOGRAPHIC TERMS...................................................................................................................16
2.3. HISTORICAL BACKGROUND.........................................................................................................................17
2.3.1. CRYPTOGRAPHY- ORIGIN......................................................................................................................17
2.3.2. HISTORY OF CRYPTOGRAPHY.................................................................................................................17
2.4. CIPHER TECHNIQUES................................................................................................................................20
2.4.1. TRANSPOSITION (PERMUTATION) CIPHERS...............................................................................................21
2.4.2 SUBSTITUTION CIPHER..............................................................................................................................22
2.5. CONVENTIONAL ENCRYPTION ALGORITHMS...................................................................................................25
2.5.1. SYMMETRIC KEY CRYPTOGRAPHY...........................................................................................................25
[Link]. Data Encryption Standard (DES).............................................................................................................25
[Link]. Advanced Encryption Standard(AES)......................................................................................................26
2.5.2. Asymmetric Key Cryptography...................................................................................................27
[Link]. Digital Signature Standard (DSS)............................................................................................................28
[Link]. Algorithm - RSA.....................................................................................................................................28
[Link]. ElGamal.................................................................................................................................................28
2.5.3. Hash Functions...........................................................................................................................29
2.6. CRYPTANALYSIS.......................................................................................................................................30
2.7. CRYPTOGRAPHIC SYSTEMS.........................................................................................................................31
2.7.1. Symmetric key cryptography......................................................................................................31
2.7.2. Data Encryption Standard (DES)................................................................................................32
[Link]. 3DES Triple (3DES).................................................................................................................................32
[Link]. Advanced...............................................................................................................................................34
2.8. CHAPTER SUMMARY................................................................................................................................34
2.9. REVIEW OF QUESTIONS.............................................................................................................................35
CHAPTER THREE.......................................................................................................................................... 36
PROGRAM SECURITY................................................................................................................................... 36
3.1. SECURE PROGRAM..................................................................................................................................37
3.2 TYPES OF FLAWS.....................................................................................................................................38
3.2.2 Non-Malicious Program Errors.......................................................................................................38
3.2.3 Buffer Overflows.............................................................................................................................38
3.3 VIRUS AND OTHER MALICIOUS CODE..........................................................................................................40

i|Page
 3.4. KINDS OF MALICIOUS CODE.....................................................................................................................................................41
3.4 DEVELOPMENTAL CONTROLS.....................................................................................................................43
3.5 SECURITY IN...........................................................................................................................................43
3.6 USER AUTHENTICATION............................................................................................................................45
3.7. DESIGNING TRUSTED OPERATING SYSTEM....................................................................................................46
3.8. TRUSTED OPERATING SYSTEMS DESIGN.......................................................................................................48
3.8.1. Trusted System Design Elements................................................................................................49
3.9. ASSURANCE IN TRUSTED OPERATING SYSTEMS..............................................................................................50
3.10. AUTHENTICATION....................................................................................................................................53
3.11. IDENTIFICATION.......................................................................................................................................54
3.12. REVIEW QUESTIONS.................................................................................................................................55
CHAPTER FOUR................................................................................................................................................57
SECURITY DATABASE.....................................................................................................................................57
4.1. INTRODUCTION.......................................................................................................................................58
4.2. SECURITY RISKS TO DATABASE SYSTEMS......................................................................................................58
4.2.1. Malware infections.......................................................................................................................59
4.3. DATABASE SECURITY CONTROLS.................................................................................................................59
4.4. THREATS TO THE DATABASE......................................................................................................................59
4.5. PRINCIPLES OF DATABASE SECURITY.............................................................................................................60
4.6. MULTI - INSTANCE LEVEL AUTHORITIES........................................................................................................62
4.7. DATABASE AUTHORITIES...........................................................................................................................63
4.8. HOW TO PROTECT DATABASE FROM THREATS?.............................................................................................64
4.9. SECURITY PLAN IN DATABASE.....................................................................................................................65
4.10. REVIEW QUESTIONS.................................................................................................................................65
CHAPTER FIVE..................................................................................................................................................66
NETWORK SECURITY.....................................................................................................................................66
5.1. INTRODUCTION.......................................................................................................................................67
5.2. BENEFITS OF NETWORK SECURITY...............................................................................................................67
5.3. NETWORK SECURITY ISSUES.......................................................................................................................67
5.4. THREATS AGAINST NETWORKED APPLICATIONS...............................................................................................68
5.5. HOW TO STOP THIS THREAT?.....................................................................................................................69
5.6. NETWORK SECURITY VULNERABILITIES.........................................................................................................70
5.7. TCP/IP SUITE WEAKNESSES AND BUFFER FLOW...........................................................................................71
5.8. NETWORK SECURITY PROTOCOLS...............................................................................................................72
5.9. APPLICATION LAYER SECURITY...................................................................................................................72
5.9.1. Web Security..............................................................................................................................73
5.9.2. Transport Layer Security............................................................................................................73
5.9.3. Network Layer Security..............................................................................................................74
5.9.4. Link Layer Security......................................................................................................................74
5.9.5. Physical Security.........................................................................................................................75
5.10. USER AUTHENTICATION AND AUTHORIZATION..............................................................................................75
[Link]. Access Control Lists...............................................................................................................................76
[Link]. Wireless Security...................................................................................................................................76
5.11. INTRODUCTION TO SECURE NETWORK DESIGN...............................................................................................77
5.11.1. DESIGNING SECURITY INTO A NETWORK...................................................................................................78
5.11.2. Firewalls.....................................................................................................................................78
5.11.3. Intrusion Detection System.........................................................................................................83
5.12. REVIEW OF QUESTION..............................................................................................................................86
CHAPTER SIX.....................................................................................................................................................87
ADMINISTERING SECURITY..........................................................................................................................87
6.1. SECURITY PLANNING................................................................................................................................88
6.2. SECURITY PLANNING TEAM MEMBERS........................................................................................................90

ii | P a g e
 6.2.1. Assuring Commitment To a security plan...................................................................................91
6.2.2. Business Continuity Plan............................................................................................................91
6.2.3. Develop and implement a plan for the strategy.........................................................................92
6.2.4. Organizational Security Policies..................................................................................................95
6.3. PHYSICAL SECURITY..................................................................................................................................96
6.3.1. Natural Disasters.......................................................................................................................96
6.3.2. Power loss..................................................................................................................................97
6.3.3. Human vandals..........................................................................................................................97
6.4. CONTINGENCY PLANNING..........................................................................................................................98
6.4.1. Physical security backup.............................................................................................................98
CHAPTER SEVEN............................................................................................................................................100
THE ECONOMICS OF CYBERSECURITY..................................................................................................100
7.1. INTRODUCTION TO CYBER SECURITY..........................................................................................................101
7.2. IMPACTS OF CYBER SECURITY...................................................................................................................102
7.3. CYBER SECURITY POLICY.........................................................................................................................103
7.3.1. Organization Policy..................................................................................................................104
7.3.2. Employees Policy......................................................................................................................104
7.4. The Economics of Cyber Security..................................................................................................105
7.5. MAKING AN ECONOMIC CASE FOR SECURITY................................................................................................106
7.5.1. Making a Business Case...................................................................................................................106
7.5.2. Determining Economic Value...........................................................................................................107
7.6. MEASURING AND QUANTIFYING ECONOMIC VALUE......................................................................................109
7.7. The Economic Impact of Cybersecurity.........................................................................................109
7.8. MODELING THE ECONOMICS OF CYBERSECURITY..........................................................................................111
7.8.1. The Role of Organizational Culture..........................................................................................111
7.9. REVIEW QUESTIONS...............................................................................................................................113
REFERENCE................................................................................................................................................ 114

iii | P a g e
 Course Description
To familiarize students with the security issues and technologies involved in modern
information systems, including computer systems and networks and the various ways in
which information systems can be attacked and tradeoffs in protecting networks.
Course Goals or Learning Outcomes
By the end of this course, students will be able to:
 Understand the basic concepts in information security, including security
attacks/threats, security vulnerabilities, security policies, security models, and security
mechanisms
 Understand the concepts, principles and practices related to elementary cryptography,
including plain-text, cipher-text, the four techniques for crypto-analysis, symmetric
cryptography, asymmetric cryptography, digital signature, message authentication
code, hash functions, and modes of encryption operations.
 Understand issues related to program security and the common vulnerabilities in
computer programs; including buffer overflow vulnerabilities, time-of-check to time-
of- use flaws, incomplete mediation.
 Explain and compare security mechanisms for conventional operating systems,
including memory, time, file, object protection requirements and techniques and
protection in contemporary operating systems.
 Understand the basic requirements for trusted operating systems, and describe the
independent evaluation, including evaluation criteria and evaluation process.
 Describe security requirements for database security, and describe techniques for
ensuring database reliability and integrity, secrecy, inference control, and multi-level
databases.
 Describe threats to networks, and explain techniques for ensuring network security,
including encryption, authentication, firewalls, and intrusion detection.
 Explain the requirements and techniques for security management, including security
policies, risk analysis, and physical threats and controls.
Prerequisites:
Data Communications and Computer Networks (CoSc2061)

1|Page
 Chapter one
Introduction

Activity 1.1.

 What is Security?
 What is computer security?
 What is Internet security?
 Define Information security.
 Define the network security.
 Explain the main of computer security pillars.
 Define computer system security.
 Discuss the of attack.

2|Page
 1.1. Terminology
What is Security?
A state of being secure and free from danger or harm; also, the actions taken to make
someone or something secure
What is computer Security?
Definition: Computer Security protection afforded to an automated information system in
order to attain the applicable objectives of preserving the integrity, availability and
confidentiality of information system resources (includes hardware, software, firmware,
information/data, and telecommunications).
 Something that cannot be bypassed.
 Complete mediation.
 Not vulnerable to threats. Threats could be external or internal threats.
 Trust boundaries i.e Trusted Computer Base (TCB). For example, trusted computer
base could be a small chip as compared to computer that has many soft wares running on it.
What is Information security?
Protection of the confidentiality, integrity, and availability of information assets, whether in
storage, processing, or transmission, via the application of policy, education, training and
awareness, and technology.
What is network security?
A subset of communications security; the protection of voice and data networking
components, connections, and content.
1.2. Key Security Concepts
Computer security bases on three principles – CIA Trid

Figure 1.1:CIA Triad

These three concepts form what is often referred to as the CIA triad (Figure 1.1 above). The
three concepts embody the fundamental security objectives for both data and for information

3|Page
and computing services. FIPS PUB 199 provides a useful characterization of these three
objectives in terms of requirements and the definition of a loss of security in each category:
Confidentiality: Preserving authorized restrictions on information access and disclosure,
including means for protecting personal privacy and proprietary information. A loss of
confidentiality is the unauthorized disclosure of information.
Integrity: Guarding against improper information modification or destruction, and includes
ensuring information non-repudiation and authenticity. A loss of integrity is the unauthorized
modification or destruction of information.
Availability: Ensuring timely and reliable access to and use of information. A loss of
availability is the disruption of access to or use of information or an information system.
Although the use of the CIA triad to define security objectives is well established, some in
the security field feel that additional concepts are needed to present a complete picture. Two
of the most commonly mentioned are:
 Authenticity: The property of being genuine and being able to be verified and trusted;
confidence in the validity of a transmission, a message, or message originator.
 Accountability: The security goal that generates the requirement for actions of an entity
to be traced uniquely to that entity
Computer Security Challenges:
 not simple
 must consider potential attacks
 procedures used counter-intuitive
 involve algorithms and secret info
 must decide where to deploy mechanisms.
 Battle of wits between attacker/ admin
 not perceived on benefit until fails
 requires regular monitoring
 too often an after-thought
 regarded as impediment to using system
Computer security is both fascinating and complex. Some of the reasons follow:
1. Computer security is not as simple as it might first appear to the novice. The requirements
seem to be straightforward, but the mechanisms used to meet those requirements can be quite
complex and subtle.
2. In developing a particular security mechanism or algorithm, one must always consider
potential attacks (often unexpected) on those security features.

4|Page
3. Hence procedures used to provide particular services are often counterintuitive.
4. Having designed various security mechanisms, it is necessary to decide where to use them.
5. Security mechanisms typically involve more than a particular algorithm or protocol, but
also require participants to have secret information, leading to issues of creation, distribution,
and protection of that secret information.
6. Computer security is essentially a battle of wits between a perpetrator who tries to find
holes and the designer or administrator who tries to close them.
7. There is a natural tendency on the part of users and system managers to perceive little
benefit from security investment until a security failure occurs.
8. Security requires regular monitoring, difficult in today's short-term environment.
9. Security is still too often an afterthought - incorporated after the design is complete.
10. Many users / security administrators view strong security as an impediment to efficient
and user-friendly operation of an information system or use of information.
1.3. Threat Models
Threat models define the capabilities, goals and limitations of the attackers. The limitations
of the attacker are as follows:
1) Computational limitation: Attackers must have good computers that can-do calculations
very fast.
2) Bandwidth: Attackers must have good resources like bandwidth, connectivity etc.
3) Time: Attacker should complete the attack before session expires.
4) Access: It is also one of the limitations that attacker face. There could be two types of
access.
5) Remote access: Which means attacker has an account on the server.
6) Local access : which means that attacker has an account on the server which he want to
attack.
7) Knowledge of the defenses: Attacker should the knowledge of everything except the
explicitly denoted secrets like passwords, encryption keys, random no’s.
Attacker should know have the knowledge of the
 Encryption system.
 Public keys info.
 Logging system.
 Partial knowledge of the data.
 Location of the trap doors Network layout.
 Browser Source code.

5|Page
Figure 1.2: Scenario of threat model
1.4. Computer Security Terminologies

.
a) Adversary (threat agent) - An entity that attacks, or is a threat to, a system.
b) Attack -An assault on system security that derives from an intelligent threat; a deliberate
attempt to evade security services and violate security policy of a system.
c) A countermeasure is any means taken to deal with a security attack. Ideally, a
countermeasure can be devised to prevent a particular type of attack from succeeding. When
prevention is not possible, or fails in some instance, the goal is to detect the attack, and then
recover from the effects of the attack. A countermeasure may itself introduce new
vulnerabilities. In and case, residual vulnerabilities may remain after the imposition of
countermeasures. Such vulnerabilities may be exploited by threat agents representing a
residual level of risk to the assets. Owners will seek to minimize that risk given other
constraints. Countermeasure: means taken to deal with a security attack. Contain these
activities: Prevent/Detect/Recover
d) Risk - An expectation of loss expressed as the probability that a particular threat will

6|Page
exploit particular vulnerability with a particular harmful result.
e) Security Policy - A set of rules and practices that specify how a system or org provides
security services to protect sensitive and critical system resources.
f) System Resource (Asset) - Data; a service provided by a system; a system capability; an
item of system equipment; a facility that houses system operations and equipment.
g) Threat - A potential for violation of security, which exists when there is a circumstance,
capability, action, or event that could breach security and cause harm.
h) Vulnerability - Flaw or weakness in a system's design, implementation, or operation and
management that could be exploited to violate the system's security policy.
Security Vulnerabilities and Attacks
Security vulnerabilities are describe as:
 Leakage: loss of confidentiality
 Being corrupt: loss of integrity
 Become unavailable: loss of availability
Security attacks are threats being carried out. Two major types of attack:
 Passive/Active: Based on the extent to which the attack is being noticed
 Inside/Outside: Based on where the attack is originated from

1.5. Threat Consequences

Once carried out, a threat has the following potential consequences:
 Unauthorized disclosure: compromises confidentiality

7|Page
  Exposure, Interception, Inference, Intrusion
 Deception: a threat to integrity
 Masquerade, falsification, repudiation
 Disruption: a threat to availability
 Incapacitation, corruption, obstruction
 Usurpation: a threat to authenticity. Unauthorized entity controls the system
 Misappropriation, Misuse

RFC 2828 describes four kinds of threat consequences and kinds of attacks that result:
Unauthorized disclosure is a threat to confidentiality:
 Exposure: Sensitive data is directly released to an unauthorized entity.
 Interception: An unauthorized entity directly accesses sensitive data in transit.
 Inference: an unauthorized entity indirectly accesses sensitive data by reasoning from

8|Page
 characteristics or byproducts of communications.
 Intrusion: An unauthorized entity circumvents system's security protections.
Deception is a threat to either system integrity or data integrity:
 Masquerade: An unauthorized entity poses as an authorized entity.
 Falsification: False data deceives an authorized entity.
 Repudiation: An entity deceives another by falsely denying responsibility for an act.
Disruption is a threat to availability or system integrity:
 Incapacitation: Prevent/interrupt system operation by disabling a system component
 Corruption: adversely modifying system functions or data
 Obstruction: interrupts delivery of system services by hindering system operation.
Usurpation is a threat to system integrity:
 Misappropriation: unauthorized logical or physical control of a system resource.
 Misuse: Causes system to perform a function or service detrimental to security.
1.6. Scope of Computer Security

Figure 1.3
1 As mentioned, the assets of a computer system can be categorized as hardware, software,
data, and communication lines and networks. We briefly describe these four categories and
relate these to the concepts of integrity, confidentiality, and availability, as illustrated here in
Figure 1.3.
Hardware - A major threat = is the threat to availability. Hardware is the most vulnerable to
attack and the least susceptible to automated controls. Threats include accidental and
deliberate damage to equipment as well as theft. Theft of CDROMs and DVDs can lead to
loss of confidentiality. Physical and administrative security measures are needed to deal with
these threats.
Software - includes the operating system, utilities, and application programs. A key threat is
an attack on availability. Software is often easy to delete. Software can also be altered or

9|Page
damaged to render it useless. Careful software configuration management can maintain high
availability. A more difficult problem is software modification (e.g. from virus/worm) that
results in a program that still functions but that behaves differently than before, which is a
threat to integrity/authenticity.
Data - involves files and other forms of data controlled by individuals, groups, and business
organizations. Security concerns with respect to data are broad, encompassing availability,
secrecy, and integrity. In the case of availability, the concern is with the destruction of data
files, which can occur either accidentally or maliciously. The obvious concern with secrecy is
the unauthorized reading of data files or databases. A less obvious secrecy threat involves the
analysis of data and manifests itself in the use of so-called statistical databases, which
provide summary or aggregate information. Finally, data integrity is a major concern in most
installations. Modifications to data files can have consequences ranging from minor to
disastrous.
1.7. Network Security Attacks
Network security attacks can either be passive or active attacks.
A) Passive attacks
 Release of Message Contents: threat agent learns contents of sensitive transmission
 Traffic Analysis: Opponent observes the pattern of the message
B) Active attacks
 Masquerade: entity pretends to be another
 Replay: passive capture of data and subsequent retransmission
 Modification of Message: legitimate message is altered, delayed or reordered
 Denial of Service: prevents normal use of communication facilities.
 Disruption of the entire communication line
1.7. Security Functional Requirement
Functional requirement describes what the security system has to do. It has the following
features:
o Technical Measures: More of technical by its nature
 Access control, identification & authentication, System & Communication protection,
System and information integrity
o Management Controls and Procedures: Strategies and protocols
 Awareness & training, audit and accountability, certification, accreditation, security
assessment, contingency plan, physical and environmental protection, risk assessment
o Overlapping technical and management:

10 | P a g e
 Configuration management, incident response, media protection
Figure 1.3. Scenario: IoT Security Requirements

ITU-T Recommendation X.800, Security Architecture for OSI, defines a systematic way of
defining the requirements for security and characterizing the approaches to satisfying those
requirements. The OSI security architecture is useful to managers as a way of organizing the
task of providing security. The OSI security architecture focuses on security attacks,
mechanisms, and services. These can be defined briefly as:
• Security attack: Any action that compromises the security of information owned by an
organization. cf.
network security attacks slide earlier
• Security mechanism: A mechanism that is designed to detect, prevent, or recover from a
security attack.
• Security service: A service that enhances the security of the data processing systems and
the information transfers of an organization. The services are intended to counter security
attacks, and they make use of one or more security mechanisms to provide the service.
1.8. Security Taxonomy
There is one generally agreed-upon approach used by the CERT and other organizations
concerned with computer security, the computer and network security incident taxonomy.
Figure 1.4 from the text depicts the overall scope of computer security using this taxonomy.
At a top level of detail, an attacker, or group of attackers, achieves their objectives by
performing attacks. An incident may be comprised of a single or multiple attack, as
illustrated by the return loop. The key elements are:
• Action: A step taken by a user or process in order to achieve a result

11 | P a g e
• Target: A computer or network logical entity or physical entity
• Event: An action directed at a target that is intended to result in a change of state, or status,
of the target
• Tool: A means of exploiting a computer or network vulnerability
• Vulnerability: A weakness in a system allowing unauthorized action
• Unauthorized result: An unauthorized consequence of an event
• Attack: A series of steps taken by an attacker to achieve an unauthorized result
• Attacker: An individual who attempts one or more attacks in order to achieve an objective
• Objectives: The purpose or end goal of an incident
• Incident: a group of attacks that can be distinguished from other attacks because of the
distinctiveness of the attackers, attacks, objectives, sites, and timing.
1.9. Computer Security Strategy
A computer security strategy is an action plan detailing how a business will protect itself from
threats. A strategy must consider the followings:
Specification/Policy
 What is the security scheme supposed to do?
 Codify in policy and
procedures Implementation
mechanisms
 How does it do it?
 Prevention, detection, response, recovery
 Correctness/assurance
 Does it really work?
 Evaluation
 Figure 1.4. Example: NIST Cybersecurity Framework 2.0

• Specification/policy: What is the security scheme supposed to do? A security policy is an

12 | P a g e
informal description of desired system behavior. In developing a security policy, a security
manager needs to consider the context, in terms of: value of the assets being protected;
vulnerabilities of the system; potential threats and the likelihood of attacks. Further, the
manager must consider the following: tradeoffs between “Ease of use versus security” and
“Cost of security versus cost of failure and recovery”.
• Implementation/mechanisms: How does it do it? Security implementation involves four
complementary courses of action: prevention (ideal security scheme is when no attack is
successful. Not practical in all cases, is a reasonable goal), detection (when practical to detect
security attacks), response (to halt the attack and prevent further damage), recovery (from
attack consequences, such as using a backup system).
• Correctness/assurance: Does it really work? Have the concepts of assurance and
evaluation. Assurance as the degree of confidence one has that the security measures, both
technical and operational, work as intended to protect the system and the information it
processes. Evaluation is the process of examining a computer product or system with respect
to certain criteria. Evaluation involves testing, and may also involve formal analytic or
mathematical techniques.
1.10. Review Question
1. Distinguish between vulnerability, threat, and control.
2. Theft usually results in some kind of harm. For example, if someone steals your car, you
may suffer financial loss, inconvenience (by losing your mode of transportation), and
emotional upset (because of invasion of your personal property and space). List three kinds of
harm a company might experience from theft of computer equipment.
3. List at least three kinds of harm a company could experience from electronic espionage or
unauthorized viewing of confidential company materials.
4. List at least three kinds of damage a company could suffer when the integrity of a program
or company data is compromised.
5. List at least three kinds of harm a company could encounter from loss of service, that is,
failure of availability. List the product or capability to which access is lost, and explain how
this loss hurts the company.
6. Describe a situation in which you have experienced harm as a consequence of a failure of
computer security. Was the failure malicious or not? Did the attack target you specifically or
was it general and you were the unfortunate victim?
7. Describe two examples of vulnerabilities in automobiles for which auto manufacturers
have instituted controls. Tell why you think these controls are effective, somewhat
effective, or

13 | P a g e
ineffective.
8. One control against accidental software deletion is to save all old versions of a program. Of
course, this control is prohibitively expensive in terms of cost of storage. Suggest a less
costly control against accidental software deletion. Is your control effective against all
possible causes of software deletion? If not, what threats does it not cover?
9. On your personal computer, who can install programs? Who can change operating system
data? Who can replace portions of the operating system? Can any of these actions be
performed remotely?
10. Suppose a program to print paychecks secretly leaks a list of names of employees earning
more than a certain amount each month. What controls could be instituted to
limit the vulnerability of this leakage?
11. Preserving confidentiality, integrity, and availability of data is a restatement of the
concern over interruption, interception, modification, and fabrication. How do the first three
concepts relate to the last four? That is, is any of the four equivalents to one or more of the
three? Is one of the three encompassed by one or more of the four?

14 | P a g e
 Chapter Two
Basic cryptography
Activity 2.1

 What is cryptography?

 Explain basic terminology of Cryptography.

 Discuss type of cryptography system
 Explain symmetric encryption algorithm types.
 Explain asymmetric encryption algorithm types.
 What is the purpose of encryption?
 Discuss Hash function.

15 | P a g e
2.1. Introduction
Cryptography comes from the Greek words “kryptos”, meaning “hidden,” and graphein,
meaning “to write,” and involves making and using codes to secure messages.
Cryptanalysis involves cracking or breaking encrypted messages back into their
unencrypted origins. Cryptography uses mathematical algorithms that are usually known to
all. After all, it’s not the knowledge of the algorithm that protects the encrypted message, it’s
the knowledge of the key a series of characters or bits injected into the algorithm along with
the original message to create the encrypted message. An individual or system usually
encrypts a plaintext message into ciphertext, making it unreadable to unauthorized people
those without the key needed to decrypt the message back into plaintext, where it can be read
and understood.
Cryptology the science of encryption, which encompasses cryptography and cryptanalysis.
The science of cryptography is not as enigmatic as you might think. A variety of
cryptographic techniques are used regularly in everyday life. For example, open your
newspaper to the entertainment section and you’ll find the daily cryptogram, a word puzzle
that involves unscrambling letters to find a hidden message.
The science of encryption, known as cryptology, encompasses cryptography and cryptanalysis.

2.2. Basic cryptographic terms

To understand the fundamentals of cryptography, you must know the meanings of the
following terms:
 Algorithm: The steps used to convert an unencrypted message into an encrypted
sequence of bits that represent the message; sometimes refers to the programs that enable the
cryptographic processes.
 Bit stream cipher: An encryption method that involves converting plaintext to ciphertext
one bit at a time.
 Block cipher: An encryption method that involves dividing the plaintext into blocks or
sets of bits and then converting the plaintext to ciphertext one block at a time.
 Cipher or cryptosystem: An encryption method or process encompassing the algorithm,
key(s) or crypto variable(s), and procedures used to perform encryption and decryption.
 Ciphertext or cryptogram: The encoded message resulting from an encryption.
Decipher:To decrypt, decode, or convert ciphertext into the equivalent plaintext.
 Encipher:To encrypt, encode, or convert plaintext into the equivalent ciphertext.
 Key or cryptovariable: The information used in conjunction with an algorithm to create
the ciphertext from the plaintext or derive the plaintext from the ciphertext.
 Keyspace: The entire range of values that can be used to construct an individual key.

16 | P a g e
 Plaintext or cleartext: The original unencrypted message, or a message that has
been successfully decrypted.
 Steganography: The hiding of messages for example, within the digital encoding of a
picture or graphic.
 cryptography the process of making and using codes to secure the transmission of
information/ making communications secure.
 Encryption is the process of turning a clear-text message (Plaintext) into a data stream
which looks like a meaningless and random sequence of bits (cipher text).
 Decryption is the process of turning cipher text back into plaintext
 Crypto analysis deals with breaking ciphertext, that is, recovering plaintext without
knowing the key.
 Cryptology is a branch of mathematics which deals with both cryptography and crypto
analysis.
 Symmetric algorithms use the same key for encryption and decryption.
 Public-key algorithms (also known as asymmetric algorithms) use two different keys (a
key pair) for encryption and decryption.
 cipher text - the coded message
 cipher -algorithm for transforming plaintext to ciphertext
 key -info used in cipher known only to sender/receiver
 encipher (encrypt) - converting plaintext to ciphertext
 decipher (decrypt) - recovering ciphertext from plaintext
 cryptology - the field of both cryptography and cryptanalysis

2.3. Historical background

2.3.1. Cryptography- Origin
Human being from ages had two inherent needs:(a) to communicate and share information
and (b) to communicate selectively. These two needs gave rise to the art of coding the
messages in such a way that only the intended people could have access to the information.
Unauthorized people could not extract any information, even if the scrambled messages fell
in their hand.
The art and science of concealing the messages to introduce secrecy in information security
is recognized as cryptography.
The word ‘cryptography’ was coined by combining two Greek words, ‘Krypto’ meaning
hidden and ‘graphene’ meaning writing.

2.3.2. History of Cryptography

The art of cryptography is considered to be born along with the art of writing. As civilizations

17 | P a g e
evolved, human beings got organized in tribes, groups, and kingdoms. This led to the
emergence of ideas such as power, battles, supremacy, and politics. These ideas further
fueled the natural need of people to communicate secretly with selective recipient which in
turn ensured the continuous evolution of cryptography as [Link] roots of cryptography are
found in Roman and Egyptian civilizations.
Hieroglyph The Oldest Cryptographic Technique
The first known evidence of cryptography can be traced to the use of ‘hieroglyph’. Some
4000 years ago, the Egyptians used to communicate by messages written in hieroglyph. This
code was the secret known only to the scribes who used to transmit messages on behalf of the

kings.
One such hieroglyph is shown below.
Later, the scholars moved on to using simple mono-alphabetic substitution ciphersduring
500 to 600 BC. This involved replacing alphabets of message with other alphabets with some
secret rule. This rule became a key to retrieve the message back from the garbled message.
The earlier Roman method of cryptography, popularly known as the Caesar Shift Cipher,
relies on shifting the letters of a message by an agreed number (three was a common choice),
the recipient of this message would then shift the letters back by the same number and obtain
the original message.

EvolutionofCryptography
It is during and after the European Renaissance, various Italian and Papal states led the rapid
proliferation of cryptographic techniques. Various analysis and attack techniques were
researched in this era to break the secret codes.

Improved coding techniques such as Vigenere Coding came into existence in the 15th
century, which offered moving letters in the message with a number of variable places instead
of moving them the same number of places.

18 | P a g e
 Only after the 19th century, cryptography evolved from the ad hoc approaches to
encryption to the more sophisticated art and science of information security.

 In the early 20th century, the invention of mechanical and electromechanical machines,
such as the Enigma rotor machine, provided more advanced and efficient means of coding
the information.
 During the period of World War II, both cryptography and cryptanalysis became
excessively mathematical.
 With the advances taking place in this field, government organizations, military units, and
some corporate houses started adopting the applications of cryptography. They used
cryptography to guard their secrets from others. Now, the arrival of computers and the
Internet has brought effective cryptography within the reach of common [Link] the
context of any application-to-application communication, there are some specific security
requirements, including:
What is the purpose of Cryptography?
There are some specific security requirements, including:
 Authentication: The process of proving one's identity. (The primary forms of host-to-host
authentication on the Internet today are name-based or address-based, both of which are
notoriously weak.)
 Privacy/confidentiality: Ensuring that no one can read the message except the intended
receiver.
 Integrity: Assuring the receiver that the received message has not been altered in any way
from the original.
 Non-repudiation: A mechanism to prove that the sender really sent this message.
 Non-repudiation: A mechanism to prove that the sender really sent this message.
Cryptography, then, not only protects data from theft or alteration, but can also be used for
user authentication. There are, in general, three types of cryptographic schemes typically
used to accomplish these goals: secret key (or symmetric) cryptography, public-key (or
asymmetric) cryptography, and hash functions, each of which is described below. In all
cases, the initial unencrypted data is referred to as plaintext. It is encrypted into ciphertext,
which will in turn (usually) be decrypted into usable plaintext.
In many of the descriptions below, two communicating parties will be referred to as Alice
and Bob; this is the common nomenclature in the crypto field and literature to make it easier
to identify the communicating parties. If there is a third or fourth party to the
communication,

19 | P a g e
they will be referred to as Carol and Dave. Mallory is a malicious party, Eve is an
eavesdropper, and Trent is a trusted third party

2.4. Cipher Techniques

There are two methods of encrypting plaintext: the bit stream method or the block cipher
method, as defined in the previous section. In the bit stream method, each bit in the plaintext
is transformed into a cipher bit one bit at a time. In the block cipher method, the message is
divided into blocks for example, sets of 8-, 16-, 32-, or 64-bit blocks and then each block of
plaintext bits is transformed into an encrypted block of cipher bits using an algorithm and
a key. Bit stream methods commonly use algorithm functions like the exclusive OR
operation (XOR), whereas block methods can use substitution, transposition, XOR, or some
combination of these operations, as described in the following sections.
Note that most computer-based encryption methods operate on data at the level of its binary
digits (bits), while others operate at the byte or character level.

Fig. Cipher classification/category

Block Cipher Vs Stream Cipher
 A stream cipher is one that encrypts a digital data stream one bit or one byte at time.
Examples of classical stream ciphers are the auto keyed Vigenère cipher and the Vernam
cipher.
 A block cipher is one in which a block of plaintext is treated as a whole and used to
produce a ciphertext block of equal length. Typically, a block size of 64 or 128 bits is used.

20 | P a g e
 Block Cipher:
 A block cipher is an encryption/decryption scheme in which a block of plaintext is
treated as a whole and used to produce a ciphertext block of equal length.
 Many block ciphers have a Feistel structure.
 Such a structure consists of a number of identical rounds of processing.
 In each round, a substitution is performed on one half of the data being processed,
followed by a permutation that interchanges the two halves.
 The original key is expanded so that a different key is used for each round.

Fig. Stream Cipher

Fig. Block Cipher

2.4.1. Transposition (Permutation) Ciphers

Transposition cipher Also known as a permutation cipher, an encryption method that
involves simply rearranging the values within a block based on an established pattern to
create the ciphertext. Rearrange the letter order without altering the actual letters.
Rail Fence Cipher:
Meet me after the toga party
Write message out diagonally as,

Ciphertext:

21 | P a g e
MEMATRHTGPRYETEFETEOAAT
Row Transposition Ciphers:
Write letters in rows, reorder the columns according to the key before reading off.
Key: 4312567
Product Ciphers

Use several ciphers in succession to make harder, but:

 Two substitutions make a more complex substitution
 Two transpositions make more complex transposition
 But a substitution followed by a transposition makes a new much harder cipher.
 This is a bridge from classical to modern ciphers
2.4.2 Substitution Cipher
 Monoalphabetic substitution A substitution cipher that only incorporates a single
alphabet in the encryption process.
 polyalphabetic substitution A substitution cipher that incorporates two or more
alphabets in
the encryption process.
 substitution cipher an encryption method in which one value is substituted for another.
Vigenère cipher an advanced type of substitution cipher that uses a simple polyalphabetic
code.
 A substitution technique is one in which the letters of plaintext are replaced by other
letters or by numbers or symbols. If the plaintext is viewed as a sequence of bits, then
substitution involves replacing plaintext bit patterns with cipher text bit patterns.
I. Caesar Cipher.
II. Playfair Cipher.
III. One-Time Pad.
IV. Hill Cipher
V. Monoalphabetic Ciphers
VI. Polyalphabetic Ciphers
I. Caesar Cipher
The earliest known use of a substitution cipher and the simplest was by Julius Caesar.

22 | P a g e
It is a mono-alphabetic cipher wherein each letter of the plaintext is substituted byanother
letter to form the ciphertext. It is a simplest form of substitution cipher scheme.
This cryptosystem is generally referred to as the Shift Cipher. The concept is to replace each
alphabet by another alphabet which is ‘shifted’ by some fixed number between 0 and 25.
For this type of scheme, both sender and receiver agree on a ‘secret shift number’ for shifting
the alphabet. This number which is between 0 and 25 becomes the key of encryption.
The name ‘Caesar Cipher’ is occasionally used to describe the Shift Cipher when the ‘shift
of three’ is used.
The plaintext letter is then encrypted to the ciphertext letter on the sliding ruler underneath.
The result of this process is depicted in the following illustration for an agreed shift of three
positions. In this case, the plaintext ‘tutorial’ is encrypted to the ciphertext ‘WXWRULDO’.
Here is the ciphertext alphabet for a Shift of 3:

If n=3

Plain Text: meet me after the toga party Considering n=3

Cipher Text: PHHW PH DIWHU WKH WRJD SDUWB
Weakness: Total 26 keys
II. Playfair Cipher
The best-known multiple letter encryption cipher is the Playfair, which treats diagrams in the
plaintext as single units and translates these units into cipher text diagrams.
 The Playfair algorithm is based on the use of 5x5 matrix of letters constructed using a
keyword.
 Let the keyword be “monarchy‟.
 The matrix is constructed by filling in the letters of the keyword (minus duplicates) from
left to right and from top to bottom, and then filling in the remainder of the matrix with the
remaining letters in alphabetical order.
 The letter „i‟ and „j‟ count as one letter.

23 | P a g e
Example: Keyword : MONARCHY
M O N A R
C H Y B D
E F G I/J K
L P Q S T
U V W X Z
Plaintext = meet me at the school house Splitting two letters as a unit =>
me et me at th es ch ox ol ho us ex Corresponding cipher text =>
CL KL CL RS PD IL HY AV MP HF XL IU
Since there are 26 letters, 26x26 = 676 diagrams are possible, so identification of individual
diagram is more difficult. Frequency analysis is much more difficult.
Hill Cipher
 The Hill Cipher was invented by Lester S. Hill in 1929.
 The encryption algorithm takes ‘m’ successive plain text letters and substitutes for them
‘m’ ciphertext letters.
 Encryption - Ciphertext = K * P mod 26
 Decryption Plaintext = K-1 * C mod 26
Example:

III. One-Time Pad

 It is an unbreakable cryptosystem. It represents the message as a sequence of 0s and 1s.
 This can be accomplished by writing all numbers in binary, for example, or by using ASCII.
 The key is a random sequence of 0‟s and 1‟s of same length as the message.
 Once a key is used, it is discarded and never used again. The system can be expressed as
follows:
 Thus, the cipher text is generated by performing the bitwise XOR of the plaintext and the
key.
 Decryption uses the same key.
 Because of the properties of XOR, decryption simply involves the same bitwise operation
• Monoalphabetic Ciphers
 With only 25 possible keys, the Caesar cipher is far from secure.
 A dramatic increase in the key space can be achieved by allowing an arbitrary substitution.
 A permutation of a finite set of elements is an ordered sequence of all the elements of, with

24 | P a g e
each element appearing exactly once. For example, if, there are six permutations of :

In general, there are! permutations of a set of elements, because the first element can be
chosen in one of n ways
 If, instead, the “cipher” line can be any permutation of the 26 alphabetic characters, then
there are 26! or greater than possible keys.
 This is 10 orders of magnitude greater than the key space for DES and would seem to
eliminate brute-force techniques for cryptanalysis.
 Such an approach is referred to as a monoalphabetic substitution cipher, because a single
cipher alphabet (mapping from plain alphabet to cipher alphabet) is used per message.
Polyalphabetic Ciphers
 Vigenere Cipher is a method of encrypting alphabetic text. It uses a simple form of
polyalphabetic substitution.
 A polyalphabetic cipher is any cipher based on substitution, using multiple substitution
alphabets.
 The encryption of the original text is done using the Vigenère square or Vigenère table.
 The table consists of the alphabets written out 26 times in different rows, each alphabet
shifted cyclically to the left compared to the previous alphabet, corresponding to the 26
possible Caesar Ciphers.
 At different points in the encryption process, the cipher uses a different alphabet from one
of the rows.
 The alphabet used at each point depends on a repeating keyword.

2.5. Conventional encryption algorithms

Types of Cryptography
I) Symmetric Key Cryptography
II) Asymmetric Key Cryptography
II) Hash Functions

2.5.1. Symmetric Key Cryptography

The key for encrypting and decrypting the file had to be known to all the recipients. Else, the
message could not be decrypted by conventional means.
Symmetric Key Cryptography Examples:

[Link]. Data Encryption Standard (DES)

 The Data Encryption Standard (DES) has been the most widely used symmetric
encryption algorithm until recently. It exhibits the classic Feistel structure.

25 | P a g e
 DES uses a 64-bit block and a 56-bit key.
 Two important methods of cryptanalysis are differential cryptanalysis and linear
cryptanalysis.
 DES has been shown to be highly resistant to these two types of attack.
DES Encryption
As with any encryption scheme, there are two inputs to the encryption function: the plaintext
to be encrypted and the key.
In this case, the plaintext must be 64 bits in length and the key is 56 bits in [Link] the
exception of the initial and final permutations, DES has the exact structure of a Feistel cipher,

Fig. Data Encryption Standard

Assuming that, on average, half the key space has to be searched, a single machine
performing one DES encryption per microsecond would take more than a thousand years to
break the cipher.
Confidentiality using Symmetric Encryption:
 Placement of Encryption Function
 What to encrypt and where to place the encrypted function
 Encryption placement end to end encryption and link encryption
 There are number of locations where attacks can occur.
 And, it is not under the physical control of the end user.

[Link]. Advanced Encryption Standard(AES)

Advanced Encryption Standard (AES) is an encryption standard adopted by the U.S.

government. The standard comprises three block ciphers, AES-128, AES-192 and AES-256,

26 | P a g e
adopted from a larger collection originally published as Rijndael. Each AES cipher has a
128- bit block size, with key sizes of 128, 192 and 256 bits, respectively. The AES ciphers
have been analysed extensively and are now used worldwide, as was the case with its
predecessor, the Data Encryption Standard (DES). IDEA(The International Data Encryption
Algorithm) was developed in 1991.
It uses a 128 bit key to encrypt a 64 bit block of plaintext into a 64 bit block of ciphertext.
IDEA's general structure is very similar to DES, it performs 17 rounds, each round taking 64
bits of input to produce a 64 bit output, using per-round keys generated from the 128 bit key.
Key Management
Symmetric key systems are simpler and faster; their main drawback is that the two
parties must somehow exchange the key in a secure way and keep it secure after that.
Key Management caused nightmare for the parties using the symmetric key cryptography.
They were worried about how to get the keys safely and securely across to all users so that
the decryption of the message would be possible. This gave the chance for third parties to
intercept the keys in transit to decode the top-secret messages. Thus, if the key was
compromised, the entire coding system was compromised and a “Secret” would no longer
remain a “Secret”.

2.5.2. Asymmetric Key Cryptography

Asymmetric cryptography, also known as Public-key cryptography, refers to a
cryptographic algorithm which requires two separate keys, one of which is private and one of
which is public. The public key is used to encrypt the message and the private one is used to
decrypt the message. Public Key Cryptography is a very advanced form of cryptography.
Officially, it was invented by Whitfield Diffie and Martin Hellman in 1975.
The basic technique of public key cryptography was first discovered in 1973 by the British
Clifford Cocks of Communications-Electronics Security Group (CESG) of (Government
Communications Headquarters - GCHQ) but this was a secret until 1997.A public-key
encryption scheme has six ingredients:
 Plaintext: This is the readable message or data that is fed into the algorithm as input.
 Encryption algorithm: The encryption algorithm performs various transformations on
the plaintext.
 Public and private keys: This is a pair of keys that have been selected so that if one is
used for encryption, the other is used for decryption. The exact transformations performed by
the algorithm depend on the public or private key that is provided as input.
 Ciphertext: This is the scrambled message produced as output. It depends on the
plaintext and the [Link] a given message, two different keys will produce two different
ciphertexts.
27 | P a g e
 Decryption algorithm: This algorithm accepts the ciphertext and the matching key and
produces the original plaintext.

Fig: Process of Encryption and Decryption

Asymmetric Key Cryptography – Examples:

[Link]. Digital Signature Standard (DSS)

is the digital signature algorithm (DSA) developed by the U.S. National Security Agency
(NSA) to generate a digital signature for the authentication of electronic documents. DSS
was put forth by the National Institute of Standards and Technology (NIST) in 1994, and has
become the United States government standard for authentication of electronic documents.
DSS is specified in Federal Information Processing Standard (FIPS) 186.
[Link]. Algorithm - RSA
RSA (Rivest, Shamir and Adleman who first publicly described it in 1977) is an algorithm
for public-key cryptography. It is the first algorithm known to be suitable for signing as well
as encryption, and one of the first great advances in public key cryptography. RSA is widely
used in electronic commerce protocols, and is believed to be secure given sufficiently long
keys and the use of up-to-date implementations.

[Link]. ElGamal
ElGamal is a public key method that is used in both encryption and digital [Link]

28 | P a g e
encryption algorithm is similar in nature to the Diffie-Hellman key agreement protocol It is
used in many applications and uses discrete logarithms. ElGamal encryption is used in the
free GNU Privacy Guard software.
RSA and ElGamal Schemes – AComparison
Let us briefly compare the RSA and ElGamal schemes on the various aspects.
RSA ElGamal

It is more efficient for encryption. It is more efficient for decryption.

It is less efficient for decryption. It is more efficient for decryption.

For a particular security level, lengthy keys For the same level of security, very short keys are
are required in RSA. required.
It is widely accepted and used. It is new and not very popular in market.
Difference between Symmetric encryption and Asymmetric encryption
[Link] Symmetric encryption Asymmetric encryption

1. It uses a single shared key (secret key) to encrypt It uses two different keys for encryption and decryption.
and
decrypt the message.
2. The size of cipher text is same or smaller than the The size of cipher text is same or larger than the
original
original plain text.
plain text.
3. The encryption process is very fast. The encryption process is slow.

4. It is used when a large amount of data is required to It is used to transfer small amount of data.
transfer.
5. It only provides confidentiality. It provides confidentiality, authenticity and non-
repudiation.
6. It is less secured as there is a use of a single key for It is safer as there are two keys used for encryption and
encryption. decryption.
7. The algorithms used in symmetric encryption are RSA, DSA, Diffie-Hellman, ECC, ElGamal.
3DES, AES, DES, and RC4.

2.5.3. Hash Functions

A cryptographic hash function is a hash function that takes an arbitrary block of data and
returns a fixed-size bit string, the cryptographic hash value, such that any (accidental or
intentional) change to the data will (with very high probability) change the hash value. The
data to be encoded are often called the message, and the hash value is sometimes called the

29 | P a g e
message digest or simply digest

Fig. 2.2. Hash Function Algorithm

What is Hash is Function?
The ideal cryptographic hash function has four main properties:
 it is easy to compute the hash value for any given message
 it is infeasible to generate a message that has a given hash
 it is infeasible to modify a message without changing the hash
 it is infeasible to find two different messages with the same hash.

2.6. Cryptanalysis
The process of attempting to discover the plaintext or key is known as cryptanalysis. It is
very difficult when only the ciphertext is available to the attacker as in some cases even the
encryption algorithm is not known. The most common attack under these circumstances is
brute-force approach of trying all the possible keys. This attack is made impractical when the
key size is considerably large. The table below gives an idea on types of attacks on encrypted
messages.

30 | P a g e
2.7. Cryptographic Systems
In general, cryptographic algorithms are often grouped into two broad categories symmetric
and asymmetric, but in practice, today’s popular cryptosystems use a combination of both
algorithms i.e., symmetric and asymmetric algorithms are distinguished by the types of
keys they use for encryption and decryption operations.

2.7.1. Symmetric key cryptography

Cryptographic Notation
The notation used to represent the encryption process varies, depending on its source. The
notation in this text uses the letter M to represent the original message, C to represent the
ending ciphertext, E to represent the enciphering or encryption process, D to represent the
decryption or deciphering process, and K to represent the key. This notation can be used as
follows:

31 | P a g e
To encrypt a plaintext set of data, you can use one of two methods: bit stream and block
cipher. In the bit stream method, each bit is transformed into a cipher bit, one after the other.
In the block cipher method, the message is divided into blocks for example, 8-, 16-, 32-, or
64-bit blocks and then each is transformed using the algorithm and key. Bit stream methods
most commonly use algorithm functions like XOR, whereas block methods can use XOR,
transposition, or substitution.

2.7.2. Data Encryption Standard (DES)

it was developed by IBM and is based on the company’s Lucifer algorithm, which uses a key
length of 128 bits. As implemented, DES uses a 64-bit block size and a 56-bit [Link] was
adopted by NIST in 1976 as a federal standard for encryption of non-classified information,
after which it became widely employed in commercial applications. DES enjoyed increasing
popularity for almost 20 years until 1997, when users realized that a 56-bit key size did not
provide acceptable levels of security.

[Link]. 3DES Triple (3DES)

It was created to provide a level of security far beyond that of DES. 3DES was an advanced
application of DES,and while it did deliver on its promise of encryption strength beyond
DES, it soon proved too weak to survive indefinitely especially as computing power
continued to double every 18 months. Within just a few years, 3DES needed to be replaced.
The successor to 3DES is the Advanced Encryption Standard (AES). AES is a federal
information processing standard (FIPS) that specifies a cryptographic algorithm used within
the U.S. government to protect information in federal agencies that are not part of the
national defence.
Triple DES (3DES) was designed to surpass the security provided by standard DES. (In
between, there was a 2DES; however, it was statistically shown not to provide significantly
stronger security than DES.) 3DES uses three 64-bit keys for an overall key length of 192
bits.
32 | P a g e
3DES encryption is the same as that of standard DES, repeated three times. 3DES can be
employed using two or three keys and a combination of encryption or decryption for
additional security. The most common implementations involve encrypting and/or decrypting
with two or three different keys, as described in the following steps. 3DES employs 48
rounds in its encryption computation, generating ciphers that are approximately 256 times
stronger than standard DES ciphers but that require only three times longer to process. One
example of 3DES encryption is as follows:

infrastructure. (Agencies that are considered a part of national defence use more secure
methods of encryption, which are provided by the National Security Agency.) The
requirements for AES stipulate that the algorithm should be unclassified, publicly disclosed,
and available royalty-free worldwide. AES was developed to replace both DES and 3DES.
While 3DES remains an approved algorithm for some uses, its expected useful life is limited.
Historically, cryptographic standards approved by FIPS have been adopted on a voluntary
basis by organizations outside government entities. The AES selection process involved
cooperation between the U.S. government, private industry, and academia from around the
world. AES was approved by the Secretary of Commerce as the official federal governmental
standard on May 26, 2002.
AES implements a block cipher called the Rijndael Block Cipher with a variable block length
and a key length of 128, 192, or 256 bits. Experts estimate that the special computer used by
the Electronic Frontier Foundation to crack DES within a couple of days would require
approximately 4,698,864 quintillion years (4,698,864,000,000,000,000,000) to crack AES.

33 | P a g e
[Link]. Advanced Encryption Standard (AES)
Advanced Encryption Standard (AES): The current federal standard for the encryption of
data, as specified by NIST. AES is based on the Rijndael algorithm, which was developed by
Vincent Rijmen and Joan Daemen.
Private-key encryption or symmetric encryption an encryption method that incorporates
mathematical operations involving the same secret key both to encipher and decipher the
message. Secret key a key that can be used in symmetric encryption both to encipher and
decipher the message Encryption methodologies that require the same secret key to encipher
and decipher the message are performing private-key encryption or symmetric encryption.
Symmetric encryption methods use mathematical operations that can be programmed into
extremely fast computing algorithms so that encryption and decryption are executed quickly,
even by small computers.
The primary challenge of symmetric key encryption is getting the key to the receiver, a
process that must be conducted out of band to avoid interception. In other words, the process
must use a channel or band other than the one carrying the ciphertext.

2.8. Chapter Summary

 Encryption is the process of converting a message into a form that is unreadable to
unauthorized people.
 The science of encryption, known as cryptology, encompasses cryptography (making and
using encryption codes) and cryptanalysis (breaking encryption codes).
 Cryptology has a long history and continues to change and improve.
 Two basic processing methods are used to convert plaintext data into encrypted data bit
stream and block ciphering. The other major methods used for scrambling data include
substitution ciphers, transposition ciphers, the XOR function, the Vigenère cipher, and the
Vernam cipher.
 The strength of many encryption applications and cryptosystems is determined by key
size. All other things being equal, the length of the key directly affects the strength of the
encryption.
 Hash functions are mathematical algorithms that generate a message summary, or digest,
that can be used to confirm the identity of a specific message and confirm that the message
has not been altered.
 Most cryptographic algorithms can be grouped into two broad categories: symmetric and
asymmetric. In practice, most popular cryptosystems are hybrids that combine symmetric and
asymmetric algorithms.
 Public key infrastructure (PKI) is an integrated system of software, encryption

34 | P a g e
methodologies, protocols, legal agreements, and third-party services that enables users to
communicate securely. PKI includes digital certificates and certificate authorities.
 Digital signatures are encrypted messages that are independently verified by a central
facility, and which provide nonrepudiation.
 A digital certificate is an electronic document, similar to a digital signature, which is
attached to a file to certify it came from the organization that claims to have sent it and was
not modified from its original format.
 Steganography is the hiding of information. It is not properly a form of cryptography, but
is similar in that it is used to protect confidential information while in transit.
 Most well-known encryption methods are released to the information security and
computer security communities for testing, which leads to the development of more secure
algorithms.

2.9. Review of questions

1. Define security trends

2. Computer Security Losses
3. Security Technologies used
4. Discuss cybersecurity.
5. Who is hacker/cracker?
6. Explain Black verse White hacker.
7. Define Computer crime.
8. Discuss in details cryptography

35 | P a g e
 Chapter Three
Program Security
Activity 3.1

 What is program flaws?

 What is program security mean?
 Explain malware.
 Discuss social engineering.
 Explain software attack.
 Discuss network threat/attack
 Explain in details type of virus.

36 | P a g e
 3.1. Secure Program
Consider what we mean when we say that a program is "secure." We know that security
implies some degree of trust that the program enforces expected confidentiality, integrity,
and availability. From the point of view of a program or a programmer, how can we look at a
software component or code fragment and assess its security? This question is, of course,
similar to the problem of assessing software quality in general. One way to assess security or
quality is to ask people to name the characteristics of software that contribute to its overall
security. However, we are likely to get different answers from different people. This
difference occurs because the importance of the characteristics depends on who is analyzing
the software. For example, one person may decide that code is secure because it takes too
long to break through its security controls. And someone else may decide code is secure if it
has run for a period of time with no apparent failures. But a third person may decide that any
potential fault in meeting security requirements makes code insecure.
Early work in computer security was based on the paradigm of "penetrate and patch," in
which analysts searched for and repaired faults. Often, a top-quality "tiger team" would be
convened to test a system's security by attempting to cause it to fail. The test was considered
to be a "proof" of security; if the system withstood the attacks, it was considered secure.
Unfortunately, far too often the proof became a counterexample, in which not just one but
several serious security problems were uncovered. The problem discovery in turn led to a
rapid effort to "patch" the system to repair or restore the security. However, the patch efforts
were largely useless, making the system less secure rather than more secure because they
frequently introduced new faults. There are at least four reasons why.
1. The pressure to repair a specific problem encouraged a narrow focus on the fault itself
and not on its context. In particular, the analysts paid attention to the immediate cause of
the failure and not to the underlying design or requirements faults.
2. The fault often had nonobvious side effects in places other than the immediate area of the
fault.
3. Fixing one problem often caused a failure somewhere else, or the patch addressed the
problem in only one place, not in other related places.
4. The fault could not be fixed properly because system functionality or performance would
suffer as a consequence.
The inadequacies of penetrate-and-patch led researchers to seek a better way to be confident
that code meets its security requirements. One way to do that is to compare the requirements
with the behavior. That is, to understand program security, we can examine programs to see

37 | P a g e
whether they behave as their designers intended or users expected. We call such unexpected
behavior a program security flaw; it is inappropriate program behavior caused by a
program vulnerability. Program security flaws can derive from any kind of software fault.
That is, they cover everything from a misunderstanding of program requirements to a one-
character error in coding or even typing. The flaws can result from problems in a single code
component or from the failure of several programs or program pieces to interact compatibly
through a shared interface. The security flaws can reflect code that was intentionally
designed or codedto be malicious or code that was simply developed in a sloppy or
misguided way. Thus, it makes sense to divide program flaws into two separate logical
categories: inadvertent human errors versus malicious, intentionally induced flaws.
3.2 Types of Flaws
To aid our understanding of the problems and their prevention or correction, we can define
categories that distinguish one kind of problem from another. For example, Landwehr et al.
present a taxonomy of program flaws, dividing them first into intentional and
inadvertent flaws. They further divide intentional flaws into malicious and no malicious
ones. In the taxonomy, the inadvertent flaws fall into six categories:
 validation error (incomplete or inconsistent): permission checks
 domain error: controlled access to data
 serialization and aliasing: program flow order
 inadequate identification and authentication: basis for authorization
 boundary condition violation: failure on first or last case
 other exploitable logic errors
3.2.2 Non-Malicious Program Errors
Being human, programmers and other developers make many mistakes, most of which are
unintentional and no malicious. Many such errors cause program malfunctions but do not
lead to more serious security vulnerabilities. However, a few classes of errors have plagued
programmers and security professionals for decades, and there is no reason to believe they
will disappear. In this section we consider three classic error types that have enabled many
recent security breaches. We explain each type, why it is relevant to security, and how it can
be prevented or mitigated.
3.2.3 Buffer Overflows
A buffer overflow is the computing equivalent of trying to pour two liters of water into a
one- liter pitcher: Some water is going to spill out and make a mess. And in computing, what
a mess these errors have made.

38 | P a g e
Definition: A buffer (or array or string) is a space in which data can be held. A buffer resides
in memory. Because memory is finite, a buffer's capacity is finite. For this reason, in many
programming languages the programmer must declare the buffer's maximum size so that the
compiler can set aside that amount of space.
Let us look at an example to see how buffer overflows can happen. Suppose a C language
program contains the declaration:
char sample[10];
The compiler sets aside 10 bytes to store this buffer, one byte for each of the ten elements of
the array, sample[0] through sample[9]. Now we execute the statement:
sample[10] = 'A';
The subscript is out of bounds (that is, it does not fall between 0 and 9), so we have a
problem. The nicest outcome (from a security perspective) is for the compiler to detect the
problem and mark the error during compilation. However, if the statement were
sample[i] = 'A';
we could not identify the problem until i was set during execution to a too-big subscript. It
would be useful if, during execution, the system produced an error message warning of a
subscript out of bounds. Unfortunately, in some languages, buffer sizes do not have to be
predefined, so there is no way to detect an out-of-bounds error. More importantly, the code
needed to check each subscript against its potential maximum value takes time and space
during execution, and the resources are applied to catch a problem that occurs relatively
infrequently. Even if the compiler were careful in analyzing the buffer declaration and use,
this same problem can be caused with pointers, for which there is no reasonable way to
define a proper limit. Thus, some compilers do not generate the code to check for exceeding
bounds. Let us examine this problem more closely. It is important to recognize that the
potential overflow causes a serious problem only in some instances. The problem's
occurrence depends on what is adjacent to the array sample. For example, suppose each of
the ten elements of the array sample is filled with the letter A and the erroneous reference
uses the letter B, as follows: for (i=0; i<=9; i++) sample[i] = 'A'; sample[10] = 'B'
All program and data elements are in memory during execution, sharing space with the
operating system, other code, and resident routines. So there are four cases to consider in
deciding where the 'B' goes. If the extra character overflows into the user's data space, it
simply overwrites an existing variable value (or it may be written into an as-yet unused
location), perhaps affecting the program's result, but affecting no other program or data.

39 | P a g e
3.3 Virus and Other Malicious Code
By themselves, programs are seldom security threats. The programs operate on data, acting
only when data and state changes trigger it. Much of the work done by a program is invisible
to users, so they are not likely to be aware of any malicious activity. For instance, when was
the last time you saw a bit? Do you know in what form a document file is stored? If you
know a document resides somewhere on a disk, can you find it? Can you tell if a game
program does anything in addition to its expected interaction with you? Which files are
modified by a word processor when you create a document? Most users cannot answer these
questions. However, since computer data are not usually seen directly by users, malicious
people can make programs serve as vehicles to access and change data and other programs.
Let us look at the possible effects of malicious code and then examine in detail several kinds
of programs that can be used for interception or modification of data.
Why Worry About Malicious Code?
None of us likes the unexpected, especially in our programs. Malicious code behaves in
unexpected ways, thanks to a malicious programmer's intention. We think of the malicious
code as lurking inside our system: all or some of a program that we are running or even a
nasty part of a separate program that somehow attaches itself to another (good) program.
Malicious Code Can Do Much (Harm)
Malicious code can do anything any other program can, such as writing a message on a
computer screen, stopping a running program, generating a sound, or erasing a stored file. Or
malicious code can do nothing at all right now; it can be planted to lie dormant, undetected,
until some event triggers the code to act. The trigger can be a time or date, an interval (for
example, after 30 minutes), an event (for example, when a particular program is executed), a
condition (for example, when communication occurs on a modem), a count (for example, the
fifth time something happens), some combination of these, or a random situation. In fact,
malicious code can do different things each time, or nothing most of the time with something
dramatic on occasion. In general, malicious code can act with all the predictability of a two-
year-old child: We know in general what two-year-olds do, we may even know what a
specific two-year-old often does in certain situations, but two-year-olds have an amazing
capacity to do the unexpected.
Malicious code runs under the user's authority. Thus, malicious code can touch everything
the user can touch, and in the same ways. Users typically have complete control over their
own program code and data files; they can read, write, modify, append, and even delete them.
And well they should. But malicious code can do the same, without the user's permission or
even

40 | P a g e
knowledge.
3.4. Kinds of Malicious Code
Malicious code or a rogue program is the general name for unanticipated or undesired
effects in programs or program parts, caused by an agent intent on damage. This definition
eliminates unintentional errors, although they can also have a serious negative effect. This
definition also excludes coincidence, in which two benign programs combine for a negative
effect. The agent is the writer of the program or the person who causes its distribution. By
this definition, most faults found in software inspections, reviews, and testing do not qualify
as malicious code, because we think of them as unintentional. However, keep in mind as you
read this chapter that unintentional faults can in fact invoke the same responses as intentional
malevolence; a benign cause can still lead to a disastrous effect.
You are likely to have been affected by a virus at one time or another, either because your
computer was infected by one or because you could not access an infected system while its
administrators were cleaning up the mess one made. In fact, your virus might actually have
been a worm: The terminology of malicious code is sometimes used imprecisely. A virus is a
program that can pass on malicious code to other no malicious programs by modifying them.
The term "virus" was coined because the affected program acts like a biological virus: It
infects other healthy subjects by attaching itself to the program and either destroying it or
coexisting with it. Because viruses are insidious, we cannot assume that a clean program
yesterday is still clean today. Moreover, a good program can be modified to include a copy of
the virus program, so the infected good program itself begins to act as a virus, infecting other
programs. The infection usually spreads at a geometric rate, eventually overtaking an entire
computing system and spreading to all other connected systems.
A virus can be either transient or resident. A transient virus has a life that depends on the
life of its host; the virus runs when its attached program executes and terminates when its
attached program ends. (During its execution, the transient virus may have spread its
infection to other programs.) A resident virus locates itself in memory; then it can remain
active or be activated as a stand-alone program, even after its attached program ends.
A Trojan horse is malicious code that, in addition to its primary effect, has a second,
nonobvious malicious effect. As an example of a computer Trojan horse,
A logic bomb is a class of malicious code that "detonates" or goes off when a specified
condition occurs. A time bomb is a logic bomb whose trigger is a time or date.
A trapdoor or backdoor is a feature in a program by which someone can access the
program other than by the obvious, direct call, perhaps with special privileges. For
instance, an

41 | P a g e
automated bank teller program might allow anyone entering the number 990099 on the
keypad to process the log of everyone's transactions at that machine. In this example, the
trapdoor could be intentional, for maintenance purposes, or it could be an illicit way for the
implementer to wipe out any record of a crime.
A worm is a program that spreads copies of itself through a network. The primary difference
between a worm and a virus is that a worm operates through networks, and a virus can spread
through any medium (but usually uses copied program or data files). Additionally, the worm
spreads copies of itself as a stand-alone program, whereas the virus spreads copies of itself as
a program that attaches to or embeds in other programs.
White et al. also define a rabbit as a virus or worm that self-replicates without bound, with
the intention of exhausting some computing resource. A rabbit might create copies of itself
and store them on disk, in an effort to completely fill the disk, for example.
These definitions match current careful usage. The distinctions among these terms are small,
and often the terms are confused, especially in the popular press. The term "virus" is often
used to refer to any piece of malicious code. Furthermore, two or more forms of malicious
code can be combined to produce a third kind of problem. For instance, a virus can be a time
bomb if the viral code that is spreading will trigger an event after a period of time has passed.
The kinds of malicious code are summarized in Table 3-1.
TABLE 3-1 Types of Malicious Code.
Code Type Characteristics

Virus Attaches itself to program and propagates copies of itself to

other programs

Trojan horse Contains unexpected, additional functionality

Logic bomb Triggers action when condition occurs
Time bomb Triggers action when specified time occurs
Trapdoor Allows unauthorized access to functionality
Worm Propagates copies of itself through a network
Rabbit Replicates itself without limit to exhaust resource

Because "virus" is the popular name given to all forms of malicious code and because fuzzy
lines exist between different kinds of malicious code, we will not be too restrictive in the
following discussion. We want to look at how malicious code spreads, how it is activated,
and

42 | P a g e
what effect it can have. A virus is a convenient term for mobile malicious code, and so in the
following sections we use the term "virus" almost exclusively. The points made apply also to
other forms of malicious code.
3.4 Developmental Controls
Many controls can be applied during software development to ferret out and fix problems. So
let us begin by looking at the nature of development itself, to see what tasks are involved in
specifying, designing, building, and testing software. The Nature of Software Development
Software development is often considered a solitary effort; a programmer sits with a
specification or design and grinds out line after line of code. But in fact, software
development is a collaborative effort, involving people with different skill sets who combine
their expertise to produce a working product. Development requires people who can specify
the system, by capturing the requirements and building a model of how the system should
work from the users' point of view design the system, by proposing a solution to the problem
described by the requirements and building a model of the solution implement the system, by
using the design as a blueprint for building a working solution test the system, to ensure that
it meets the requirements and implements the solution as called for in the design review the
system at various stages, to make sure that the end products are consistent with the
specification and design models document the system, so that users can be trained and
supported manage the system, to estimate what resources will be needed for development and
to track when the system will be done maintain the system, tracking problems found, changes
needed, and changes made, and evaluating their effects on overall quality and functionality
One person could do all these things. But more often than not, a team of developers works
together to perform these tasks. Sometimes a team member does more than one activity; a
tester can take part in a requirement review, for example, or an implementer can write
documentation. Each team is different, and team dynamics play a large role in the team's
success. We can examine both product and process to see how each contributes to quality and
in particular to security as an aspect of quality. Let us begin with the product, to get a sense
of how we recognize high- quality secure software.
3.5 Security in operating system
The basis of protection is separation: keeping one user's objects separate from other users.
Rushby and Randell noted that separation in an operating system can occur in several ways:
 physical separation, in which different processes use different physical objects, such as
separate printers for output requiring different levels of security

43 | P a g e
 temporal separation, in which processes having different security requirements are
executed at different times
 logical separation, in which users operate under the illusion that no other processes exist,
as when an operating system constrains a program's accesses so that the program cannot
access objects outside its permitted domain
 cryptographic separation, in which processes conceal their data and computations in
such a way that they are unintelligible to outside processes Of course, combinations of two or
more of these forms of separation are also possible. The categories of separation are listed
roughly in increasing order of complexity to implement, and, for the first three, in decreasing
order of the security provided. However, the first two approaches are very stringent and can
lead to poor resource utilization. Therefore, we would like to shift the burden of protection to
the operating system to allow concurrent execution of processes having different security
needs. But separation is only half the answer. We want to separate users and their objects, but
we also want to be able to provide sharing for some of those objects. For example, two users
with different security levels may want to invoke the same search algorithm or function
[Link] would like the users to be able to share the algorithms and functions without
compromising their individual security needs. An operating system can support separation
and sharing in several ways, offering protection at any of several levels.
 Do not protect. Operating systems with no protection are appropriate when sensitive
procedures are being run at separate times.
 Isolate. When an operating system provides isolation, different processes running
concurrently are unaware of the presence of each other. Each process has its own address
space, files, and other objects. The operating system must confine each process somehow so
that the objects of the other processes are completely concealed.
 Share all or share nothing. With this form of protection, the owner of an object declares
it to be public or private. A public object is available to all users, whereas a private object is
available only to its owner.
 Share via access limitation. With protection by access limitation, the operating system
checks the allowability of each user's potential access to an object. That is, access control is
implemented for a specific user and a specific object. Lists of acceptable actions guide the
operating system in determining whether a particular user should have access to a particular
object. In some sense, the operating system acts as a guard between users and objects,
ensuring that only authorized accesses occur.
 Share by capabilities. An extension of limited access sharing, this form of protection allows

44 | P a g e
dynamic creation of sharing rights for objects. The degree of sharing can depend on the
owner or the subject, on the context of the computation, or on the object itself.
 Limit use of an object. This form of protection limits not just the access to an object but
the use made of that object after it has been accessed. For example, a user may be allowed to
view a sensitive document, but not to print a copy of it. More powerfully, a user may be
allowed access to data in a database to derive statistical summaries (such as average salary at
a particular grade level), but not to determine specific data values (salaries of individuals).
3.6 User Authentication
An operating system bases much of its protection on knowing who a user of the system is. In
real-life situations, people commonly ask for identification from people they do not know: A
bank employee may ask for a driver's license before cashing a check, library employees may
require some identification before charging out books, and immigration officials ask for
passports as proof of identity. In-person identification is usually easier than remote
identification. For instance, some universities do not report grades over the telephone
because the office workers do not necessarily know the students calling. However, a
professor who recognizes the voice of a certain student can release that student's grades. Over
time, organizations and systems have developed means of authentication, using documents,
voice recognition, fingerprint and retina matching, and other trusted means of identification.
In computing, the choices are more limited and the possibilities less secure. Anyone can
attempt to log in to a computing system. Unlike the professor who recognizes a student's
voice, the computer cannot recognize electrical signals from one person as being any
different from those of anyone else. Thus, most computing authentication systems must be
based on some knowledge shared only by the computing system and the user. Authentication
mechanisms use any of three qualities to confirm a user's identity.
1. Something the user knows a Passwords, PIN numbers, passphrases, a secret handshake,
and mother's maiden name are examples of what a user may know.
2. Something the user has a Identity badges, physical keys, a driver's license, or a uniform
are common examples of things people have that make them recognizable.
3. Something the user is a authenticator, called biometrics, are based on a physical
characteristic of the user, such as a fingerprint, the pattern of a person's voice, or a face
(picture). These authentication methods are old (we recognize friends in person by their faces
or on a telephone by their voices) but are just starting to be used in computer authentication
Passwords as Authenticators.
The most common authentication mechanism for user to operating system is a password, a

45 | P a g e
"word" known to computer and user. Although password protection seems to offer a
relatively secure system, human practice sometimes degrades its quality. In this section we
consider passwords, criteria for selecting them, and ways of using them for authentication.
We conclude by noting other authentication techniques and by studying problems in the
authentication process, notably Trojan horses masquerading as the computer authentication
process.
Use of Passwords
Passwords are mutually agreed-upon code words, assumed to be known only to the user and
the system. In some cases, a user chooses passwords; in other cases the system assigns them.
The length and format of the password also vary from one system to another.
Even though they are widely used, passwords suffer from some difficulties of use:
 Loss. Depending on how the passwords are implemented, it is possible that no one will
be able to replace a lost or forgotten password. The operators or system administrators can
certainly intervene and unprotect or assign a particular password, but often they cannot
determine what password a user has chosen; if the user loses the password, a new one must
be assigned.
 Use. Supplying a password for each access to a file can be inconvenient and time
consuming.
 Disclosure. If a password is disclosed to an unauthorized individual, the file becomes
immediately accessible. If the user then changes the password to protect the file, all other
legitimate users must be informed of the new password because their old password will fail.
 Revocation. To revoke one user's access right to a file, someone must change the
password, thereby causing the same problems as disclosure.
The use of passwords is fairly straightforward. A user enters some piece of identification,
such as a name or an assigned user ID; this identification can be available to the public or
easy to guess because it does not provide the real security of the system. The system then
requests a password from the user. If the password matches that on file for the user, the user
is authenticated and allowed access to the system. If the password match fails, the system
requests the password again, in case the user mistyped.
3.7. Designing Trusted Operating System
Operating systems are the prime providers of security in computing systems. They support
many programming capabilities, permit multiprogramming and sharing of resources, and
enforce restrictions on program and user behavior. Because they have such power, operating
systems are also targets for attack, because breaking through the defenses of an operating
system gives access to the secrets of computing systems. In we considered operating systems

46 | P a g e
from the perspective of users, asking what primitive security services general operating
systems provide. We studied these four services:
 memory protection
 file protection
 general object
 access control
user authentication
We say that an operating system is trusted if we have confidence that it provides these four
services consistently and effectively. In this chapter, we take the designer's perspective,
viewing a trusted operating system in terms of the design and function of components that
provide security services. The first four sections of this chapter correspond to the four major
underpinnings of a trusted operating system:
1. Policy. Every system can be described by its requirements: statements of what the system
should do and how it should do it. An operating system's security requirements are a set of
well-defined, consistent, and implementable rules that have been clearly and unambiguously
expressed. If the operating system is implemented to meet these requirements, it meets the
user's expectations. To ensure that the requirements are clear, consistent, and effective, the
operating system usually follows a stated security policy: a set of rules that lay out what is to
be secured and why. We begin this chapter by studying several security policies for trusted
operating systems.
2. Model. To create a trusted operating system, the designers must be confident that the
proposed system will meet its requirements while protecting appropriate objects and
relationships. They usually begin by constructing a model of the environment to be secured.
The model is actually a representation of the policy the operating system will enforce.
Designers compare the model with the system requirements to make sure that the overall
system functions are not compromised or degraded by the security needs. Then, they study
different ways of enforcing that security. In the second part of this chapter we consider
several different models for operating system security.
3. Design After having selected a security model, designers choose a means to implement
it. Thus, the design involves both what the trusted operating system is (that is, its intended
functionality) and how it is to be constructed (its implementation). The third major section of
this chapter addresses choices to be made during development of a trusted operating system.
4. Trust Because the operating system plays a central role in enforcing security, we (as
developers and users) seek some basis (assurance) for believing that it will meet our

47 | P a g e
expectations. Our trust in the system is rooted in two aspects: features (the operating system
has all the necessary functionality needed to enforce the expected security policy) and
assurance (the operating system has been implemented in such a way that we have
confidence it will enforce the security policy correctly and effectively). In the fourth part of
this chapter we explore what makes a particular design or implementation worthy of trust.
Security Policies
To know that an operating system maintains the security we expect, we must be able to state
its security policy. A security policy is a statement of the security we expect the system to
enforce. An operating system (or any other piece of a trusted system) can be trusted only in
relation to its security policy; that is, to the security needs the system is expected to satisfy.
Military Security Policy:
Military security policy is based on protecting classified information. Each piece of
information is ranked at a particular sensitivity level, such as unclassified, restricted,
confidential, secret, or top secret. The ranks or levels form a hierarchy, and they reflect an
increasing order of sensitivity.
Commercial Security Policies
Commercial enterprises have significant security concerns. They worry that industrial
espionage will reveal information to competitors about new products under development.
Likewise, corporations are often eager to protect information about the details of corporate
finance. So even though the commercial world is usually less rigidly and less hierarchically
structured than the military world, we still find many of the same concepts in commercial
security policies. For example, a large organization, such as a corporation or a university,
may be divided into groups or departments, each responsible for a number of disjoint
projects. There may also be some corporate-level responsibilities, such as accounting and
personnel activities. Data items at any level may have different degrees of sensitivity, such as
public, proprietary, or internal; here, the names may vary among organizations, and no
universal hierarchy applies.
3.8. Trusted Operating Systems Design
Operating systems by themselves (regardless of their security constraints) are very difficult
to design. They handle many duties, are subject to interruptions and context switches, and
must minimize overhead so as not to slow user computations and interactions. Adding the
responsibility for security enforcement to the operating system substantially increases the
difficulty of designing an operating system.
Nevertheless, the need for effective security is becoming more pervasive, and good software

48 | P a g e
engineering principles tell us that it is better to design the security in at the beginning than to
shoehorn it in at the end. Thus, this section focuses on the design of operating systems for a
high degree of security. First, we examine the basic design of a standard multipurpose
operating system. Then, we consider isolation, through which an operating system supports
both sharing and separating user domains. We look in particular at the design of an operating
system's kernel; how the kernel is designed suggests whether security will be provided
effectively. We study two different interpretations of the kernel, and then we consider
layered or ring-structured designs.
3.8.1. Trusted System Design Elements
That security considerations pervade the design and structure of operating systems implies
two things. First, an operating system controls the interaction between subjects and objects,
so security must be considered in every aspect of its design. That is, the operating system
design must include definitions of which objects will be protected in what way, which
subjects will have access and at what levels, and so on. There must be a clear mapping from
the security requirements to the design, so that all developers can see how the two relate.
Moreover, once a section of the operating system has been designed, it must be checked to
see that the degree of security that it is supposed to enforce or provide has actually been
designed correctly. This checking can be done in many ways, including formal reviews or
simulations.
Again, a mapping is necessary, this time from the requirements to design to tests so that
developers can affirm that each aspect of operating system security has been tested and
shown to work correctly.
Second, because security appears in every part of an operating system, its design and
implementation cannot be left fuzzy or vague until the rest of the system is working and
being tested. It is extremely hard to retrofit security features to an operating system designed
with inadequate security. Leaving an operating system's security to the last minute is much
like trying to install plumbing or wiring in a house whose foundation is set, structure defined,
and walls already up and painted; not only must you destroy most of what you have built, but
you may also find that the general structure can no longer accommodate all that is needed
(and so some has to be left out or compromised). Thus, security must be an essential part of
the initial design of a trusted operating system. Indeed, the security considerations may shape
many of the other design decisions, especially for a system with complex and constraining
security requirements. For the same reasons, the security and other design principles must be
carried throughout implementation, testing, and maintenance.

49 | P a g e
Good design principles are always good for security, as we have noted above. But several
important design principles are quite particular to security and essential for building a solid,
trusted operating system. These principles have been articulated well by Saltzerand Saltzer
and Schroeder :
 Least privilege. Each user and each program should operate by using the fewest
privileges possible. In this way, the damage from an inadvertent or malicious attack is
minimized.
 Economy of mechanism. The design of the protection system should be small, simple, and
straightforward. Such a protection system can be carefully analyzed, exhaustively tested,
perhaps verified, and relied on.
 Open design: the protection mechanism must not depend on the ignorance of potential
attackers; the mechanism should be public, depending on secrecy of relatively few key items,
such as a password table. An open design is also available for extensive public scrutiny,
thereby providing independent confirmation of the design security.
 Complete mediation. Every access attempt must be checked. Both direct access attempts
(requests) and attempts to circumvent the access checking mechanism should be considered,
and the mechanism should be positioned so that it cannot be circumvented.
 Permission based: the default condition should be denial of access. A conservative
designer identifies the items that should be accessible, rather than those that should not.
 Separation of privilege ideally, access to objects should depend on more than
onecondition, such as user authentication plus a cryptographic key. In this way, someone
who defeats one protection system will not have complete access.
 Least common mechanism. Shared objects provide potential channels for information
flow. Systems employing physical or logical separation reduce the risk from sharing.
 Ease of use. If a protection mechanism is easy to use, it is unlikely to be avoided.
Although these design principles were suggested several decades ago, they are as accurate
now as they were when originally written. The principles have been used repeatedly and
successfully in the design and implementation of numerous trusted systems. More
importantly, when security problems have been found in operating systems in the past, they
almost always derive from failure to abide by one or more of these principles.
3.9. Assurance in Trusted Operating Systems
Typical Operating System Flaws
Periodically throughout our analysis of operating system security features, we have used the
phrase "exploit a vulnerability." Throughout the years, many vulnerabilities have been
uncovered in many operating systems. They have gradually been corrected, and the body of

50 | P a g e
knowledge about likely weak spots has grown.
Known Vulnerabilities
In this section, we discuss typical vulnerabilities that have been uncovered in operating
systems. Our goal is not to provide a "how-to" guide for potential penetrators of operating
systems. Rather, we study these flaws to understand the careful analysis necessary in
designing and testing operating systems. User interaction is the largest single source of
operating system vulnerabilities, for several reasons:
 The user interface is performed by independent, intelligent hardware subsystems. The
human computer interface often falls outside the security kernel or security restrictions
implemented by an operating system.
 Code to interact with users is often much more complex and much more dependent onthe
specific device hardware than code for any other component of the computing system. For
these reasons, it is harder to review this code for correctness, let alone to verify it formally.
 User interactions are often character oriented. Again, in the interest of fast data transfer,
the operating systems designers may have tried to take shortcuts by limiting the number of
instructions executed by the operating system during actual data transfer. Sometimes the
instructions eliminated are those that enforce security policies as each character is
transferred. A second prominent weakness in operating system security reflects an ambiguity
in access policy. On one hand, we want to separate users and protect their individual
resources.
 The other hand, users depend on shared access to libraries, utility programs, common
data, and system tables. The distinction between isolation and sharing is not always clear at
the policy level, so the distinction cannot be sharply drawn at implementation.
A third potential problem area is incomplete mediation. Recall that Saltzerrecommended an
operating system design in which every requested access was checked for proper
authorization. However, some systems check access only once per user interface operation,
process execution, or machine interval. The mechanism is available to implement full
protection, but the policy decision on when to invoke the mechanism is not complete.
Therefore, in the absence of any explicit requirement, system designers adopt the "most
efficient" enforcement; that is, the one that will lead to the least use of machine resources.
Generality is a fourth protection weakness, especially among commercial operating systems
for large computing systems. Implementers try to provide a means for users to customize
their operating system installation and to allow installation of software packages written by
other companies. Some of these packages, which themselves operate as part of the operating
system, must execute with the same access privileges as the operating system. For example,

51 | P a g e
there are

52 | P a g e
programs that provide stricter access control than the standard control available from the
operating system. The "hooks" by which these packages are installed are also trapdoors for
any user to penetrate the operating system. Thus, several well-known points of security
weakness are common to many commercial operating systems. Let us consider several
examples of actual vulnerabilities that have been exploited to penetrate operating systems.
Testing
Testing is the most widely accepted assurance technique. As Boebert observes, conclusions
from testing are based on the actual product being evaluated, not on some abstraction or
precursor of the product. This realism is a security advantage. However, conclusions based
on testing are necessarily limited, for the following reasons:
 Testing can demonstrate the existence of a problem, but passing tests does not
demonstrate the absence of problems.
 Testing adequately within reasonable time or effort is difficult because the combinatorial
explosion of inputs and internal states makes testing very complex.
 Testing based only on observable effects, not on the internal structure of a product, does
not ensure any degree of completeness.
 Testing based on the internal structure of a product involves modifying the product by
adding code to extract and display internal states. That extra functionality affects the
product's behavior and can itself be a source of vulnerabilities or mask other vulnerabilities.
 Testing real-time or complex systems presents the problem of keeping track of all states
and triggers. This problem makes it hard to reproduce and analyze problems reported as
testers proceed.
Formal Verification
The most rigorous method of analyzing security is through formal verification, which was
introduced in Chapter 3. Formal verification uses rules of mathematical logic to demonstrate
that a system has certain security properties. In formal verification, the operating system is
modeled and the operating system principles are described as assertions. The collection of
models and assertions is viewed as a theorem, which is then proven. The theorem asserts that
the operating system is correct. That is, formal verification confirms that the operating
system provides the security features it should and nothing else.
Proving correctness of an entire operating system is a formidable task, often requiring
months or even years of effort by several people. Computer programs called theorem provers
can assist in this effort, although much human activity is still needed.
Validation
Formal verification is a particular instance of the more general approach to assuring

53 | P a g e
correctness: verification. Validation is the counterpart to verification, assuring that the
system developers have implemented all requirements. Thus, validation makes sure that the
developer is building the right product (according to the specification), and verification
checks the quality of the implementation. There are several different ways to validate an
operating system.
 Requirements checking. One technique is to cross-check each operating system
requirement with the system's source code or execution-time behavior. The goal is to
demonstrate that the system does each thing listed in the functional requirements. This
process is a narrow one, in the sense that it demonstrates only that the system does
everything it should do. In security, we are equally concerned about prevention: making sure
the system does not do the things it is not supposed to do. Requirements checking seldom
addresses this aspect of requirements compliance.
 Design and code reviews. Design and code reviews usually address system correctness
(that is, verification). But a review can also address requirements implementation. To support
validation, the reviewers scrutinize the design or the code to ensure traceability from each
requirement to design and code components, noting problems along the way (including
faults, incorrect assumptions, incomplete or inconsistent behavior, or faulty logic). The
success of this process depends on the rigor of the review.
 System testing. The programmers or an independent test team select data to check the
system. These test data can be organized much like acceptance testing, so behaviors and data
expected from reading the requirements document can be confirmed in the actual running of
the system. The checking is done in a methodical manner to ensure completeness.
3.10. Authentication
In the context of computer systems, authentication is a process that ensures and confirms a
user’s identity. Authentication is one of the five pillars of information assurance (IA). The
other four are integrity, availability, confidentiality and nonrepudiation.
Authentication begins when a user tries to access information. First, the user must prove his
access rights and identity. When logging into a computer, users commonly enter usernames
and passwords for authentication purposes. This login combination, which must be assigned
to each user, authenticates access. However, this type of authentication can be circumvented
by hackers.
A better form of authentication, biometrics, depends on the user’s presence and biological
makeup (i.e., retina or fingerprints). This technology makes it more difficult for hackers to
break into computer systems. The Public Key Infrastructure (PKI) authentication method
uses

54 | P a g e
digital certificates to prove a user’s identity. There are other authentication tools, too, such as
key cards and USB tokens. One of the greatest authentication threats occurs with email,
where authenticity is often difficult to verify. For example, unsecured emails often appear
legitimate. Note:
a) Authentication: The verification an identity claimed by or for a system entity.
b) Authorization:
 Is the granting of a right or permission to a system entity to access a system resource.
 An authorization applies to subjects.
 It determines what a subject can do on the system. Most modern operating systems define
sets of permissions that are variations or extensions of three basic types of access:
1. Read (R): The subject can Read file contents, List directory contents
2. Write (W): The subject can change the contents of a file or directory with the following
tasks:
a. Add, Create, Delete, Rename
3. Execute (X): If the file is a program, the subject can cause the program to be run. (In
Unix systems, the 'execute' permission doubles as a 'traverse directory' permission when
granted for a directory.)
3.11. Identification
Identification and Authentication(I&A) is the process of verifying that an identity is bound
to the entity that makes an assertion or claim of identity. The I&A process assumes that there
was an initial validation of the identity, commonly called identity proofing. Various methods
of identity proofing are available, ranging from in-person validation using government issued
identification, to anonymous methods that allow the claimant to remain anonymous, but
known to the system if they return. The method used for identity proofing and validation
should provide an assurance level commensurate with the intended use of the identity within
the system. Subsequently, the entity asserts an identity together with an authenticator as a
means for validation. The only requirements for the identifier is that it must be unique within
its security domain. Authenticators are commonly based on at least one of the following
four factors:
Something you know, such as a password or a personal identification number (PIN). This
assumes that only the owner of the account knows the password or PIN needed to access the
account. Something you have, such as a smart card or security token. This assumes that only
the owner of the account has the necessary smart card or token needed to unlock the account.

55 | P a g e
Something you are, such as fingerprint, voice, retina, or iris characteristics. Where you are,
for example inside or outside a company firewall, or proximity of login location to a personal
GPS device.
Access Control Elements:
• subject - entity that can access objects
– a process representing user/application
– often have 3 classes: owner, group, world
• object - access controlled resource
– e.g. files, directories, records, programs etc
– number/type depend on environment
access right - way in which subject accesses an object
– e.g. read, write, execute, delete, create, search The basic elements of access control are:
subject, object, and access right.
A subject is an entity capable of accessing objects, usually a process. Any user or application
actually gains access to an object by means of a process that represents it. A subject is
typically held accountable for the actions they have initiated, and an audit trail may be used
to associate with a subject and security relevant actions performed on an object. Basis access
control systems typically define three classes of subject:
• Owner: This may be the creator of a resource, such as a file. For system resources,
ownership may belong to a system administrator. For project resources, a project
administrator or leader may be assigned ownership.
• Group: In addition to the privileges assigned to an owner, a named group of users may also
be granted access rights, such that membership in the group is sufficient to exercise these
access rights.
• World: The least amount of access is granted to users who are able to access the system but
are not included in the categories owner and group for this resource. An object is any
resource to which access is controlled. In general, and object is an entity used to contain
and/or receive information. Examples include records, blocks, pages, segments, files,
portions of files, the number and types of objects to be protected by an access control system
depends on the environment in which access control.
An access right describes the way in which a subject may access an object. Access rights
could include the following: read, write, execute, delete, create, search.
3.12. Review questions
1. Give an example of the use of physical separation for security in a computing environment.

56 | P a g e
 2. Give an example of the use of temporal separation for security in a computing environment.
3. Give an example of an object whose sensitivity may change during execution.
4. Respond to the allegation “An operating system requires no protection for its executable
code (in memory) because that code is a duplicate of code maintained on disk.”
5. Explain how a fence register is used for relocating a user’s program.
6. Can any number of concurrent processes be protected from one another
by just one pair of base/bounds registers?
7. The discussion of base/bounds registers implies that program code is execute only and
that data areas are read-write-only. Is this ever not the case? Explain your answer.
8. A design using tag bits presupposes that adjacent memory locations hold dissimilar
things: a line of code, a piece of data, a line of code, two pieces of data, and so forth. Most
programs do not look like that. How can tag bits be appropriate in a situation in which
programs have the more conventional arrangement of code and data?
9. What are some other modes of access that users might want to apply to code or data, in
addition to the common read, write, and execute permission?
10. A flaw in the protection system of many operating systems is argument passing. Often a
common shared stack is used by all nested routines for arguments as well as for the
remainder of the context of each calling process.
(a) Explain what vulnerabilities this flaw presents.
(b) Explain how the flaw can be controlled. The shared stack is still to be used for passing
arguments and storing context.

57 | P a g e
 Chapter Four

Security Database

Activity 4.1

1. Define the following terms:

 Data
 Database
 DBMS
2. What is database security?
3. Why do we need database security? Justify the
reasons.
4. What is purpose of database security?

58 | P a g e
4.1. Introduction
Database security concerns the use of a broad range of security controls to protect databases
(potentially including the data, the database applications or stored functions, the database
systems, the database servers and the associated network links) against compromises of their
confidentiality, integrity and availability. It involves various types or categories of
controls, such as
1. Technical,
2. Procedural/administrative
3. Physical.
Database security is a specialist topic within the broader realms of computer security,
information security and risk management.

Figure 4.1. Database Security Architecture:

4.2. Security Risks to Database Systems

Unauthorized or unintended activity or misuse by authorized database users: database
administrators, or network/systems managers, or by unauthorized users or hackers (e.g.
inappropriate access to sensitive data, metadata or functions within databases, or
inappropriate changes to the database programs, structures or security configurations);

59 | P a g e
4.2.1. Malware infections
It is causing incidents such as unauthorized access, leakage or disclosure of personal or
proprietary data, deletion of or damage to the data or programs, interruption or denial of
authorized access to the database, attacks on other systems and the unanticipated failure of
database services;
Overloads, performance constraints and capacity issues resulting in the inability of
authorized users to use databases as intended;
Physical damage to database servers caused by computer room fires or floods, overheating,
lightning, accidental liquid spills, static discharge, electronic breakdowns/equipment failures
and obsolescence;
Design flaws and programming bugs in databases and the associated programs and
systems, creating various security vulnerabilities (e.g. unauthorized privilege escalation),
data loss/corruption, performance degradation etc.;
Data corruption and/or loss caused by the entry of invalid data or commands, mistakes in
database or system administration processes, damage/criminal damage etc.
4.3. Database Security Controls
 Access control
 Auditing
 Authentication
 Encryption
 Integrity controls
 Backups
 Application
 security
Scope of the Database Security
Databases have been largely secured against hackers through network security measures such
as firewalls, and network-based intrusion detection systems. Furthermore, implement
database Controls to system, program, function and data access controls, along with the
associated user identification, authentication and rights management functions, have always
been important to limit and in some cases log the activities of authorized users and
administrators. In other words, these are complementary approaches to database security,
working from both the outside-in and the inside-out as it were.
4.4. Threats to The Database
You will build your security skills from two directions. One is from the appreciation and

60 | P a g e
awareness of changing threats, and the other from the technical remedies to them. Threats
include:
 Unauthorized modification: Changing data values for reasons of sabotage, crime or
ignorance which may be enabled by inadequate security mechanisms, or sharing of
passwords or password guessing, for example.
 Unauthorized disclosure: When information that should not have been disclosed has
been disclosed. A general issue of crucial importance, which can be accidental or deliberate.
 Loss of availability: Sometimes called denial of service. When the database is not
available it incurs a loss (otherwise life is better without the system!). So any threat that gives
rise to time offline, even to check whether something has occurred, is to be avoided.
 Commercial sensitivity: Most financial losses through fraud arise from employees.
Access controls provide both protection against criminal acts and evidence of attempts
(successful or otherwise) to carry out acts detrimental to the organization,whether fraud,
extraction of sensitive data or loss of availability.
 Personal privacy and data protection: Personal data is data about an identifiable
individual. Often the individual has to be alive but the method of identification is not
prescribed. So a postal code for a home may in some cases identify an individual, if only one
person is living at an address with the postal code. Such data needs careful handling and
control.
 Computer misuse: There is also generally legislation on the misuse of computers.
Misuse includes the violation of access controls and attempts to cause damage by changing
the database state or introducing worms and viruses to interfere with proper operation. These
offences are often extraditable. So an unauthorized access in Hong Kong using computers in
France to access databases in Germany which refer to databases in America could lead to
extradition to France or Germany or the USA.
 Audit requirements: These are operational constraints built around the need to know
who did what, who tried to do what, and where and when everything happened. They
involve the detection of events (including CONNECT and GRANT transactions), providing
evidence for detection, assurance as well as either defense or prosecution.
4.5. Principles of database security
To structure thoughts on security, you need a model of security. These come in various
forms that depend on roles, degree of detail and purpose. The major categories are areas of
interest (threats, impact and loss) as well as the actions involved in dealing with them.
Security risks are to be seen in terms of the loss of assets. These assets include:

61 | P a g e
  Hardware
 Software
 Data
 Data quality
 Credibility
 Availability
 Business benefit
B2 database and functions can be managed by two different modes of security controls:
1. Authentication
2. Authorization
Authentication
Authentication is the process of confirming that a user logs in only in accordance with the
rights to perform the activities he is authorized to perform. User authentication can be
performed at operating system level or database level itself. By using authentication tools for
biometrics such as retina and figure prints are in use to keep the database from hackers or
malicious users.
The database security can be managed from outside the db2 database system. Here are some
types of security authentication process:
1. Based on Operating System authentications.
2. Lightweight Directory Access Protocol (LDAP)
For DB2, the security service is a part of operating system as a separate product. For
Authentication, it requires two different credentials, those are userid or username, and
password.
Authorization
You can access the DB2 Database and its functionality within the DB2 database system,
which is managed by the DB2 Database manager. Authorization is a process managed by
the DB2 Database manager. The manager obtains information about the current authenticated
user, that indicates which database operation the user can perform or access.
Here are different ways of permissions available for authorization:
 Primary permission: Grants the authorization ID directly.
 Secondary permission: Grants to the groups and roles if the user is a member
 Public permission: Grants to all users publicly.
 Context-sensitive permission: Grants to the trusted context role.

62 | P a g e
4.6. Multi - Instance level authorities:
1. System administration authority (SYSADM)
2. System control authority (SYSCTRL)
3. System maintenance authority (SYSMAINT)
4. System monitors authority (SYSMON)
5. Database authorities
1. System administration authority (SYSADM)
It is highest level administrative authority at the instance-level. Users with SYSADM
authority can execute some databases and database manager commands within the
instance. Users with SYSADM authority can perform the following operations:
 Upgrade a Database
 Restore a Database
 Update Database manager configuration file.
2. System control authority (SYSCTRL)
It is the highest level in System control authority. It provides to perform maintenance and
utility operations against the database manager instance and its databases. These operations
can affect system resources, but they do not allow direct access to data in the database.
Users with SYSCTRL authority can perform the following actions:
 Forcing users off the system-level
 Creating or Dropping a database-level
 Creating, altering, or dropping a table space
 Using any table space
 Restoring Database
3. System maintenance authority (SYSMAINT)
It is a second level of system control authority. It provides to perform maintenance and utility
operations against the database manager instance and its databases. These operations affect
the system resources without allowing direct access to data in the database. This authority is
designed for users to maintain databases within a database manager instance that contains
sensitive [Link] Users with SYSMAINT authorities can perform the following tasks:
1. Taking backup
2. Restoring the backup
3. Roll forward recovery
4. Starting or stopping instance

63 | P a g e
5. Restoring tablespaces
6. Executing db2trc command
7. Query the state of a tablespace
8. Updating log history files
9. Reorganizing of tables
10. Using RUNSTATS (Collection catalog statistics)
4. System monitor authority (SYSMON)
With this authority, the user can monitor or take snapshots of database manager instance or its
database. SYSMON authority enables the user to run the following tasks:
 GET DATABASE MANAGER MONITOR SWITCHES GET MONITOR SWITCHES
 GET SNAPSHOT LIST
 LIST ACTIVE DATABASES LIST APPLICATIONS
 LIST DATABASE PARTITION GROUPS LIST DCS APPLICATIONS
 LIST PACKAGES LIST TABLES
 LIST TABLESPACE CONTAINERS LIST TABLESPACES
 LIST
UTITLITIES RESET
MONITOR
UPDATE MONITOR SWITCHES
4.7. Database Authorities
Each database authority holds the authorization ID to perform some action on the database.
These database authorities are different from privileges. Here is the list of some database
authorities:
ACCESSCTRL: allows to grant and revoke all object privileges and database authorities.
BINDADD: Allows to create a new package in the database.
CONNECT: Allows to connect to the database. CREATETAB:
Allows to create new tables in the database.
CREATE_EXTERNAL_ROUTINE: Allows to create a procedure to be used by applications
and the users of the databases.
DATAACCESS: Allows to access data stored in the database tables.
DBADM: Act as a database administrator. It gives all other database authorities except
ACCESSCTRL, DATAACCESS, and SECADM.
EXPLAIN: Allows to explain query plans without requiring them to hold the privileges to

64 | P a g e
access the data in the tables.
LOAD: Allows to load data into table.
4.8. How to protect Database from Threats?
1. SETSESSIONUSER
Authorization ID privileges involve actions on authorization IDs. There is only one privilege,
called the SETSESSIONUSER privilege. It can be granted to user or a group and it allows
to session user to switch identities to any of the authorization IDs on which the privileges are
granted. This privilege is granted by user SECADM authority.
1. Schema privileges
This privileges involve actions on schema in the database. The owner of the schema has all
the permissions to manipulate the schema objects like tables, views, indexes, packages, data
types, functions, triggers, procedures and aliases. A user, a group, a role, or PUBLIC can be
granted any user of the following privileges:
CREATEIN: allows to create objects within the schema ALTERIN: allows to modify
objects within the schema. DROPIN: allows to delete the objects within the schema.
2. Tablespace privileges
These privileges involve actions on the tablespaces in the database. User can be granted the
USE privilege for the tablespaces. The privileges then allow them to create tables within
tablespaces. The privilege owner can grant the USE privilege with the command WITH
GRANT OPTION on the tablespace when tablespace is created.
Table and view privileges
The user must have CONNECT authority on the database to be able to use table and view
privileges. The privileges for tables and views are as given below:
CONTROL
It provides all the privileges for a table or a view including drop and grant, revoke individual
table privileges to the user.
ALTER
It allows user to modify a table.
DELETE
It allows the user to delete rows from the table or view.
INDEX
It allows the user to insert a row into table or view. It can also run import utility.
REFERENCES
It allows the users to create and drop a foreign key.
SELECT
It allows the user to retrieve rows from a table or view.

65 | P a g e
UPDATE
It allows the user to change entries in a table, view.
4.9. Security plan in database
 Identify the user community.
 Gather the database information.
 Determine the types of user account (i.e. associate database objects and user roles).
 Undertake a threat analysis.
 Establish DBA authorities and procedures.
 Establish policies for managing (creating, deleting, auditing) user accounts.
 Determine the user tracking policy.
 Establish the user identification method.
 Define security incidents and reporting procedure.
 Assess the sensitivity of specific data objects.
 Establish standards and enforcement procedures (as well as back-up and recovery plans,
of course).
4.10. Review Questions
1) Using the two-step commit presented in the beginning of this chapter, describe how to
avoid assigning one seat to two people, as in the airline example. That is, list precisely
which steps the database manager should follow in assigning passengers to seats.
2) Suppose a database manager were to allow nesting of one transaction inside another. That
is, after having updated part of one record, the DBMS would allow you to select another
record, update it, and then perform further updates on the first record. What effect would
nesting have on the integrity of a database? Suggest a mechanism by which nesting could
be allowed.
5) Can a database contain two identical records without a negative effect on the integrity of
the database? Why or why not?
6) Some operating systems perform buffered I/O. In this scheme, an output request is
accepted from a user and the user is informed of the normal I/O completion. However, the
actual physical write operation is performed later, at a time convenient to the operating
system. Discuss the effect of buffered I/O on integrity in a DBMS.

66 | P a g e
 Chapter five
Network Security
Activity 5.1

 What is network security?

 Discuss in details network attack/threat.
 How to stop network attack?
 Explain the mitigation of network attack.
 What is firewall?
 Discuss IDS/IPS.

67 | P a g e
5.1. Introduction
Network security is any system, device, or action designed to protect the safety and
reliability of a network and its data. Like a fence around private land or a lock on a door,
network security manages access to a network by stopping a variety of threats from entering
and spreading through a system. Network security is focused on protecting files, documents,
and information from those types of attacks. Most commonly, network security starts with
authentication in the form of a username and password, but it can also employ other tools
like firewalls, anti-virus programs, and virtual private networks (VPNs) to protect the
network’s information.
5.2. Benefits of Network Security
Secure and reliable networks protect not just organizational interests and operations, but also
any client or customer who exchanges information with the organization, in addition to the
general public. Here are the top benefits a company stands to gain from improved network
security.
 Builds Trust: Security for large systems translates to security for everyone. Network
security boosts client and consumer confidence, and it protects your business from the
reputational and legal fallout of a security breach.
 Mitigates Risk: The right network security solution will help your business stay
compliant with business and government regulations, and it will minimize the business and
financial impact of a breach if it does occur.
 Protects Proprietary Information: clients and customers rely on organizations to
protect their sensitive information. Business relies on that same protection, too. Network
security ensures the protection of information and data shared across the network.
 Enables a more modern workplace: from allowing employees to work securely from
any location using VPN to encouraging collaboration with secure network access, network
security provides options to enable the future of work. Effective network security also
provides many levels of security to scale with your growing business.

5.3. Network security issues

When businesses connect their systems and computers, one user's problems may affect
everyone on the network. Despite the many benefits of using networks, networking raises a
greater potential for security issues such as:
 data loss
 security breaches
 malicious attacks, such as hacking and viruses
Protection with common network security issues

68 | P a g e
Typical preventive measures to help you avoid network security threats include:
 security devices such as firewalls and anti-virus software
 security settings in the router or the operating system
 data encryption systems for sensitive data
 data backup, including the use of off-site backup
 restricting access to the network infrastructure to authorized personnel only
 training staff in the safe and secure use of the equipment
As well as training staff, you should also implement policies and rules for computer use in
the workplace. You should let your staff know that misuse of networked equipment can be
regarded as misconduct and may result in disciplinary action. Find sample IT policies,
disclaimers and notices for your business.
5.4. Threats against networked applications
The possibly external network threat for organization are listed below.
A) Malicious threat:
Malicious threat includes Computer viruses, Trojan, worm and spyware. It is code or
software that is particularly intended to damage, steal, disrupt, or as a rule inflict some other
“terrible” or illegitimate activity on information, hosts, or network.
B) DOS attack:
A Denial-of-Service (DOS) attack is an attack intended to close down a machine or network,
making it unavailable to its intended users.
C) Eavesdropping:
Eavesdropping refers to the unauthorized monitoring of other people’s communications. It
can be conducted on ordinary telephone systems, emails, instant messaging or other Internet
services.
D) Data breaches:
A data breach is an occurrence in which sensitive, secured or confidential data has potentially
been seen, stolen or utilized by an individual unapproved to do as such. In case of small
organization data breaches may involve personal information and intellectual property.
E) Phishing:
Phishing is the process to gain sensitive information like usernames, passwords and credit
card information, frequently for malicious reasons, by taking on the appearance of a
dependable element in an electronic correspondence.
F) D-DOS attack
A distributed Denial of Service (DDOS) attack is a challenge to make an online service
inaccessible by overpowering it with traffic from numerous sources. It focus on wide range

69 | P a g e
banking information and confidential data of any organization.
1. Bots: A bot is a small program that automates web requests with various goals. Bots
perform their tasks without any human intervention, for example, scanning website content
and testing stolen credit card numbers.
A bot attack utilizes automated web requests to defraud, manipulate, or disrupt applications,
websites, end-users, or APIs. Bot attacks were originally used primarily for spam and denial
of service, but have evolved into complex enterprises with economies and infrastructure that
enables waging additional, more damaging attacks.
2. Advanced Persistent Threats (APTs): is a targeted and prolonged attack during which
intruders gain unauthorized access to a network, remaining undetected for an extended
time. Threat actors usually launch APT attacks to steal data rather than cause damage to the
target’s network.
3. Drive-by Download: is the unintentional download of malicious code to a computer or
mobile device, exposing the victim to a cyberattack. Unlike other cyberattacks, a drive-by
does not rely on a user to actively enable the attack. It exploits an application, web
browser, or operating system containing security flaws, which may occur due to a lack of
updates or unsuccessful updates.
4. DNS Attack: occurs when a threat actor exploits vulnerability in a domain name
system (DNS). DNS was designed for usability rather than security. As a result, threat actors
can exploit the communication between clients and servers to launch attacks.
5.5. How to stop this threat?
1. Malicious threat:
Security measure:
a. Install antivirus software into the system and download updates to ensure
that software has the latest fixes for new viruses, Trojans, worms and bots.
b. Ensure that antivirus software can scan email and the all the files
downloaded from the internet.
2. DOS attack:
Security Measure:
a. Using Over-provisioning brute force defense.
b. Configuring windows firewall and IP access lists.
3. Eavesdropping:
Security Measure: An electronic search of the radio frequency (RF) spectrum to
detect any unauthorized emanations from the area being examined.

70 | P a g e
 Use encrypted data using data transmission or conversation.
4. Data breaches:
Security measure:
a. Encrypting all the sensitive information and shred them before disposing.
b. Retain the third party and limiting the staffs to access system and devices.
5. Phishing:
Security Measure:
a. Keep websites certificates up to date so that users are assured the legitimacy
of the websites.
b. Educate users about the best practices that they should follow and
observe when using Internet services.
6. D-DOS attack
Security Measure:
a. Limit the rate of router to prevent form web server being overwhelmed
b. Use of firewall and pack sniffing technique for controlling high packet traffic
5.6. Network Security Vulnerabilities
In computer security, vulnerability is a weakness that can be exploited by a threat actor,
usually for malicious purposes. Vulnerabilities can be found in many different areas of a
system, including hardware, software, networks, and even people. There are four main types
of security vulnerabilities:
 Misconfigurations: Incorrectly configured systems and applications are often the
weakest links in an organization’s security posture. A poorly configured firewall in
cybersecurity, weak passwords, and leaving default accounts active are all examples of
common misconfigurations that can lead to serious security vulnerabilities.
 Unsecured APIs: Many modern applications rely on application programming interfaces
(APIs) to function properly. However, if APIs are not properly secured, they can be a serious
security vulnerability. Attackers can exploit unsecured APIs to gain access to sensitive data
or even take control of entire systems.
 Outdated or Unpatched Software: Software vulnerabilities are often the root cause of
major security breaches. Outdated software is especially vulnerable, as attackers can exploit
known weaknesses that have already been patched in newer versions. Unpatched software is
also a major security risk, as many organizations fail to apply critical security updates in a
timely manner.

71 | P a g e
 Zero-Day Vulnerability: Zero-day vulnerability is a previously unknown security flaw
exploited by attackers before the vendor has patched it. These types of vulnerabilities are
extremely dangerous, as there is usually no way to defend against them until after they have
been exploited.
5.7. TCP/IP Suite Weaknesses and Buffer Flow
TCP/IP protocol suite is the defacto protocol suite used by the Internet. Common attack
techniques that target TCP/IP protocol suite are the followings:
 Sniffing: Sniffing is eavesdropping on the network. A (packet) sniffer is a wire-tap
program. Sniffing is the act by machine S of making copies of a network packet sent by
machine A intended to be received by machine B. Sniffing can be used for monitoring the
health of a network as well as capturing the passwords used in telnet, rlogin, and FTP
connections.
 Buffer Overflow: Many of these server programs run with the privileges of a super user.
Among the many servers that suffer from such bugs are several implementations of FTP
servers, the ubiquitous DNS server program called bind, the popular mail server called
sendmail, and the Web server IIS, to name a few. An attacker supplies cleverly constructed
inputs to such programs causing them to transfer control to executable code they have
supplied. A typical code produces a shell that she can interact with from a remote machine
with all the privileges of the super user.
 Spoofing: Spoofing refers to altering (portions of) a packet so that the overall packet
remains structurally legitimate (e.g., checksums are valid) but the “info” it contains is fake.
Spoofing often accompanies sniffing, but may newly manufacture packets with fake values.
Spoofed packets are injected into the network.
 Poisoning: Many network services are essentially mappings implemented as table
lookups. The mappings are dynamic, and update methods are well-defined. Unfortunately,
who is qualified to provide the updates, and how messages that provide update information
are to be authenticated are ill-defined. An attacker takes advantage of this, and provides fake
updates causing the table to be “poisoned.”
 TCP “SYN” Attack: This attack is caused by the three-way handshake mechanism used
between host and the server to setup connection. A server has limited resources. Once it
responds to a SYN request using SYN ACK it sets aside resources for this connection and
listens for ACK from client. If the attacker sends multiple SYN within very short interval
then the server will exhaust its resources. The attacker does not respond to SYN ACK sent
by the

72 | P a g e
server and the connections are left half opened. This ways server is unable to respond to
further connection request because of exhaustion of resources and denial of service takes
place.
 Connection Hijacking: Authentication between two hosts takes place during the initial
stages of the connection setup. Thenceforth no authentication is required. The attacker can
take advantage of this by sending a reset to the client and killing the connection for the client
and then the attacker spoofs the client and continues session with server.
5.8. Network Security Protocols
Network security entails securing data against attacks while it is in transit on a network. To
achieve this goal, many real-time security protocols have been designed. Such protocol needs
to provide at least the following primary objectives:
 The parties can negotiate interactively to authenticate each other.
 Establish a secret session key before exchanging information on network.
 Exchange the information in encrypted form.
Interestingly, these protocols work at different layers of networking model. For example,
S/MIME (Secure/Multipurpose Internet Mail Extensions) protocol works at Application
layer, SSL (Secure Socket Layer) protocol is developed to work at transport layer, and IPsec
(IP Security) protocol works at Network layer.
5.9. Application Layer Security
Email Security
Growing use of e-mail communication for important and crucial transactions demands
provision of certain fundamental security services as the following:
 Confidentiality − E-mail message should not be read by anyone but the intended
recipient.
 Authentication − E-mail recipient can be sure of the identity of the sender.
 Integrity − Assurance to the recipient that the e-mail message has not been altered
since it was transmitted by the sender.
 Non-repudiation − E-mail recipient is able to prove to a third party that the sender
really did send the message.
 Proof of submission − E-mail sender gets the confirmation that the message is
handed to the mail delivery system.
 Proof of delivery − Sender gets a confirmation that the recipient received the message.
 Security services such as privacy, authentication, message integrity, and non-
repudiation are usually provided by using public key cryptography.

73 | P a g e
  Here are the protocols and schemes used in email security.
 Pretty Good Privacy (PGP) is an e-mail encryption scheme. It works at an
application layer. It has become the de-facto standard for providing security services
for e-mail communication.
 S/MIME: S/MIME is a secure e-mail standard. It is based on an earlier non-secure e-
mailing standard called MIME.
 A secure e-email communication in a captive network can be provided by adapting to
PGP. For e-mail security over Internet, where mails are exchanged with new
unknown users very often, S/MIME is considered as a good option.
5.9.1. Web Security
Secure web browsing is provided by HTTPS (Secured HTTP). It stands for HTTP over SSL.
This protocol is used to provide the encrypted and authenticated connection between the
client web browser and the website server. The secure browsing through HTTPS ensures that
the following content are encrypted:
 URL of the requested web page.
 Web page contents provided by the server to the user client.
 Contents of forms filled in by user.
 Cookies established in both directions.
Secured Shell Protocol (SSH)
 SSH is a network protocol that runs on top of the TCP/IP layer. It is designed to replace
the TELNET which provided unsecure means of remote logon facility.
 SSH provides a secure client/server communication and can be used for tasks such as file
transfer and e-mail.
 SSH2 is a prevalent protocol which provides improved network communication security
over earlier version SSH1.
5.9.2. Transport Layer Security
The security at this layer is mostly used to secure HTTP based web transactions on a
network. However, it can be employed by any application running over TCP. The main
protocols that provides security scheme at the transport layer are TLS and SSL.
Transport Layer Security (TLS)
TLS protocols operate above the TCP layer. Design of these protocols uses popular
Application Program Interfaces (API) to TCP, called “sockets" for interfacing with TCP
layer. Applications are now interfaced to Transport Security Layer instead of TCP directly.
Transport Security Layer provides a simple API with sockets, which is similar and
analogous to TCP's

74 | P a g e
API. TLS is designed to operate over TCP, the reliable layer 4 protocol (not on UDP
protocol), to make design of TLS much simpler, because it doesn't have to worry about
‘timing out’ and ‘retransmitting lost data’. The TCP layer continues doing that as usual
which serves the need of TLS.
Secure Socket Layer (SSL)
SSL provides network connection security through confidentiality, authentication and
reliability. It is available for all TCP applications and is support by almost all web browsers.
It provides ease in doing business with new online entities. It developed primarily for web e-
commerce.
5.9.3. Network Layer Security
Internet Protocol Security (IPSec)
The popular framework developed for ensuring security at network layer is Internet Protocol
Security (IPsec). The important security functions provided by the IPsec are as follows:
 Confidentiality: Enables communicating nodes to encrypt messages. Prevents
eavesdropping by third parties.
 Origin authentication and data integrity: Provides assurance that a received packet
was actually transmitted by the party identified as the source in the packet header. Confirms
that the packet has not been altered or otherwise.
 Key Management: Allows secure exchange of keys. Protection against certain types of
security attacks, such as replay attacks.
IPsec provides an easy mechanism for implementing Virtual Private Network (VPN) for
medium to large institutions. VPN technology allows institution’s inter-office traffic to be
sent over public Internet by encrypting traffic before entering the public Internet and
logically separating it from other traffic.
5.9.4. Link Layer Security
Data link Layer in Ethernet networks is highly prone to several attacks. The most common
attacks are ARP Spoofing (the process of modifying a target host’s ARP cache with a forged
entry), MAC Flooding (the attacker floods the switch with MAC addresses using forged ARP
packets until the CAM1 table is full), Port Stealing (an attack that exploits the ability of a
switch to bind MAC to ports). Several methods have been developed to mitigate these types
of attacks. Some of the important methods are:
Port Security

1
Content Addressable Memory is a table on a switch that stores the MAC addresses, switch port numbers and
other info.

75 | P a g e
It is a feature available on intelligent Ethernet switches. By default, port security limits the
ingress MAC address count to one. The port can be configured to shut down or block the
MAC addresses that exceed a specified limit.
DHCP Snooping
DHCP spoofing is an attack where the attacker listens for DHCP requests from host on the
network and answers them with fake DHCP response before the authorized DHCP response
comes to the host. DHCP snooping can prevent such attacks. DHCP snooping is a switch
feature. Switch can be configured to determine which switch ports can respond to DHCP
requests. Switch ports are identified as trusted or untrusted ports.
Spanning Tree Protocol (STP)
In order to provide desired path redundancy, as well as to avoid a loop condition, STP
defines a tree that spans all the switches in a network. STP forces certain redundant data links
into a blocked state and keeps other links in a forwarding state.
5.9.5. Physical Security
Restricting access to the devices on network is a very essential step for securing a network.
Since network devices comprise of communication as well as computing equipment,
compromising these can potentially bring down an entire network and its resources.
Paradoxically, many organizations ensure excellent security for their servers and applications
but leave communicating network devices with rudimentary security.
An important aspect of network device security is access control and authorization. Many
protocols have been developed to address these two requirements and enhance network
security to higher levels.
5.10. User Authentication and Authorization
User authentication is necessary to control access to the network systems, in particular
network infrastructure devices. Authentication has two aspects: general access authentication
and functional authorization. General access authentication is the method to control whether
a particular user has “any” type of access right to the system he is trying to connect to.
Usually, this kind of access is associated with the user having an “account” with that system.
Authorization deals with individual user “rights”. For example, it decides what can a user do
once authenticated; the user may be authorized to configure the device or only view the data.
User authentication depends up on factors that include something he knows (password),
something he has (cryptographic token/Card), or something he is (biometric). The use of
more than one factor for identification and authentication provides the basis for Multifactor
authentication.

76 | P a g e
Password Based Authentication
At a minimum level, all network devices should have username-password authentication.
The password should be non-trivial (at least 10 character, mixed alphabets, numbers, and
symbols). In case of remote access by the user, a method should be used to ensure usernames
and passwords are not passed in the clear over the network. Also, passwords should also be
changed with some reasonable frequency.
Centralized Authentication Methods
Individual device based authentication system provides a basic access control measure.
However, a centralized authentication method is considered more effective and efficient
when the network has large number of devices with large numbers of users accessing these
devices. Traditionally, centralized authentication was used to solve problems faced in remote
network access. In Remote Access Systems (RAS), the administration of users on the
network devices is not practical. Placing all user information in all devices and then keeping
that information up-to-date is an administrative nightmare.
Centralized authentication systems, such as RADIUS and Kerberos, solve this problem.
These centralized methods allow user information to be stored and managed in one place.
These systems can usually be seamlessly integrated with other user account management
schemes such as Microsoft’s Active Directory or LDAP directories. Most RADIUS servers
can communicate with other network devices in the normal RADIUS protocol and then
securely access account information stored in the directories.
[Link]. Access Control Lists
Many network devices can be configured with access lists. These lists define hostnames or IP
addresses that are authorized for accessing the device. It is typical, for instance, to restrict
access to network equipment from IPs except for the network administrator. This would then
protect against any type of access that might be unauthorized. These types of access lists
serve as an important last defense and can be quite powerful on some devices with different
rules for different access protocols.
[Link]. Wireless Security
Wireless security is the protection of wireless networks, devices and data from unwanted
access and breaches. It involves a variety of strategies and practices designed to preserve the
confidentiality, integrity and availability of wireless networks and their resources. Wireless
networks broadcast data using radio waves, which can be intercepted by anybody within the
network range. As a result, wireless networks are prone to eavesdropping, illegal access and
theft. Using security measures such as encryption protocols, access control rules, and

77 | P a g e
authentication procedures prevents unauthorized access and safeguards these wireless
networks. A wireless network can be a cellular network, wireless LAN or other sensor or
communications network, but Wi-Fi is the wireless network protocol people are generally
most familiar with.
Wireless security protocols encrypt data transmitted over wireless networks to prevent
unauthorized access and eavesdropping. They also provide authentication mechanisms to
verify the identity of users and devices attempting to access the network. These protocols
implement access control rules to determine which users or devices are allowed on the
network and what their access level is.
 Wired Equivalent Privacy (WEP): employs a shared key authentication mechanism and
the RC4 encryption algorithm to encrypt data. However, this protocol is outdated and
considered insecure because it is easily hackable.
 Wi-Fi Protected Access (WPA): is an improvement of WEP introduced in 2003. It
provides stronger security measures like message integrity checks and improved key
management. WPA uses the Temporal Key Integrity Protocol (TKIP) encryption algorithm,
but is still vulnerable to attacks.
 Wi-Fi Protected Access II (WPA2): introduced in 2004, remains the most popular
wireless security protocol. It uses the Counter Mode Cipher Block Chaining Message
Authentication Code Protocol (CCMP) based on the Advanced Encryption Standard (AES)
encryption algorithm for stronger security measures. WPA2 is basically an upgraded version
of WPA since it features improved management and is less vulnerable to attacks.
 Wi-Fi Protected Access III (WPA3): is the latest wireless security protocol and offers
enhanced security features such as stronger encryption, protection against dictionary attacks
and individualized data encryption. Announced in 2018 by the Wi-Fi Alliance, WPA3
simplifies the process of configuring devices with little to no display interface, such as IoT
devices, by introducing Wi-Fi Easy Connect. This works by allowing the IoT device to
present a QR code or a Near Field Communication (NFC) tag, which the user can scan with
their device to establish a secure Wi-Fi connection. Despite advances like stronger encryption
and more secure key exchange, WPA3 has yet to gain much traction among users.
5.11. Introduction to Secure Network Design
All information systems create risks to an organization, and whether or not the level of risk
introduced is acceptable is ultimately a business decision. Controls such as firewalls, resource
isolation, hardened system configurations, authentication and access control systems, and

78 | P a g e
encryption can be used to help mitigate identified risks to acceptable levels.

5.11.1. Designing Security into a Network

Security is often an overlooked aspect of network design, and attempts at retrofitting security
on top of an existing network can be expensive and difficult to implement properly. Separating
assets of differing trust and security requirements should be an integral goal during the design
phase of any new project. Aggregating assets that have similar security requirements in
dedicated zones allows an organization to use small numbers of network security devices, such
as firewalls and intrusion-detection systems, to secure and monitor multiple application
systems.
Other influences on network design include budgets, availability requirements, the network’s
size and scope, future growth expectations, capacity requirements, and management’s
tolerance of risks. For example, dedicated WAN links to remote offices can be more reliable
than virtual private networks (VPNs), but they cost more, especially when covering large
distances. Fully redundant networks can easily recover from failures, but having duplicate
hardware increases costs, and the more routing paths available, the harder it is to secure and
segregate traffic flows. A significant but often missed or under-considered factor in determining
an appropriate security design strategy is to identify how the network will be used and what is
expected from the business
it supports. This design diligence can help avoid expensive and difficult retrofits after the network
is implemented. Let’s consider some key network design strategies.

5.11.2. Firewalls
What is a Firewall?
A firewall is simply a program or network devices that filters the information coming through
the internet connection into your private network or computer system.
In computing, a firewall is a network security system that monitors and controls incoming and
outgoing network traffic based on predetermined security rules. A firewall typically establishes a
barrier between a trusted internal network and untrusted external network, such as the
Internet. Firewalls are often categorized as either network firewalls or host-based firewalls.
Network firewalls filter traffic between two or more networks and run on network hardware.
Host-based firewalls run on host computers and control network traffic in and out of those
machines.

79 | P a g e
 What is an Application Firewall?
 Application Fire wall is a special firewall that is specifically coded
(Software Programs) for the type of traffic it is inspecting.
 Example: The most widely developed application firewall is the web
application firewall.
Difference between Host based & Network based Firewall
 A host-based firewall is installed on the individual computer to protect it
from activity occurring on its network.
 A network-based firewall is implemented at a specific point i n the network path
and protects all computers on the “internal” side of the firewall from all
computers on the external side of the fire wall.
Hardware and Software Firewall:
 Hardware firewalls are integrated into the router that sits between a computer
and the internal.
 Software firewalls are integrated on individual servers. They intercept each
connection request and then determine whether the request is valid or
not.
Three Design goals of Firewalls.
 The first design goal for a firewall is that collectively the sum of all the network
from internal to external must go through the firewall physically cutting off all
access to the local network except via firewall. Example: Security Guard in the
commercial Bank of Ethiopia, Ambo Main Branch.
 The second goal would be only authorized traffic which is delineated by the local

80 | P a g e
 security policy will be allowed to proceed. Example: The Bank Manager informed
the security Guard to Block A & B.
Finally, the last design goal is that the firewall itself is resistant to penetration
inclusive in a solid trustworthy system with a protected operating system.
Example: Here the security guard himself/herself act as an intellectual to block few
peoples.
Types of Firewalls:
1. Packet Filtering Router
2. Application Level Gateway
3. Circuit Level Gateway
1. Packet Filtering Router
 Applies a set of rules to each incoming IP packets and then forwards or
discards the packets.
 Filter packets going in both directions.
 The packet filter is typically set up as a list of rules based on matches in the IP
or TCP header.

Application Level Gateway

81 | P a g e
  Also called as proxy server.
 Acts as a relay of application level traffic.
 It is used to check the traffic levels.
Circuit Level Gateway

 Standalone Software.
 Sets up two TCP connections.
 The gateways typically relays TCP segments from one connection to the other
without examining the contents (simply it will send).
 The Security functions consists of determining which connections will be allowed.
The Role of Firewalls
 A firewall is a term used for a “barrier” between a network of machines and
users that operate under a common security policy and generally trust each
other and the outside world.
 There are two basic reasons for using a firewall at present: to save money in
concentrating your security on a small number of components, and to simplify
the architecture of a system by restricting access only to machines that trust
each other.
Advantages of Firewalls
 Concentration of security all modified software and logging is located on the
firewall system as opposed to being distributed many hosts.
 Protocol Filtering, where the firewalls filters protocols and services that are
either not necessary or that cannot be adequately secured from exploitation.
 Information Hiding, in which a firewall can “hide” names of internal systems

82 | P a g e
 (or) electronic mail addresses, thereby revealing less information to outside
hosts.
 Application Gateways, where the firewalls requires inside or outside users to
connect first to the firewall before connecting further, thereby filtering the
protocol.
Disadvantages of Firewalls
o The most obvious being that certain types of network access may be
hampered or even blocked for some hosts, including telnet, ftp, NFS etc.
o A second disadvantages with a firewall system is that it concentrates security in
one spot as opposed to distributing it among systems, thus a compromised of
the firewall could be disastrous to other less protected systems on the subnet.
Example: If someone attacks the security guard, the organization face more
risks.
Table 5.1 :Comparison of Firewall types
Packet Filtering Sateful Inspection Application Guard Personal firewall
Proxy
Simple More complex Even complex Most complex Similar to
packet filtering

Sees only Can see either Sees full data Sees full text of Can see full data
addresses and addresses or data portion of packet communication portionof packet
service protocol
type
Auditing difficult Auditing possible Can audit Can audit Can and usually
activity activity does audit
activity
Screens based on Screens based Screens based on Screens based on Typically, screens
connection rules on behavior of interpretation of based
information across proxies message contents on information in
packetsin either a single packet,
header or data using header or
field data

83 | P a g e
Complex Usually Simple proxies Complex guard Usually starts in
addressing rules preconfigured to can substitute for functionality can "deny all
can make detect certain complex limit assurance inbound" mode,
configuration attack signatures addressing rules to which user
tricky adds trusted
addresses as
they appear

5.11.3. Intrusion Detection System

An intrusion detection system (IDS) is a device, typically another separate computer, that
monitors activity to identify malicious or suspicious events. An IDS is a sensor, like a smoke
detector, that raises an alarm if specific things occur. A model of an IDS is shown in below
figure. The components in the figure are the four basic elements of an intrusion detection
system, based on the Common Intrusion Detection Framework of [STA96]. An IDS receives
raw inputs from sensors. It saves those inputs, analyzes them, and takes some controlling
action.
Types of IDSs:
The two general types of intrusion detection systems are signature based and heuristic.
Signature-based intrusion detection systems perform simple pattern-matching and report
situations that match a pattern corresponding to a known attack type. Heuristic intrusion
detection systems, also known as anomaly based, build a model of acceptable behavior and
flag exceptions to that model; for the future, the administrator can mark a flagged behavior as
acceptable so that the heuristic IDS will now treat that previously unclassified behavior as
acceptable.
Intrusion detection devices can be network based or host based. A network-based IDS is a
stand-alone device attached to the network to monitor traffic throughout that network; a host-
based IDS runs on a single workstation or client or host, to protect that one host.
Signature-Based Intrusion Detection:
A simple signature for a known attack type might describe a series of TCP SYN packets sent
to many different ports in succession and at times close to one another, as would be the case
for a port scan. An intrusion detection system would probably find nothing unusual in the
first SYN, say, to port 80, and then another (from the same source address) to port 25. But as
more and more ports receive SYN packets, especially ports that are not open, this pattern
reflects a possible port scan. Similarly, some implementations of the protocol stack fail if
they receive

84 | P a g e
an ICMP packet with a data length of 65535 bytes, so such a packet would be a pattern for
which to watch.
Heuristic Intrusion Detection:
Because signatures are limited to specific, known attack patterns, another form of intrusion
detection becomes useful. Instead of looking for matches, heuristic intrusion detection looks
for behavior that is out of the ordinary. The original work in this area focused on the
individual, trying to find characteristics of that person that might be helpful in understanding
normal and abnormal behavior. For example, one user might always start the day by reading
e-mail, write many documents using a word processor, and occasionally back up files. These
actions would be normal. This user does not seem to use many administrator utilities. If that
person tried to access sensitive system management utilities, this new behavior might be a
clue that someone else was acting under the user's identity.
Inference engines work in two ways. Some, called state-based intrusion detection systems,
see the system going through changes of overall state or configuration. They try to detect
when the system has veered into unsafe modes. Others try to map current activity onto a
model of unacceptable activity and raise an alarm when the activity resembles the model.
These are called model-based intrusion detection systems. This approach has been extended
to networks in [MUK94]. Later work sought to build a dynamic model of behavior, to
accommodate variation and evolution in a person's actions over time. The technique
compares real activity with a known representation of normality.
Alternatively, intrusion detection can work from a model of known bad activity. For
example, except for a few utilities (login, change password, create user), any other attempt to
access a password file is suspect. This form of intrusion detection is known as misuse
intrusion detection. In this work, the real activity is compared against a known suspicious
area.
Stealth Mode:
An IDS is a network device (or, in the case of a host-based IDS, a program running on a
network device). Any network device is potentially vulnerable to network attacks. How
useful would an IDS be if it itself were deluged with a denial-of-service attack? If an attacker
succeeded in logging in to a system within the protected network, wouldn't trying to disable
the IDS be the next step?
To counter those problems, most IDSs run in stealth mode, whereby an IDS has two network
interfaces: one for the network (or network segment) being monitored and the other to
generate alerts and perhaps other administrative needs. The IDS uses the monitored interface
as input only; it never sends packets out through that interface. Often, the interface is

85 | P a g e
configured so that the device has no published address through the monitored interface; that
is, a router cannot route anything to that address directly, because the router does not know
such a device exists. It is the perfect passive wiretap. If the IDS needs to generate an alert, it
uses only the alarm interface on a completely separate control network.
Goals for Intrusion Detection Systems:
1. Responding to alarms:
Whatever the type, an intrusion detection system raises an alarm when it finds a match. The
alarm can range from something modest, such as writing a note in an audit log, to something
significant, such as paging the system security administrator. Particular implementations
allow the user to determine what action the system should take on what events.
In general, responses fall into three major categories (any or all of which can be used in a
single response):
◻ Monitor, collect data, perhaps increase amount of data collected
◻ Protect, act to reduce exposure
◻ Call a human
2. False Results:
Intrusion detection systems are not perfect, and mistakes are their biggest problem. Although
an IDS might detect an intruder correctly most of the time, it may stumble in two different
ways: by raising an alarm for something that is not really an attack (called a false positive, or
type I error in the statistical community) or not raising an alarm for a real attack (a false
negative, or type II error). Too many false positives means the administrator will be less
confident of the IDS's warnings, perhaps leading to a real alarm's being ignored. But false
negatives mean that real attacks are passing the IDS without action. We say that the degree of
false positives and false negatives represents the sensitivity of the system. Most IDS
implementations allow the administrator to tune the system's sensitivity, to strike an
acceptable balance between false positives and negatives.
IDS strength and limitations:
On the upside, IDSs detect an ever-growing number of serious problems. And as we learn
more about problems, we can add their signatures to the IDS model. Thus, over time, IDSs
continue to improve. At the same time, they are becoming cheaper and easier to administer.
On the downside, avoiding an IDS is a first priority for successful attackers. An IDS that is
not well defended is useless. Fortunately, stealth mode IDSs are difficult even to find on an
internal network, let alone to compromise. IDSs look for known weaknesses, whether
through patterns

86 | P a g e
of known attacks or models of normal behavior. Similar IDSs may have identical
vulnerabilities, and their selection criteria may miss similar attacks. Knowing how to evade a
particular model of IDS is an important piece of intelligence passed within the attacker
community. Of course, once manufacturers become aware of a shortcoming in their products,
they try to fix it. Fortunately, commercial IDSs are pretty good at identifying attacks.
Another IDS limitation is its sensitivity, which is difficult to measure and adjust. IDSs will
never be perfect, so finding the proper balance is critical.
In general, IDSs are excellent additions to a network's security. Firewalls block traffic to
particular ports or addresses; they also constrain certain protocols to limit their impact. But
by definition, firewalls have to allow some traffic to enter a protected area.
Watching what that traffic actually does inside the protected area is an IDS's job, which it
does quite well.
5.12. Review of question
1. The FTP protocol is relatively easy to proxy; the firewall decides, for example, whether
an outsider should be able to access a particular directory in the file system and issues a
corresponding command to the inside file manager or responds negatively to the outsider.
Other protocols are not feasible to proxy.
List three protocols that it would be prohibitively difficult or impossible to proxy. Explain
your answer.
2. How would the content of the audit log differ for a screening router versus an
application proxy firewall?
3. Cite a reason why an organization might want two or more firewalls on a single network.
4. Firewalls are targets for penetrators. Why are there few compromises of
firewalls? not?
Should a network administrator put a firewall in front of a honey pot? Why or why
5. Can a firewall block attacks using server scripts, such as the attack in which the user
could change a price on an item offered by an e-commerce site? Why or why not?
6. Why does a stealth mode IDS need a separate network to communicate alarms and to
accept management commands?
7. One form of IDS starts operation by generating an alert for every action. Over time, the
administrator adjusts the setting of the IDS so that common, benign activities do not generate
alarms. What are the advantages and disadvantages of this design for an IDS?
8. Can encrypted e-mail provide verification to a sender that a recipient has read an e- mail
message? Why or why not?
9. Can message confidentiality and message integrity protection be applied to the same
message? Why or why not?
10. What are the advantages and disadvantages of an e-mail program that automatically
applies and removes protection to e-mail messages between sender and receiver?

87 | P a g e
 Chapter Six

Administering Security

Activity 6.1

 What is security policy?

 What is security procedure?
 Define security plan.
 Why security plan is need?

88 | P a g e
6.1. Security planning
A security plan identifies and organizes the security activities for a computing system. The
plan is both a description of the current situation and a plan for improvement. Every security
plan must address seven issues.
1. Policy, indicating the goals of a computer security effort and the willingness of the people
involved to work to achieve those goals
2. Current state, describing the status of security at the time of the plan
3. Requirements, recommending ways to meet the security goals
4. Recommended controls, mapping controls to the vulnerabilities identified in the policy
and requirements
5. Accountability, describing who is responsible for each security activity
6. Timetable, identifying when different security functions are to be done
7. Continuing attention, specifying a structure for periodically updating the security plan
1. Policy:
The policy statement should specify the following:
 The organization's goals on security. For example, should the system protect data from
leakage to outsiders, protect against loss of data due to physical disaster, protect the data's
integrity, or protect against loss of business when computing resources fail?
What is the higher priority: serving customers or securing data?
 Where the responsibility for security lies. For example, should the responsibility rest with
a small computer security group, with each employee, or with relevant managers?
 The organization's commitment to security. For example, who provides security
support for staff, and where does security fit into the organization's structure?
2. Current Security Status:
To be able to plan for security, an organization must understand the vulnerabilities to which
it may be exposed. The organization can determine the vulnerabilities by performing a risk
analysis: a careful investigation of the system, its environment, and the things that might go
wrong. The risk analysis forms the basis for describing the current status of security. The
status can be expressed as a listing of organizational assets, the security threats to the assets,
and the controls in place to protect the assets.
The status portion of the plan also defines the limits of responsibility for security. It describes
not only which assets are to be protected but also who is responsible for protecting them. The
plan may note that some groups may be excluded from responsibility; for example,joint
ventures with other organizations may designate one organization to provide security for all

89 | P a g e
member organizations. The plan also defines the boundaries of responsibility, especially
when networks are involved. For instance, the plan should clarify who provides the security
for a network router or for a leased line to a remote site.
Even though the security plan should be thorough, there will necessarily be vulnerabilities
that are not considered. These vulnerabilities are not always the result of ignorance rather,
they can arise from the addition of new equipment or data as the system [Link] can
also result from new situations, such as when a system is used in ways not anticipated by its
designers. The security plan should detail the process to be followed when someone
identifies a new vulnerability. In particular, instructions should explain how to integrate
controls for that vulnerability into the existing security procedures.
3. Requirements:
The heart of the security plan is its set of security requirements: functional or performance
demands placed on a system to ensure a desired level of security. The requirements are
usually derived from organizational needs. Sometimes these needs include the need to
conform to specific security requirements imposed from outside, such as by a government
agency or a commercial standard.
4. Recommended Controls:
The security requirements lay out the system's needs in terms of what should be protected.
The security plan must also recommend what controls should be incorporated into the system
to meet those requirements. Throughout this book you have seen many examples of controls,
so we need not review them here. As we see later in this chapter, we can use risk analysis to
create a map from vulnerabilities to controls. The mapping tells us how the system will meet
the security requirements. That is, the recommended controls address implementation issues:
how the system will be designed and developed to meet stated security requirements.
5. Responsibility for Implementation:
A section of the security plan should identify which people are responsible for implementing
the security requirements. This documentation assists those who must coordinate their
individual responsibilities with those of other developers. At the same time, the plan makes
explicit who is accountable should some requirement not be met or some vulnerability not be
addressed. That is, the plan notes who is responsible for implementing controls when a new
vulnerability is discovered or a new kind of asset is introduced.
People building, using, and maintaining the system play many roles. Each role can take some
responsibility for one or more aspects of security. Consider, for example, the groups listed
here.

90 | P a g e
◻ Personal computer users may be responsible for the security of their own machines.
Alternatively, the security plan may designate one person or group to be coordinator of
personal computer security.
◻ Project leaders may be responsible for the security of data and computations.
6. Timetable:
A comprehensive security plan cannot be executed instantly. The security plan includes a
timetable that shows how and when the elements of the plan will be performed. These dates
also give milestones so that management can track the progress of implementation.
7. Continuing Attention:
Good intentions are not enough when it comes to security. We must not only take care in
defining requirements and controls, but we must also find ways for evaluating a system's
security to be sure that the system is as secure as we intend it to be. Thus, the security plan
must call for reviewing the security situation periodically. As users, data, and equipment
change, new exposures may develop. In addition, the current means of control may become
obsolete or ineffective (such as when faster processor times enable attackers to break an
encryption algorithm). The inventory of objects and the list of controls should periodically be
scrutinized and updated, and risk analysis performed anew.
6.2. Security Planning Team Members
The membership of a computer security planning team must somehow relate to the different
aspects of computer security described in this book. Security in operating systems and
networks requires the cooperation of the systems administration staff. Program security
measures can be understood and recommended by applications programmers. Physical
security controls are implemented by those responsible for general physical security, both
against human attacks and natural disasters. Finally, because controls affect system users, the
plan should incorporate users' views, especially with regard to usability and the general
desirability of controls. Thus, no matter how it is organized, a security planning team should
represent each of the following groups:
 Computer hardware group
 System administrators
 Systems programmers
 Applications programmers
 Data entry personnel
 Physical security personnel
 Representative users

91 | P a g e
In some cases, a group can be adequately represented by someone who is consulted at
appropriate times, rather than a committee member from each possible constituency being
enlisted.
6.2.1. Assuring Commitment To a security plan:
After the plan is written, it must be accepted and its recommendations carried out.
Acceptance by the organization is key; a plan that has no organizational commitment is
simply a plan that collects dust on the shelf. Commitment to the plan means that security
functions will be implemented and security activities carried out. Three groups of people
must contribute to making the plan a success.
 The planning team must be sensitive to the needs of each group affected by the plan.
 Those affected by the security recommendations must understand what the plan means
for the way they will use the system and perform their business activities. In particular, they
must see how what they do can affect other users and other systems.
 Management must be committed to using and enforcing the security aspects of the
system. Management commitment is obtained through understanding. But this understanding
is not just a function of what makes sense technologically; it also involves knowing the cause
and the potential effects of lack of security. Managers must also weigh tradeoffs in terms of
convenience and cost. The plan must present a picture of how cost effective the controls are,
especially when compared to potential losses if security is breached without the controls.
Thus, proper presentation of the plan is essential, in terms that relate to management as well
as technical concerns.
Management is often reticent to allocate funds for controls until the value of those controls is
explained. As we note in the next section, the results of a risk analysis can help communicate
the financial tradeoffs and benefits of implementing controls. By describing vulnerabilities in
financial terms and in the context of ordinary business activities (such as leaking data to a
competitor or an outsider), security planners can help managers understand the need for
controls.
The plans we have just discussed are part of normal business. They address how a business
handles computer security needs. Similar plans might address how to increase sales or
improve product quality, so these planning activities should be a natural part of management.
Next we turn to two particular kinds of business plans that address specific security
problems: coping with and controlling activity during security incidents.
6.2.2. Business Continuity Plan
A business continuity plan documents how a business will continue to function during a

92 | P a g e
computer security incident. An ordinary security plan covers computer security during
normal times and deals with protecting against a wide range of vulnerabilities from the usual
sources. A business continuity plan deals with situations having two characteristics:
 Catastrophic situations, in which all or a major part of a computing capability is suddenly
unavailable
 Long duration, in which the outage is expected to last for so long that business will suffer
There are many situations in which a business continuity plan would be helpful. Here are
some examples that typify what you might find in reading your daily newspaper:
 A fire destroys a company's entire network.
 A seemingly permanent failure of a critical software component renders the computing
system unusable.
 A business must deal with the abrupt failure of its supplier of electricity,
telecommunications, network access, or other critical service.
 A flood prevents the essential network support staff from getting to the operations center.
The key to coping with such disasters is advance planning and preparation, identifying
activities that will keep a business viable when the computing technology is disabled. The
steps in business continuity planning are these:
 Assess the business impact of a crisis.
 Develop a strategy to control impact.
6.2.3. Develop and implement a plan for the strategy
Incident response plan:
 Incident response Plan should be
 define what constitutes an incident
 identify who is responsible for taking charge of the situation
 describe the plan of action
Risk Analysis:
We distinguish a risk from other project events by looking for three things,
1. A loss associated with an event. The event must generate a negative effect: compromised
security, lost time, diminished quality, lost money, lost control, lost understanding, and so on.
This loss is called the risk impact.
2. The likelihood that the event will occur. The probability of occurrence associated with
each risk is measured from 0 (impossible) to 1 (certain). When the risk probability is 1, we
say we have a problem.

93 | P a g e
3. The degree to which we can change the outcome. We must determine what, if anything,
we can do to avoid the impact or at least reduce its effects. Risk control involves a set of
actions to reduce or eliminate the risk.
We usually want to weigh the pros and cons of different actions we can take to address each
risk. To that end, we can quantify the effects of a risk by multiplying the risk impact by the
risk probability, yielding the risk exposure. For example, if the likelihood of virus attack is
0.3 and the cost to clean up the affected files is $10,000, then the risk exposure is $3,000. So
we can use a calculation like this one to decide that a virus checker is worth an investment of
$100, since it will prevent a much larger potential loss. Clearly, risk probabilities can change
over time, so it is important to track them and plan for events accordingly.
Risk is inevitable in life: Crossing the street is risky but that does not keep us from doing it.
We can identify, limit, avoid, or transfer risk but we can seldom eliminate it. In general, we
have three strategies for dealing with risk:
1. Avoiding the risk, by changing requirements for security or other system characteristics.
2. Transferring the risk, by allocating the risk to other systems, people, organizations, or
assets; or by buying insurance to cover any financial loss should the risk become a reality
3. Assuming the risk, by accepting it, controlling it with available resources, and preparing
to deal with the loss if it occurs Thus, costs are associated not only with the risk's potential
impact but also with reducing it. Risk leverage is the difference in risk exposure divided by
the cost of reducing the risk. In other words, risk leverage is

The Nature of Risk:

In our everyday lives, we take risks. In crossing the road, eating oysters, or playing the
lottery, we take the chance that our actions may result in some negative result such as being
injured, getting sick, or losing money. Consciously or unconsciously, we weigh the benefits
of taking the action with the possible losses that might result. Just because there is a risk to a
certain act we do not necessarily avoid it; we may look both ways before crossing the street,
but we do cross it. In building and using computing systems, we must take a more organized
and careful approach to assessing our risks. Many of the systems we build and use can have a
dramatic impact on life and health if they fail. For this reason, risk analysis is an essential
part of security planning.
We cannot guarantee that our systems will be risk free; that is why our security plans must

94 | P a g e
address actions needed should an unexpected risk become a problem. And some risks are
simply part of doing business; for example, as we have seen, we must plan for disaster
recovery, even though we take many steps to avoid disasters in the first place.
When we acknowledge that a significant problem cannot be prevented, we can use controls
to reduce the seriousness of a threat. For example, you can back up files on your computer as
a defense against the possible failure of a file storage device. But as our computing systems
become more complex and more distributed, complete risk analysis becomes more difficult
and time consuming and more essential.
Steps of a Risk Analysis
Risk analysis is performed in many different contexts; for example, environmental and health
risks are analyzed for activities such as building dams, disposing of nuclear waste, or
changing a manufacturing process. Risk analysis for security is adapted from more general
management practices, placing special emphasis on the kinds of problems likely to arise from
security issues. By following well-defined steps, we can analyze the security risks in a
computing system.
The basic steps of risk analysis are listed below.
1. Identify assets.
2. Determine vulnerabilities.
3. Estimate likelihood of exploitation.
4. Compute expected annual loss.
5. Survey applicable controls and their costs.
6. Project annual savings of control.
Arguments For and against risk analysis:
Risk analysis is a well-known planning tool, used often by auditors, accountants, and
managers. In many situations, such as obtaining approval for new drugs, new power plants,
and new medical devices, a risk analysis is required by law in many countries. There are
many good reasons to perform a risk analysis in preparation for creating a security plan.
Improve awareness. Discussing issues of security can raise the general level of interest and
concern among developers and users. Especially when the user population has little expertise
in computing, the risk analysis can educate users about the role security plays in protecting
functions and data that are essential to user operations and products.
Relate security mission to management objectives. Security is often perceived as a financial
drain for no gain. Management does not always see that security helps balance harm and
control costs.
Identify assets, vulnerabilities, and controls. Some organizations are unaware of their

95 | P a g e
computing assets, their value to the organization, and the vulnerabilities associated
with those assets. A systematic analysis produces a comprehensive list of assets, valuations,
and risks.
 Improve basis for decisions. A security manager can present an argument such as "I think
we need a firewall here" or "I think we should use token-based authentication instead of
passwords." Risk analysis augments the manager's judgment as a basis for the decision.
Justify expenditures for security. Some security mechanisms appear to be very expensive and
without obvious benefit. A risk analysis can help identify instances where it is worth the
expense to implement a major security mechanism. Justification is often derived from
examining the much larger risks of not spending for security.
6.2.4. Organizational Security Policies
A security policy is a high-level management document to inform all users of the goals of
and constraints on using a system. A policy document is written in broad enough terms that it
does not change frequently. The information security policy is the foundation upon which all
protection efforts are built. It should be a visible representation of priorities of the entire
organization, definitively stating underlying assumptions that drive security activities. The
policy should articulate senior management's decisions regarding security as well as asserting
management's commitment to security. To be effective, the policy must be understood by
everyone as the product of a directive from an authoritative and influential person at the top
of the organization.
Purpose:
Security policies are used for several purposes, including the following:
 recognizing sensitive information assets
 clarifying security responsibilities
 promoting awareness for existing employees
 guiding new employees
Audience:
A security policy addresses several different audiences with different expectations. That is,
each group users, owners, and beneficiaries use the security policy in important but different
ways.
Users
Users legitimately expect a certain degree of confidentiality, integrity, and continuous
availability in the computing resources provided to them. Although the degree varies with the
situation, a security policy should reaffirm a commitment to this requirement for service.

96 | P a g e
Users also need to know and appreciate what is considered acceptable use of their computers,
data, and programs. For users, a security policy should define acceptable use.
Owners
Each piece of computing equipment is owned by someone, and the owner may not be a
system user. An owner provides the equipment to users for a purpose, such as to further
education, support commerce, or enhance productivity. A security policy should also reflect
the expectations and needs of owners.
Beneficiaries
A business has paying customers or clients; they are beneficiaries of the products and
services offered by that business. At the same time, the general public may benefit in several
ways: as a source of employment or by provision of infrastructure.
Contents:
A security policy must identify its audiences: the beneficiaries, users, and owners. The policy
should describe the nature of each audience and their security goals. Several other sections
are required, including the purpose of the computing system, the resources needing
protection, and the nature of the protection to be supplied.
 Purpose
 Protected resources
 Nature of protection
Characteristics of a Good Security
Policy:
If a security policy is written poorly, it cannot guide the developers and users in providing
appropriate security mechanisms to protect important assets. Certain characteristics make a
security policy a good one.
 Durability
 Realism
 Usefulness
6.3. Physical security
Physical security is the term used to describe protection needed outside the computer system.
Typical physical security controls include guards, locks, and fences to deter direct attacks. In
addition, there are other kinds of protection against less direct disasters, such as floods and
power outages; these, too, are part of physical security.
6.3.1. Natural Disasters:
It is impossible to prevent natural disasters, but through careful planning it is possible to reduce

97 | P a g e
the damage they inflict. Some measures can be taken to reduce their impact. Because many
of these perils cannot be prevented or predicted, controls focus on limiting possible damage
and recovering quickly from a disaster. Issues to be considered include the need for offsite
backups, the cost of replacing equipment, the speed with which equipment can be replaced,
the need for available computing power, and the cost or difficulty of replacing data and
programs. Some of them are
 Flood
 Fire
 Other natural disasters
6.3.2. Power loss:
Computers need their food electricity and they require a constant, pure supply of it. With a
direct power loss, all computation ceases immediately. Because of possible damage to media
by sudden loss of power, many disk drives monitor the power level and quickly retract the
recording head if power fails. For certain time-critical applications, loss of service from the
system is intolerable; in these cases, alternative complete power supplies must be instantly
available.
6.3.3. Human vandals:
Because computers and their media are sensitive to a variety of disruptions, a vandal can
destroy hardware, software, and data. Human attackers may be disgruntled employees, bored
operators, saboteurs, people seeking excitement, or unwitting bumblers. If physical access is
easy to obtain, crude attacks using axes or bricks can be very effective. One man recently
shot a computer that he claimed had been in the shop for repairs many times without success.
Physical attacks by unskilled vandals are often easy to prevent; a guard can stop someone
approaching a computer installation with a threatening or dangerous object. When physical
access is difficult, more subtle attacks can be tried, resulting in quite serious damage. People
with only some sophisticated knowledge of a system can short-circuit a computer with a car
key or disable a disk drive with a paper clip. These items are not likely to attract attention
until the attack is completed.
 Unauthorized access and use
 Theft
 Preventing access
 Preventing portability
 Detecting theft

98 | P a g e
Interception of Sensitive Information:
When disposing of a draft copy of a confidential report containing its sales strategies for the
next five years, a company wants to be especially sure that the report is not reconstruct able
by one of its competitors. When the report exists only as hard copy, destroying the report is
straightforward, usually accomplished by shredding or burning. But when the report exists
digitally, destruction is more problematic. There may be many copies of the report in digital
and paper form and in many locations (including on the computer and on storage media).
There may also be copies in backups and archived in e-mail files. Here, we look at several
ways to dispose of sensitive information. They are
 Shredding
 Overwriting magnetic data
 Degaussing
 Protecting against Emanation
6.4. Contingency Planning:
The key to successful recovery is adequate preparation. Seldom does a crisis destroy
irreplaceable equipment; most computing systems personal computers to mainframes are
standard, off-the-shelf systems that can be easily replaced. Data and locally developed
programs are more vulnerable because they cannot be quickly substituted from another
source. Let us look what to do after a crisis occurs.
 Back-up
 Off-site backup
 Network storage
 Cold site
 Hot site
6.4.1. Physical security backup:
We have to protect the facility against many sorts of disasters, from weather to chemical
spills and vehicle crashes to explosions. It is impossible to predict what will occur or when.
The physical security manager has to consider all assets and a wide range of harm. Malicious
humans seeking physical access are a different category of threat agent. The primary physical
controls are strength and duplication. Strength means overlapping controls implementing a
defense-in-depth approach so that if one control fails, the next one will protect. People who
built ancient castles practiced this philosophy with moats, walls, drawbridges, and arrow
slits. Duplication means eliminating single points of failure. Redundant copies of data
protect

99 | P a g e
against harm to one copy from any cause. Spare hardware components protect against failures.
6.5. Review Questions
1. In what ways is denial of service (lack of availability for authorized users) a
vulnerability to users of single-user personal computers?
2. List three factors that should be considered when developing a security plan.
3. Cite three controls that could have both positive and negative effects.
4. List three different sources of water to a computing system, and state a control for each.
5. Cite a risk in computing for which it is impossible or infeasible to develop a classical
probability of occurrence.
6. Investigate the computer security policy for your university or employer. Who wrote the
policy? Who enforces the policy? Who does it cover? What resources does it cover?
7. For an airline, what are its most important assets? What are the minimal computing
resources it would need to continue business for a limited period (up to two days)? What
other systems or processes could it use during the period of the disaster?
8. Investigate your university's or employer's security plan to determine whether its security
requirements meet all the conditions listed in this chapter. List any that do not. When was the
plan written? When was it last reviewed and updated?

100 | P a g e
 Chapter Seven

The Economics of Cybersecurity

In this chapter
 Introduction to Cyber Security
 Making an economic case for security
 Measuring and quantifying
 economic value
 Modeling the economics of cybersecurity
Activity 7.1

 What is cybersecurity?
 Define cyber-attack.
 What is an economics of cybersecurity?
 Explain the impact of cyber-attack on economy.

101 | P a g e
7.1. Introduction to Cyber Security
The Committee on National Security Systems (CNSS-4009) defines cybersecurity as the
ability to protect or defend an enterprise’s use of cyberspace from an attack, conducted via
cyberspace, for the purpose of: disrupting, disabling, destroying, or maliciously controlling a
computing environment/infrastructure; or, destroying the integrity of the data or stealing
controlled information.
The National Institute of Standards and Technology defines cybersecurity as "the process
of protecting information by preventing, detecting, and responding to attacks." Similar to
financial and reputational risk, cybersecurity risk affects a company’s bottom line. It can
drive up costs and impact revenue. It can harm an organization’s ability to innovate and to
gain and maintain customers.
The International Organization for Standardization defines cybersecurity or cyberspace
security as the preservation of confidentiality, integrity and availability of information in the
Cyberspace. In turn, “the Cyberspace” is defined as “the complex environment resulting from
the interaction of people, software and services on the Internet by means of technology
devices and networks connected to it, which does not exist in any physical form.”
At its core, cybersecurity seeks to protect your enterprise from those who wish to do harm to
your business, steal your information or your money, or use your systems to target peers in
the market.
What is Cyber Security?
One way to think about it
Cyber security = security of cyberspace
What is cyberspace?
 Information Systems and
Networks. One way to think about
it
 Cyber security = security of information systems and networks.
 Cyber security = security of information systems and networks with the goal of
protecting operations and assets.
 Cyber security = security of information systems and networks in the face of
attacks, accidents and failures with the goal of protecting operations and assets.

102 | P a g e
 Cyber Security Conceptual Framework

Figure 7.1: Cyber Security Conceptual Framework

The Framework provides a conceptual framework upon which to understand all aspects of
cybersecurity, including discussions, solutions, and services.
 The industry is guided by both Government Policies that shape cyber-defences, and the
Regulatory Environment that sets standards for conduct.
 Business Requirements drive the specific cybersecurity elements that are necessary to
achieve business objectives.
 Threat Intelligence gleaned from newspapers, governments, industry partners, security
vendors, internal efforts, or a combination of all these sources, establishes the landscape that
security measures must be ready to respond to, both today and in the future.
 Corporate Security activities related to cybersecurity, physical security, and personnel
security, collectively provide the integrated elements of an effective protective solution.
 Finally, Cybersecurity Technology underpins but does not drive an effective
cybersecurity policy. Too often, technology is viewed as the solution rather than merely a
component of a broader strategy.
7.2. Impacts of cyber security
Case 1: Internet Under Siege
 February 7 - 9, 2000 Yahoo!, Amazon, [Link], [Link], eBay, E*Trade, ZDNet

103 | P a g e
websites hit with massive DOS.
 Attacks received the attention of president Clinton and Attorney General Janet Reno.
 “A 15-year-old kid could launch these attacks, it doesn’t take a great deal of
sophistication to do” – Ron Dick, Director NIPC, February 9.
 U.S. Federal Bureau of Investigation (FBI) officials have estimated the attacks caused
$1.7 billion in damage
Case 2: Slammer Worm
 January 2003, Infects 90% of vulnerable computers within 10 minutes.
 Effect of the Worm- Interference with elections; Cancelled airline flights; 911
emergency systems affected in Seattle; 13,000 Bank of America ATMs failed.
 Estimated ~$1 Billion in productivity loss
Case 3: WorldCom
 July 2002, WorldCom declares bankruptcy
 Problem WorldCom carries 13% - 50% of global internet [Link] 40% of
Internet traffic uses WorldCom’s network at some point
 October 2002, Outage affecting only 20% of WorldCom users snarls traffic around
the globe.
Case 4: September 11
 Wireless Tower on Top of Trade Center Destroyed
 Rescue efforts hampered
Case 5: It’s a Jungle Out There
 The Internet is highly, globally connected.
 Viruses/worms are legion on the Internet and continue to scan for vulnerable hosts.
 Hackers scan looking for easy targets to attack.
Case 6: Wannacry Ransomware
 May 2017 almost 200,000 peoples were victims.
 One of the most severe attack in the world.
7.3. Cyber Security Policy
The cyber security policy is a developing mission that caters to the entire field of
Information and Communication Technology (ICT) users and providers. It includes:
 Home users
 Small, medium, and large Enterprises
 Government and non-government entities
It serves as an authority framework that defines and guides the activities associated with the
security of cyberspace. It allows all sectors and organizations in designing suitable

104 | P a g e
cybersecurity policies to meet their requirements. The policy provides an outline to
effectively protect information, information systems and networks.
It gives an understanding into the Government’s approach and strategy for security of
cyber space in the country. It also sketches some pointers to allow collaborative working
across the public and private sectors to safeguard information and information systems.
Therefore, the aim of this policy is to create a cybersecurity framework, which leads to
detailed actions and programs to increase the security carriage of cyberspace.
7.3.1. Organization Policy
A well-thought-out cyber security policy outlines which systems should be in place to
guard critical data against attacks.
These systems, or the infrastructure, tell IT and other administrative staff how they will
protect the company’s data (which controls will be used) and who will be responsible for
protecting it.
Your cyber security policy should include information on controls such as:
 Which security programs will be implemented (Example: In a layered security
environment, endpoints will be protected with antivirus, firewall, anti-malware, and
anti-exploit software.)
 How updates and patches will be applied in order to limit the attack surface and plug
up application vulnerabilities (Example: Set frequency for browser, OS, and other
Internet-facing application updates.)
 How data will be backed up (Example: Automated backup to an encrypted cloud
server with multi-factor authentication.)
In addition, your policy should clearly identify roles and responsibilities. That includes:
 Who issued the policy and who is responsible for its maintenance
 Who is responsible for enforcing the policy
 Who will train users on security awareness
 Who responds to and resolves security incidents and how
 Which users have which admin rights and controls
7.3.2. Employees Policy
The most critical step in establishing a successful cyber security policy is documenting and
distributing the acceptable use conditions for employees.
Why? No matter how strong defenses are, users can introduce threats to your company’s
networks by falling for phishing scams, posting secure information on social media, or giving
away credentials.

105 | P a g e
 According to the 2014 IBM Cyber Security Intelligence Index, over 95% of all threat
incidents investigated involved human error.
Your cyber security policy should clearly communicate best practices for users in order to
limit the potential for attacks and ameliorate damage.
They should also allow employees the appropriate degree of freedom they need to be
productive.
Banning all Internet and social media usage, for example, would certainly help keep your
company safe from online attacks but would (obviously) be counterproductive.
Acceptable use guidelines might include:
 How to detect social engineering tactics and other scams
 What is acceptable Internet usage
 How remote workers should access the network
 How social media use will be regulated
 What password management systems might be utilized
 How to report security incidents
 In addition, the employee policy should also cover what happens when users fail to
comply with guidelines. For example, an employee found to be responsible for a
breach might be required to repeat training if it was due to negligence, or terminated if
the breach was an inside job.
7.4. The Economics of Cyber Security
Cybersecurity economics can be defined as a field of research that utilizes a socio-technical
perspective to investigate economic aspects of cybersecurity such as budgeting, information
asymmetry, governance, and types of goods and services, to provide sustainable policy
recommendations, regulatory options, and practical solutions that can substantially improve
the cybersecurity posture of the interacting agents in the open socio-technical systems.
In this topic, we focus on decisions involved in allocating scarce financial resources to
cybersecurity. That is, as a practitioner, you must decide in what kinds of security controls to
invest, based on need, cost, and the tradeoffs with other investments (that may not be security
related). For example, the chief executive officer may announce that because the company
has done well, there is a sum of money to invest for the benefit of the company. She solicits
proposal that describe not only the way in which the money can be used but also the likely
benefits to be received (and by whom) as a result. You prepare a proposal that suggests
installation of a firewall, a spam filter, an encryption scheme to create a virtual private
network, and the use of secure identification tokens for remote network access. You describe
the threats

106 | P a g e
addressed by these products and the degree (in terms of cost and company profit) to which
the proposed actions will benefit the company. The choices, and the tradeoffs among them,
can be analyzed by understanding the economics of cybersecurity.
Once we have good data, we can build models and make projections. We examine several
ways to model the impact of a cybersecurity investment. Building and using a model involve
understanding key factors and relationships; we discuss examples of each. Finally, we
explore the possibilities for future research in this rich, interdisciplinary area.
7.5. Making an Economic case for security
7.5.1. Making a Business Case
There are many reasons why companies look carefully at their investments in cybersecurity.
Table 1 shows the results of a series of in-depth interviews with organizations in the U.S.
manufacturing industry, health care companies, universities, Internet service providers,
electric utilities, nonprofit research institutions, and small businesses. It shows that various

pressures,
both internal and external, drive organizations to scrutinize the amount and effectiveness of
their cybersecurity practices and [Link] how do companies decide how much to invest
in cybersecurity, and in what ways?. Typically, they use some kind of benchmarking, in
which they learn what other, similar companies are spending; then they allocate similar
amounts of resources. For example, if Mammoth Manufacturing is assessing the sufficiency
of its cybersecurity investments, it may determine (through surveys or consultants) that
other
107 | P a g e
manufacturing companies usually spend x percent of their information technology budgets on
security. If Mammoth's investment is very different, then Mammoth's executives may
question what is different about Mammoth's needs, practices, or risk tolerance. It may
be that Mammoth has a more capable support staff, or simply that Mammoth has a higher
tolerance for risk. Such analysis helps Mammoth
executives to decide if investments should increase, decrease, or stay the same.
Requests for cybersecurity resources usually have to compete with other types of requests,
and the final decisions are made based on what is best for the business. Thus, there has
always been keen interest in how to make a convincing argument that security is good for
business. When companies have to balance investments in security with other business
investments, it is difficult to find data to support such decision-making. Because of the many
demands on an organization's finite resources, any request for those resources must be
accompanied by a good business case. A business case for a given expenditure is a proposal
that justifies the use of resources.
It usually includes the following items:
 a description of the problem or need to be addressed by the expenditure.
 a list of possible solutions.
 constraints on solving the problem.
 a list of underlying assumptions.
 analysis of each alternative, including risks, costs, and benefits.
 a summary of why the proposed investment is good for the organization
7.5.2. Determining Economic Value
Favaro and Pfleeger [FAV98] suggest that economic value can be a unifying principle in
considering any business opportunity. That is, we can look at each investment alternative in
terms of its potential economic value to the company or organization as a whole. In fact,
maximizing economic value can very well lead to increases in quality, customer satisfaction,
and market leadership.
However, there are many different ways to capture economic value. For example, Gordon
and Loeb [GOR06a] present several ways of thinking about the economic benefit of
cybersecurity, including net present value, internal rate of return, and return on investment.
We must decide which investment analysis approach is most appropriate for security-related
investment decision-making based on economic value.
Net Present Value
Taking the perspective of a financial analyst, Favaro and Pfleeger [FAV98] look critically at

108 | P a g e
the most commonly used approaches: net present value, payback, average return on book
value, internal rate of return, and profitability index. Favaro and Pfleeger explain why net
present value (NPV) makes the most sense for evaluating software-related investments. For
this reason, we explore NPV in some detail here. When proposing technology, you must be
sure to consider all costs. For example, to invest in a new security tool, a company may
spend money for training and learning time, as well as for the tool itself. The NPV
calculation subtracts these initial investment costs from the projected benefits.
More formally, the net present value is the present value of the benefits minus the value of
the initial investment. That is, NPV compares the value of a dollar (or euro or yuen) today to
the value of that same dollar (or euro or yuen) in the future, considering the effects of
inflation and returns on investment. NPV expresses economic value in terms of total project
life, regardless of scale or time frame. Since investment planning involves spending money
in the future, we can think of the present value of an investment as the value today of a
predicted future cash flow.
Suppose, for example, that the rationale for spending 100 units today on a proposed project
suggests that the project might yield a benefit (profit) of 200 units five years from now. To
assess the overall project benefit to the company, we must adjust the 200 units both for
inflation and for the interest or growth the firm would otherwise gain on the 100 units over
five years if it were instead to invest the money in a traditional financial vehicle, such as a
bank account. Suppose 100 units invested traditionally (and wisely) today might yield 170
units in five years. Then the present value of the proposed project is only 30 units (200 -
170), although the 30 units of profit represent a net benefit for the company.
Adjusting Future Earnings against Investment Income
As noted before, if a company has disposable or uncommitted money on hand today that it
wants to invest, it has several choices: it can spend it now or save it for the future. If the
company decides to save it, the earnings compound so that the value of that money in the
future is greater than it is today (not considering inflation). Suppose corporate savings
generate a 5 percent annual return; then by investing today's 100 units, the firm can expect to
have almost 128 units in five years. Calculations of this kind suggest a threshold that must be
met if a proposed project is considered by the company to be worthwhile. Thus, if a proposed
cybersecurity (or any other) project requires an up-front investment of 100 units, its profit by
the fifth year has to be at least 128 units to be economically viable. In this way, net present
value calculations give companies a way to compare and contrast several investment
strategies and pick the most economically desirable one(s).

109 | P a g e
The formal equation for calculating NPV is

where Bt and Ct are the benefits and costs anticipated from the investment in each time period
t. C0 is the initial investment, the discount rate (expected rate of return on investment) is k,
and n is the number of time periods over which the investment's costs and benefits are
considered.
7.6. Measuring and Quantifying Economic Value
Cybersecurity threats and risks are notoriously hard to quantify and estimate. Some
vulnerabilities, such as buffer overflows, are well understood, and we can scrutinize our
systems to find and fix them. But other vulnerabilities are less understood or not yet
apparent. For example, how do you predict the likelihood that a hacker will attack a network,
and how do you know the precise value of the assets the hacker will compromise? Even for
events that have happened (such as widespread virus attacks) estimates of the damage vary
widely, so how can we be expected to estimate the costs of events that have not happened?
Unfortunately, quantification and estimation are exactly what security officers must do to
justify spending on security. Every security officer can describe a worst-case scenario under
which losses are horrific. But such arguments tend to have a diminishing impact: After
management has spent money to counter one possible serious threat that did not occur, it is
reluctant to spend again to cover another possible serious threat.
7.7. The Economic Impact of Cybersecurity
Understanding the economic impact of cybersecurity issues prevention, detection, mitigation,
and recovery requires models of economic relationships that support good decision-making.
However, realistic models must be based on data derived both from the realities of
investment in cybersecurity and consequences of actual attacks. In this section, we describe
the nature of the data needed, the actual data available for use by modelers and decision
makers, and the gap between ideal and real.
For any organization, understanding the nature of the cybersecurity threat requires
knowing at least the following elements:
 number and types of assets needing protection.
 number and types of vulnerabilities that exist in a system.
 number and types of likely threats to a system.

110 | P a g e
 Data to Justify Security Action
Interest in society's reliance on information technology has spawned a related interest in
cyber security's ability to protect our information assets. However, we lack high quality
descriptive data.
Data are needed to support cybersecurity decision-making at several levels.
 National and global data address national and international concerns by helping users
assess how industry sectors interact within their country's economy and how cybersecurity
affects the overall economy.
 Enterprise data enable us to examine how firms and enterprises apply security
technologies to prevent attacks and to deal with the effects of security breaches. In particular,
the data capture information about how enterprises balance their security costs with other
economic demands.
 Technology data describe threats against core infrastructure technologies, enabling
modelers to develop a set of least-cost responses.
Data to support economic decision-making must have the following characteristics:
 Accuracy. Data are accurate when reported values are equal or acceptably close to actual
values. For example, if a company reports that it has experienced 100 attempted intrusions
per month, then the actual number of attempted intrusions should equal or be very close to
100.
 Consistency. Consistent reporting requires that the same counting rules be used by all
reporting organizations and that the data be gathered under the same conditions. For
example, the counting rules should specify what is meant by an "intrusion" and whether
multiple intrusion attempts by a single malicious actor should be reported once per actor or
each time an attempt is made. Similarly, if a system consists of 50 computers and an
intrusion is attempted simultaneously by the same actor in the same way, the counting rules
should indicate whether the intrusion is counted once or 50 times.
 Timeliness. Reported data should be current enough to reflect an existing situation. Some
surveys indicate that the nature of attacks has been changing over time. For instance,
Symantec's periodic threat reports [SYM06] indicate that attack behavior at the companies it
surveys has changed from mischievous hacking to serious criminal behavior. Reliance on old
data might lead security personnel to be solving yesterday's problem.
 Reliability. Reliable data come from credible sources with a common understanding of
terminology. Good data sources define terms consistently, so data collected in one year are
comparable with data collected in other years.
Comparability of Categories

111 | P a g e
There are no standards in defining, tracking, and reporting security incidents and attacks. For
example, information is solicited about
 "electronic attacks" (Australian Computer Crime and Security Survey) "total number of
electronic crimes or network, system, or data intrusions" and "unauthorized use of computer
systems" (CSI/FBI).
 "security incidents," "accidental security incidents," "malicious security incidents," and
"serious security incidents" (Information Security Breaches Survey)
 "any form of security breach" (Deloitte Global Security Survey) "incidents that resulted
in an unexpected or unscheduled outage of critical business systems" (Ernst and Young
Global Information Security Survey).
Sources of Attack
Even the sources of attack are problematic. The Australian survey notes that the rate of
insider attacks has remained constant, but the Deloitte survey suggests that the rate is rising
within its population of financial institutions. There is some convergence of findings,
however. Viruses, Trojan horses, worms, and malicious code pose consistent and serious
threats, and most business sectors fear insider attacks and abuse of access. Most studies
indicate that phishing is a new and growing threat.
7.8. Modeling the Economics of Cybersecurity
Cybersecurity economics is a nascent field, bringing together elements of cybersecurity and
economics to help decision-makers understand how people and organizations invest
constrained resources in protecting their computer systems, networks, and data. Among the
many questions to ask about cybersecurity investments are these:
 How much should an organization invest in cybersecurity to protect assets of a
given value?
 What is the likely impact of a security breach?
 What are the costs and benefits of sharing information?
7.8.1. The Role of Organizational Culture
Trust and interpersonal relations are solidly linked to economic behavior. Because
interpersonal interactions are usually embedded in the organizations in which we work and
live, it is instructive to examine the variation in organizational cultures to see how they may
affect economic decision- making, particularly about investments in cybersecurity.
We can tell that two cultures are different because they exhibit different characteristics:
 symbols, heroes, rituals, and values.
 Symbols are the words, gestures, pictures and objects that carry specific meanings for a

112 | P a g e
 group of people using them to communicate [HOF05]. For example, a corporate security
group's culture may be manifested in jargon about PKI, IPSEC, and cryptographic
algorithms. Heroes of a culture are those people whose behaviors are highly prized, serving
as role models for the others in the group. We often laud our heroes as ACM or IEEE
Fellows, as recipients of medals or prizes, or as honored speakers at conferences and
workshops.
 Rituals are activities performed by all the group's members that are socially essential but
not necessary to the business. For example, group meetings to introduce new members are
often ways of teaching the language and symbols to newcomers but are not always essential
for getting work done.
Normative Pragmatic Rule-based versus job-driven
 Process versus results. An organization that is process oriented reflects the value that if
good practices are enacted properly, the desired results will follow. That is, the means will
lead to acceptable ends. However, others insist that the proof of the pudding is in the eating;
even if you follow a good recipe, you still have to evaluate the result directly to verify its
quality. Security organizations that emphasize process are often focused on "best practices,"
training members to develop, evaluate, and use software in prescribed ways. On the other
hand, organizations that emphasize results are focused on testing and evaluation, to ensure
that products work as advertised.
 Employee versus job. An organization that values its employees is concerned about
employee satisfaction and job motivation. At the other extreme, an organization focused on
the job usually uses measures such as milestones toward completion to determine if progress
is being made.
 Parochial versus professional. A parochial organization rewards its employees for
meeting goals set internally, by the organization, division, or company. A professional
organization looks outside the company to professional awards and certification authorities
for ways of rewarding its employees. For example, a professional organization would value
CISSP certification, while a parochial organization prefers in-house rewards, such as
promotion.
 Open versus closed. When an organization is open, it welcomes new talent from outside,
having no qualms about investing in training to help newcomers understand the symbols,
heroes, and rituals. A closed organization prefers to hire from within so that cultural values
and practices are preserved and reinforced.
 Loose versus tight control. A loosely controlled organization usually allows teams to
form by themselves; employees have someflexibility in deciding with whom they want to
work, and there are few reporting requirements. In a tightly controlled organization, the
113 | P a g e
managers create

114 | P a g e
the teams and impose significant reporting requirements to ensure that project progress is
being made.
 Normative versus pragmatic. Normative organizations are usually focused on best
practices. They often have a standard or recommended life-cycle methodology that is
imposed on all development and maintenance projects, with supporting measures and
reviews to ensure that the methodology is being applied. By contrast, pragmatic
organizations are more job- driven, doing what it takes to get the job done, even if that means
using unorthodox or untested approaches to solving the problem. Pragmatic organizations are
usually the ones that use small groups applying "agile methods."
7.9. Review Questions
1. Security and risk are clearly related: The more at risk a system or data set is the more
security is desirable to protect it. Discuss how prices for security products may be
tied to the degree of risk. That is, will people or organizations be willing to pay more
if the risk is higher?
2. Good economic analysis depends on good data. How would you define a
cybersecurity incident that should be counted in a cybersecurity survey? If an attack
occurs repeatedly, should it be counted each time? If it occurs simultaneously to
multiple computers or systems, how should it be counted? What other issues should
be considered in designing a useful cybersecurity survey?
3. Thanks in part to availability of information in digital form, vendors can easily collect
personal or organizational information and use it to offer differential pricing. For
example, a site may offer lower prices based on past buying history or the
expectation of future business. Or a vendor's "buyer's club" or "affinity card" may
offer lower prices in exchange for the right to gather purchase information over time.
Some people balk at such differential pricing as an invasion of privacy. Discuss the
economic costs and benefits of trading privacy for lower prices.

115 | P a g e
Reference:
Required Texts:
1. Text book: Security in Computing, Charles P. Pfleeger and Shari L. Pfleeger.
(5rd edition).Prentice-Hall. 2003. ISBN: 0-13-035548-8.
Reference books:
1. Computer Security, Dicter Gouman, John Wiley & Sons
2. Computer Security: Art and Science, Mathew Bishop, Addison-Wesley
3. Principles of Information Security, Whitman, Thomson 7th edition
4. Network security, Kaufman, Perl man and Speciner, Pearson Education
5. Cryptography and Network Security, 5th Edition William Stallings, Pearson
Education
6. Introduction to Cryptography, Buchmann, Springer.

116 | P a g e