W0rLD of CoMputer ScieNce

Assignment wireless...

2010-01-14T20:59:00.000-08:00

Question 1

There are three main multiple access technique which are the FDMA, TDMA and CDMA. List out and describe the advantages and disadvantages of the 3 multiple access techniques.

Advantages TDMA
• Permits flexible bit rates by assigning more slots per frame to a certain user.
• Can support bursts or variable bit rate traffic.
• No guard bands required for wideband system.
• No narrowband filters required for wideband system.

Disadvantages of TDMA
• Each user has a predefined time slot. However, user roaming from one cell to another are not allotted time slot. Thus, if all the time slot on the next cell is already occupied, a call might disconnect and user will not receive a dial tone.
• Subjected to multi-path distortion. However, a time limit can be used on the system to solve the problem. Once the time limit is expired the signal is ignored.
• Higher synchronization overhead because of burst mode operation.
• Complexity equalization necessary for high data rates of wideband systems.
• Frequency/slot allocation complexity
• Pulsating power envelop: interference with other devices
• Electronics operating at high bit rate increase poser consumption.

Advantages CDMA
• CDMA can support many users in the same channel, example: high capacity.
• Lower mobile transmit power, example: longer battery life and better power control.
• Improved performance in multipart environments, RAKE receivers can be used to improve signal reception by exploiting diversity.
• Soft handoffs can be used. Mobile can switch base station without switching carries. Two base stations receive the mobile signal and the mobile is receiving from two base stations.
• High peak data rates can be accommodated.

Disadvantages of CDMA
• One major problem in CDMA technology is channel pollution, where signals from too many cell sites are present in the subscriber’s phone but none of them is dominant. When this situation arises the quality of the audio degrades.
• Another disadvantage in this technology when compared to GSM is the lack of international roaming capabilities. The ability to upgrade or change to another handset is not easy with this technology because the network service information for the phone is put in the actual phone unlike GSM which uses SIM card for this.
• One another disadvantage is the limited variety of the handset, because at present the major mobile companies use GSM technology.
• The code length has to be careful selected because a large code length can induce delay or even cause interference.
• CDMA also requires tight power control as it suffers for far-near effect.
• Soft handoff increases use of radio resources and hence can reduce capacity.

Advantages FDMA
• Reducing the information bit rate and using efficient digital codes can increase the capacity.
• As FDMA systems use low bit rates (large symbol time) compared to average delay spread, they reduce the cost, and there is low Inter Symbol Interference (ISI).
• There is hardly any equalization required.
• Technological advances required for implementation are simple. A system can be configured so that improvements in terms of speec coder bit-rate reduction could be readily incorporated.
• Since the transmission is continuous, less number of bits are needed for synchronization and framing.

Disadvantages of FDMA
• It does not differ significantly from analog systems, capacity improvement depends on reducing signal to interference ratio, or signal to noise ratio (SNR).
• The maximum bit rate per channel is fixed and small.
• The guard band between each two users results in wastage of capacity.
• Hardware involves narrow band filters, which cannot be realized in VLSI and thus increase the cost.
• Law call capacity
• Lack of security where a call could be overhead with considerable ease and one could steal a phone’s serial code and make illegal calls on the systems.

Question 2

In 3G cellular network, the two popular standards are WCDMA and CDMA-2000. List out of all the similarities and differences of the two technology.

Similarities WCDMA and CDMA-2000

Differences WCDMA and CDMA-2000

CDMA is a complete cellular system which was employed for 2G and now for 3G networks. CDMA-2000 is the version of CDMA system for 3G. WCDMA is the physical layer technology adopted for 3G UMTS system. The difference between CDMA and WCDMA in term of physical layer spreading is that in CDMA system signal is spread up to 1.25 MHz while in WCDMA signal is spread up to 5MHz band. Hence extra "W" meaning "wide" is used and hence called as WCDMA.

The biggest difference between WCDMA and CDMA-2000 is the origin. WCDMA is an evolution of GSM, while CDMA-2000 is an evolution of CDMA. WCDMA uses a broader spectrum and the signalling is based on GSM. CDMA's signalling is somewhat related to TDMA signalling. Both use Code Division to get the packets in sequence and both offer similar data speed and voice capabilities.

Assignment..

2010-01-09T23:30:00.000-08:00

Minggu nie dh start kuliah..and of course la..dh ade assignment yg dh kene wat pon...=).Untuk minggu ini assignment first kene wat dlm kumpulan..(naseb baek!)..Assignment yg akan kami siapkan adelah mengenai wireless regulatory bodies kat seluruh dunia..Berikut adalah beberapa contoh wireless regulatory bodies yg terlibat dlm assignment kami..

1-Federal Communication Commission-United States
2-European Telecommunications Standard Institute - Europe
3-Department of Communications - Canada
4-Australian Communications and Media Authority - Australia
5-Commission Federal de Telecomunicaciones - Mexico

Kumpulan kami telah memilih Department of Communication in Canada sebagai salah satu wireless regulatory bodies yg akan dikaji..

Untuk menyiapkan assignment ini..kami perlu menjawab beberapa soalan yg telah diberi oleh pensyarah..Berikut adalah soalan2 nye..

1- Give brief summary about the regulatory agency
2- What a future trend of the agency in the 2.4-GHz RF spectrum and purpose of frequency 2.4-GHz
3- What is the future trend of the agency in the 5-GHz RF spectrum and hte purpose of frequency 5-GHZ
4- Differentiate this body from others
5- What official comprise the regulatory bodies
6- How do companies comply with the regulation
7- How does the regulatory agency monitor the airwaves
8- What action do they take for violation
9- What penalties are imposed for violation

LECTURE 10: LEGAL AND CRITICAL ISSUES IN COMPUTER SECURITY

2009-10-29T18:51:00.000-07:00

INTRODUCTION

To know what protection the provides for computer and data to appropriate laws that protect the right of other with respect to computer, program and data, and to understand how existing laws provide a basis for recommending new laws to protect computers, data and computer.

Law is not always the appropriate way to deal with issues of human behavior.

Differences between LAWS and ETHICS

Laws

Described by formal, written laws
Interpreted by court
Established by legislature representing everyone
Applicable to everyone
Priority determined by courts if two laws conflict
Court is final arbiter of right
Enforceable by police and court

Ethics

Described by unwritten principles
Interpreted by individuals
Presented by philosophers, religions, professionals group
Personal choice
Priority determined by individuals if two principles conflict
Limited enforcement

Protecting Programs and Data

Copyrights

- Are design to protect the expression and data.

- Applied to creative work such as story

- Intended to allow regular and free exchange of ideas.

- Must be apply to any original work and it must be in some tangible medium of expression.

- Grant to the original of the expression.

- Can also be granted for work which contains some public domain material as long as there is some originally, without the need for the author to identify what is public and what is original.

Patents

- Different from copyrights in that it applies to the results of science, technology and engineering.

- Can protect a new and useful process, machine, manufacture or composition of matter.

-Designed to protect the device or process for carrying out an idea

- Can valid only for something that is truly novel or uniques

-Granted to who invented it first, regardless who filed the invention first.

- The patents applicant has to reveal what is novel about the invention

- The patents owner then will use the patented invention by producing or by licensing others to produce them.

Trade Secret

A trade secret is information that gives one company a competitive edge over others. For example, the formula for a soft drink is a trade secret, as is a mailing list of customers, or information about a product due to be announced in a few months.

The distinguishing characteristic of a trade secret is that it must always be kept secret. The owner must take precautions to protect the secret, such as storing it in a safe, encrypting it in a computer file, or making employees sign a statement that they will not disclose the secret.
Trade secret protection applies very well to computer software.

The underlying algorithm of a computer program is novel, but its novelty depends on nobody else’s knowing it.

Trade secret protection allows distribution of the result of a secret (the executable program) while still keeping the program design hidden.
Trade secret protection does not cover copying a product (specifically a computer program), so that it cannot protect against a pirate who sells copies of someone else’s program without permission.

However, trade secret protection makes it illegal to steal a secret algorithm and use it in another product.

Why Computer Crime is Hard to Define?
Understanding
*Neither courts, lawyers, police agents, nor jurors necessarily understand computers.

Fingerprints
*Polices and courts for years depended on tangible evidence, such as fingerprints. But with many computer crimes there simply are no fingerprints, no physical clues.
Form of Assets
*We know what cash is, or diamonds, or even negotiable securities. But are 20 invisible magnetic spots really equivalent to a million dollars?

Juveniles
*Many computer crimes involve juveniles. Society understands immaturity and can treat even very serious crimes by juveniles as being done with less understanding than when the same crime is committed by an adult.

Type of Crimes Committed

Telecommunications Fraud
*It is defined as avoiding paying telephone charges by misrepresentation as a legitimate user.

Embezzlement
*It involves using the computer to steal or divert funds illegally.

Hacking
*It denotes a compulsive programmer or user who explores, tests, and pushes computers and communications system to their limits - often illegal activities.

Automatic Teller Machine Fraud
*It involves using an ATM machine for a fraudulent activity - faking deposits, erasing withdrawals, diverting funds from another person’s account through stolen PIN numbers.

Records Tampering
*It involves the alteration, loss, or destruction of computerised records.

Acts of Disgruntled Employees
*They often use a computer for revenge against their employer.

Child Pornography and Abuse
*They are illegal or inappropriate arts of a sexual nature committed with a minor or child, such as photographing or videotaping.

Drug Crimes
*Drug dealers use computers to communicate anonymously with each other and to keep records of drug deals.

Organised Crime
*For all kinds of crime, the computer system may be used as their tools.

Summary

Firstly, the legal mechanisms of copyright, patent, and trade secret were presented as means to protect the secrecy of computer hardware, software and data.

However, these mechanisms were designed before the invention of computer, so their applicability to computing needs is somewhat limited.

Meanwhile, program protection is especially desired, and software companies are pressing the courts to extend the interpretation of these means of protection to include computers.

Secondly, relationship between employers and employees, in the context of writers of software. Well-established laws and precedents control the acceptable access an employee has to software written for a company

Thirdly, some difficulties of in prosecuting computer crime. In general, the courts have not yet granted computers, software, and data appropriate status considering value of assets and seriousness of crime. The legal system is moving cautiously in its acceptance of computers.

What are Ethics?

Society relies on ethics or morals to prescribe generally accepted standards of proper behaviour.

An ethic is an objectively defined standard of right and wrong within a group of individuals.

These ethics may influence by religious believe. Therefore, through choices, each person defines a personal set of ethical practices.

A set of ethical principles is called and ethical system.

Differences of The Law and Ethics

Firstly, laws apply to every one, even you do not agree with the laws. However, you are forced to respect and obey the laws.

Secondly, there is a regular process through the courts for determining which law supersedes which if two laws conflict.

Thirdly, the laws and the courts identify certain actions as right and others as wrong. From a legal standpoint, anything that is not illegal is right.

Finally, laws can be enforced, and there are ways to rectify wrongs done by unlawful behaviour.

Contrast of Law Versus Ethics

LECTURE 9: INTRUSION DETECTION SYSTEM

2009-10-29T18:25:00.000-07:00

Intruders
Security Intrusion & Detection

Types of IDS
*HIDS
*NIDS
*DIDS
IDS Techniques
SNORT
Honeypots

An Intrusion detection system (IDS) is software and/or hardware designed to detect unwanted attempts at accessing, manipulating, and/or disabling computer systems, mainly through a network, such as the Internet. These attempts may take the form of attacks, as examples, by crackers, malware and/or disgruntled employees. An IDS cannot directly detect attacks within properly encrypted traffic.

An intrusion detection system is used to detect several types of malicious behaviors that can compromise the security and trust of a computer system. This includes network attacks against vulnerable services, data driven attacks on applications, host based attacks such as privilege escalation, unauthorized logins and access to sensitive files, and malware (viruses, trojan horses, and worms).

An IDS can be composed of several components: Sensors which generate security events, a Console to monitor events and alerts and control the sensors, and a central Engine that records events logged by the sensors in a database and uses a system of rules to generate alerts from security events received. There are several ways to categorize an IDS depending on the type and location of the sensors and the methodology used by the engine to generate alerts. In many simple IDS implementations all three components are combined in a single device or appliance.

IDS Terminology
Alert/Alarm- A signal suggesting a system has been or is being attacked [1].

True attack stimulus- An event that triggers an IDS to produce an alarm and react as though a real attack were in progress [1].

False attack stimulus- The event signaling an IDS to produce an alarm when no attack has taken place [1].

False (False Positive)- An alert or alarm that is triggered when no actual attack has taken place [1].

*False negative- A failure of an IDS to detect an actual attack.

*Noise- Data or interference that can trigger a false positive .

*Site policy- Guidelines within an organization that control the rules and configurations of an IDS .

*Site policy awareness- The ability an IDS has to dynamically change its rules and configurations in response to changing environmental activity .

*Confidence value- A value an organization places on an IDS based on past performance and analysis to help determine its ability to effectively identify an attack .

*Alarm filtering- The process of categorizing attack alerts produced from an IDS in
order to distinguish false positives from actual attacks.

Types of Intrusion-Detection systems
There are three main types of systems in which IDS can be used : network, applications and hosts.

In a network-based intrusion-detection system (NIDS), the sensors are located at choke points in network to be monitored, often in the demilitarized zone (DMZ) or at network borders. The sensor captures all network traffic and analyzes the content of individual packets for malicious traffic.

In systems, PIDS and APIDS are used to monitor the transport and protocols for illegal or inappropriate traffic or constructs of a language. For example forged SQL queries attempting to delete database records, virus in emails.

In a host-based system, the sensor usually consists of a software agent, which monitors all activity of the host on which it is installed. For example attempt to modify the master boot record, keylogger, file access.

Hybrids for the two later systems also exist.

Network intrusion detection system (NIDS)
It is an independent platform which identifies intrusions by examining network traffic and monitors multiple hosts. Network Intrusion Detection Systems gain access to network traffic by connecting to a hub, network switch configured for port mirroring, or network tap. An example of a NIDS is Snort.

Protocol-based intrusion detection system (PIDS)
It consists of a system or agent that would typically sit at the front end of a server, monitoring and analyzing the communication protocol between a connected device (a user/PC or system) and the server. For a web server this would typically monitor the HTTPS protocol stream and understand the HTTP protocol relative to the web server/system it is trying to protect. Where HTTPS is in use then this system would need to reside in the "shim", or interface, between where HTTPS is un-encrypted and immediately prior to its entering the Web presentation layer.

Application protocol-based intrusion detection system (APIDS)
It consists of a system or agent that would typically sit within a group of servers, monitoring and analyzing the communication on application specific protocols. For example, in a web server with a database this would monitor the SQL protocol specific to the middleware/business logic as it transacts with the database.

Host-based intrusion detection system (HIDS)
It consists of an agent on a host which identifies intrusions by analyzing system calls, application logs, file-system modifications (binaries, password files, capability/acl databases) and other host activities and state. An example of a HIDS is OSSEC.

Hybrid intrusion detection system
It combines two or more approaches. Host agent data is combined with network information to form a comprehensive view of the network. An example of a Hybrid IDS is Prelude.

Intrusion detection systems can also be system-specific using custom tools and honeypots.

LECTURE 8: FIREWALL

2009-10-22T10:46:00.002-07:00

Firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications. It is a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all (in and out) computer traffic between different security domains based upon a set of rules and other criteria.

Firewalls can be implemented in either hardware or software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.

There are several types of firewall techniques:

1. Packet filter: Packet filtering inspects each packet passing through the network and accepts or rejects it based on user-defined rules. Although difficult to configure, it is fairly effective and mostly transparent to its users. In addition, it is susceptible to IP spoofing.
2. Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose a performance degradation.
3. Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.
4. Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.

LECTURE 7: WIRELESS SECURITY

2009-10-20T11:45:00.000-07:00

Wireless LANs
IEEE ratified 802.11 in 1997.
-Also known as Wi-Fi.
Wireless LAN at 1 Mbps & 2 Mbps.
WECA (Wireless Ethernet Compatibility Alliance) promoted Interoperability.
-Now Wi-Fi Alliance
802.11 focuses on Layer 1 & Layer 2 of OSI model.
-Physical layer
-Data link layer

A wireless local area network (WLAN) links two or more devices using some wireless distribution method (typically spread-spectrum or OFDM radio), and usually providing a connection through an access point to the wider internet. This gives users the mobility to move around within a local coverage area and still be connected to the network.

Wireless LANs have become popular in the home due to ease of installation, and the increasing popularity of laptop computers. Public businesses such as coffee shops and malls have begun to offer wireless access to their customers; sometimes for free.

Types of wireless LAN

::Peer to peer::
An ad-hoc network is a network where stations communicate only peer to peer (P2P). There is no base and no one gives permission to talk. This is accomplished using the Independent Basic Service Set (IBSS).

A peer-to-peer (P2P) network allows wireless devices to directly communicate with each other. Wireless devices within range of each other can discover and communicate directly without involving central access points. This method is typically used by two computers so that they can connect to each other to form a network.

If a signal strength meter is used in this situation, it may not read the strength accurately and can be misleading, because it registers the strength of the strongest signal, which may be the closest computer.
IEEE 802.11 define the physical layer (PHY) and MAC (Media Access Control) layers based on CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance). The 802.11 specification includes provisions designed to minimize collisions, because two mobile units may both be in range of a common access point, but out of range of each other.

The 802.11 has two basic modes of operation: Ad hoc mode enables peer-to-peer transmission between mobile units. Infrastructure mode in which mobile units communicate through an access point that serves as a bridge to a wired network infrastructure is the more common wireless LAN application the one being covered. Since wireless communication uses a more open medium for communication in comparison to wired LANs, the 802.11 designers also included shared-key encryption mechanisms: Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA, WPA2), to secure wireless computer networks.

::Bridge::

A bridge can be used to connect networks, typically of different types. A wireless Ethernet bridge allows the connection of devices on a wired Ethernet network to a wireless network. The bridge acts as the connection point to the Wireless LAN.

::Wireless distribution system::

A Wireless Distribution System is a system that enables the wireless interconnection of access points in an IEEE 802.11 network. It allows a wireless network to be expanded using multiple access points without the need for a wired backbone to link them, as is traditionally required. The notable advantage of WDS over other solutions is that it preserves the MAC addresses of client packets across links between access points.

An access point can be either a main, relay or remote base station. A main base station is typically connected to the wired Ethernet. A relay base station relays data between remote base stations, wireless clients or other relay stations to either a main or another relay base station. A remote base station accepts connections from wireless clients and passes them to relay or main stations. Connections between "clients" are made using MAC addresses rather than by specifying IP assignments.

All base stations in a Wireless Distribution System must be configured to use the same radio channel, and share WEP keys or WPA keys if they are used. They can be configured to different service set identifiers. WDS also requires that every base station be configured to forward to others in the system.

WDS may also be referred to as repeater mode because it appears to bridge and accept wireless clients at the same time (unlike traditional bridging). It should be noted, however, that throughput in this method is halved for all clients connected wirelessly.

When it is difficult to connect all of the access points in a network by wires, it is also possible to put up access points as repeaters.

WPA and WEP

WPA and WEP are technologies that "encrypt" the traffic on your network. That is, they scramble it so that an attacker can't make any sense of it. To unscramble it at the other end, all systems using it must know a "key" or password.

Note that WPA is now in a second generation, referred to as WPA2. Unless otherwise specified, this document uses "WPA" to refer to both.

WPA and WEP provide both access control and privacy. Privacy comes from the encryption. Access control comes from the fact that someone must know the password to use your network.

For this reason, for small networks, using WPA is enough to meet the requirements of the Wireless policy. However you will still want to make sure that any services that use a password or other private information use SSL or some other type of end to end encryption.

WEP is significantly less secure than WPA, but can be used until your equipment can be upgraded to support WPA. While WEP is widely regarded as insecure, it is still a lot better than nothing.

WPA has two modes, personal and enterprise. For small installations you'll want to use personal mode. It just requires a password. Enterprise mode is for larger installations, that have a Radius server that will support WPA.

The primary problem with WPA in personal mode is that it has a single password, which you must tell to all users. That becomes impractical for larger installations.

WPA in enterprise mode requires each user to login with their own username and password. That simplifies management in large installations, because you don't have to distribute a common password to all your users. However it is a bit more complex to implement:

* Each user's system must have special software to let the user login to the network. This software is referred to as an "802.1x supplicant".
* The access point must support WPA enterprise mode. The access point is configured to talk to a RADIUS server, which is a central server that actually checks the password.
* You must have a RADIUS server that supports WPA enterprise mode. While the RADIUS server may have its own list of usernames and passwords, it would be more common for it to talk to an LDAP or Active Directory server, so that users login to the network with the same password that they use for other services.

For this reason, most large implementations at Rutgers do not use enterprise mode. Instead they use separate gateway boxes for access control, and depend upon end to end encryption for privacy. One can argue that this is not as secure as WPA enterprise mode, but it avoids the support implications of requiring users to login to the network with an 802.1x supplicant.
Choosing a good password

It is critical to use a good password. There are attacks against WPA that will break your security if your password uses words or any other well-known sequences. WPA allows passwords as long as 63 characters. We strongly recommend using a long random password, or at the very least a long phrase (at least 20 characters, but preferably longer). The phrase should not be taken from any web site or published work. Most software saves the password, so you only need to type it once on each system.

Even better than a long phrase is a truly random password. For example, consider using http://rulink.rutgers.edu/random.php3. This generates a random 32-character hex string. You can combine two of them (and leave off one character) to get a 63-character password.

LAB 6 - Security in Network

2009-10-20T10:46:00.000-07:00

This week, we are given 2 tasks which are:

Task 1: Capture FTP username and password
Task 2: Using IPSec to secure FTP Transaction

Capturing File Transfer Protocol (FTP) username and password

Step 1: Start your virtual machine containing winserv03_server and winserv03_client.

Step 2: Login as Administrator

Step 3: Set the IP address of your winserv03_server and winserv03_client as below.

winserv03_server = 192.166.1.106

winserv03_client = 192.166.1.105

On winserv03_server:

Step 4: Check that your winserv03_server is already installed with FTP server and Wireshark. If FTP server installed than start the FTP service using [Start] | [Administrative tools] | [Internet Information Services (IIS)] otherwise you need a Windows Server 2003 CD to installed Internet Information Services (IIS) with FTP.

Step 5: Whereas if wireshark is not install then it can be downloaded for free from http://www.wireshark.org.

Step 6: If it is installed then open Wireshark on winserv03_server. [Start] | [Program] | [Wireshark].

Step 7: Click on [Capture] | [Interfaces] to choose the network interfaces you wanted to monitor, refer figure 6.4. Choose the network interfaces that has an IP number 0f 192.168.1.106, click [Start], refer figure 6.5.

On winserv03_client

Step 8:On winserv03_client VM open a command prompt, login to FTP server on winserv03_server using the following command.

On winserv03_server

Step 9: As your login view the Wireshark interface on winserv03_server VM, you will notice that the username and password that you used to login to the FTP server from the winserv03_client side is clearly seen on the monitor. Capture the screen of your Wireshark output using print screen button on your keyboard.

Step 10: To simulate this on the real environment you need two computers connected via a cross cable.

Using IPSec to secure FTP transaction

On winserv03_server

Step 1: Click [Start] | [Run] and then type mmc.

Step 2: Management Console will appear and then, on the menu bar click [File] | [Add/Remove snap-in].

Step 3: On the Add/Remove Snap-in box, click [Add] button and select the [IP Security Monitor] and click [OK].

Step 4: Repeat step 3 by selecting IP Security Policy Management on Local Machine and then click [Finish].

Step 5: On the Add/Remove Snap-in, click [OK].

Step 6: In the right pane, right-click on [Secure Server (Require Security)] | [Properties].

Step 7: In the Secure Server (Require Security) Properties dialog box, highlight All IP Traffic and click [Edit].

Step 8: On the Edit Rule Properties dialog box, select the Authentication Method tab. Click add and screen New Authentication Method Properties will appear. Select Use this string (preshared key) and then type MSPRESS in the scroll box, then click OK. Make sure your client preshared key must be same as server preshared key

Step 9: Highlight the Preshared Key and click the [Move up] button to make the preshared key as a first priority for the authentication. Click [Apply] | [OK].

Step 10: Click [OK] on the [Secure Server (Require Security)] Properties dialog box and close it.

Step 11: Right-click on [Secure Server (Require Security)], and click [Assign] from the pop-up menu.

On winserv03_client

Step 12: Click [Start] | [Run] and then type mmc.

Step 13: Management Console will appear and on the menu bar click [File] | [Add/Remove snap-in].

Step 14: On the Add/Remove Snap-in box, click [Add] button and select the [IP Security Monitor] and click [OK].

Step 15: Repeat step 3 by selecting IP Security Policy Management on Local Machine and then click [Finish].

Step 16: On the Add/Remove Snap-in, click [OK].

Step 17: In the right pane, right-click on [Secure Server (Require
Security)] | [Properties].

Step 18: In the Client (Response Only) Properties dialog box, highlight and click [Edit].

LAB 5- Web Application Security

2009-10-13T10:44:00.000-07:00

On this lab, we need to describe the flaw of web application and how it is exploited. Besides that, we also have to exploit the web vulnerabilities. After that, we need to list prevention method that can be taken to overcome web application vulnerabilities.

WHAT IS WEB APPLICATION SECURITY??

Web application or simply called webapp is an application that can be accessed using a web browser over a network, either the Internet or within the Local Area Network. It is developed using browser-supported language such as HTML, JavaScript, PHP, ASP and etc. The script produced is then rendered by common web browser. Web application let user to access application or system anywhere and at any time provided the user is connected to a network connection and there is a web browser installed on the machine. This ease of usage makes webapp popular among Internet user. Moreover the ability to update and maintain web applications without distributing and installing software on potentially thousands of client computers contribute to the popularity of the webapp. Nowadays webapp is used for accessing mail, online banking, online shopping, online reservation, wikis and many other functions.

An increase in the usage of web applications is directly related to an increase in the number of security incidents for them. Even though the server is patch with the latest version of the software, the network are installed with the latest firewall system and Intrusion detection system is deployed to monitor the network, if the web application itself is lack of security features the vital information stored in its content is still expose to intrusion. A Web application system should be carefully and safely develop because it is the first line of defense, any fault or flaws in it development stage, the server configuration and even the scripting used in it development can bring a major loop hole that can be manipulated by intruder to be used as the backdoor to the entire network.

WebGoat and WebScarab

WebGoat = Simulation toolkit used to demonstrate how we can exploit the vulnerabilities of a poorly design web application.

WebScarab = Tool for everyone who need to expose the working of an HTTP(S) based application, whether to allow the developer to debug otherwise difficult problems, or to allow a security specialist to identify vulnerabilities in the way that application has been designed or implemented.

Web Application Hacking simulation using WebGoat and WebScarab

Step 1: Copy the WebGoat-OWASP_Standard-5.2.zip and extract it to the C:\ drive.
Step 2: Open the C:\ WebGoat-5.2 folder and open the webgoat.bat to start the apache tomcat J2EE.

Step 3:Open an IE 6.0 web browser or a firefox web browser and type http://localhost/WebGoat/attack.

Step 4: Login as User Name: guest Password: guest

Step 5: Open webscarab-selfcontained-20070504-1631.jar

Step 6: If the WebScarab does not open do install the JDK module (jdk-6u4-windows-i586-p.exe) to your computer.

Step 7: Once the WebScarab started, you should see the interface as figure 5.4

Step 8: Next Configure the Web browser proxy starting so that it listen to 127.0.0.1 (localhost) port 8008.

Step 9: Go to WebScarab and click on the intercept tab and enable the intercept request checkbox but disable the intercept response checkbox. This will enable the intercept features of the WebScarab in which it will intercept any request signal from the web browser.

Step 10: Close your previous web browser, open it again and type in http://localhost/WebGoat/attack.

Step 11: WebScarab will intercept your request to visit the website by prompting an Edit request window as depicted in figure 5.6. This prompted window shows the request data that you send to the web server.

Step12: The text field indicated by the arrow shows the text field containing the data you send to the web server and it can be modified.(in some of the following task you need to modified the content of the text field to help you solve the problem in lesson.

Step13: For this task do not changes the text field value just click the [Accept changes] button to view the WebGoat main page.

Step 14: Each time you click on a submit button or a link on the webpage, the Edit request window will always appear, so make sure you click on Accept changes button to view your request page display on the browser.

Getting started with WebGoat and WebScarab

Step 1: Click on [Start WebGoat]

Step 2: Click on the Introduction | How to work with WebGoat menu.

Step 3: Read and follow the instruction given in the WebGoat.

XSS Attack

Step 1: Click on the Cross Site Scripting (XSS) | Phising with XSS menu

Step 2: Apply the script below to the text field in order to create a false login page so that you can harvest the username and password keyed in by the user.

Step 3: Once you hit the Search button you will see a comment page containing a place for you to login. This login page is created using the java script above.

Step 4: Try login in with any username and password; if this is a real phishing website you would not get the prompted message on your screen but the value you supplied might be send across the world to a server that gather the login information.

Step 5: Next click on the Cross Site Scripting (XSS) | Reflected XSS Attacks menu.

Step 6: In this lesson some prevention mechanism has been build in the script, some field have a validation toward the character you supplied. It will reject any tag symbol you used, however there are still some that is not protected. By using the script below find which the text field that can be exploited using XSS attack?

Injection Flaws

Step 1: Click on the Injection Flaws | Numeric SQL Injection menu, refer figure 5.10.

Step 2: From the combo list choose a weather station and click the [Go!] button, (Do not forget to click on the accept changes button of the edit request windows) you will get the information for the country you select.

Step 3: To apply the Injection flaws you need to choose a new country and click [Go!] button. Before clicking the [Accept changes] button on the edit request windows, in the [URLEncoded] tab, add the value station variable with

This is input is a numerical value, refer figure 5.11

Step 4: Once the value is changed, click [Accept changes] button. The entire data is displayed on the screen. This shows that by manipulating the input field that is not properly design we can display the entire data in the database.

Step 5: Repeat this task on the Injection Flaws | String SQL Injection. Use the right input for this problem and compare the result. (Hint: The input should be a string).

Malicious File Execution

Step 1: Click on the Injection Flaws | Command Injection menu, refer figure 5.14.

Step2: By choosing the lesson plan to view and clicking on [View] button, user will be shown the content of the lesson. This exercise will manipulate the input field by adding the input with a command line instruction.

Step 3: Select a new lesson and click [View]. Before clicking the [Accept changes] button add the following command to your HelpFile variable value

This command will display directory list and network configuration setup.

Step 4: Once you click the [Accept changes] button the following output will be displayed on the screen.

LECTURE 6: Security in Applications

2009-10-11T22:44:00.000-07:00

EMAIL SECURITY

E-Mail

One of the most heavily used network-based applications.
Have sender and receiver. However, the receiver is not online.
Some email system only can deliver ASCII codes.

Pretty Good Privacy (PGP)

Developed by Phil Zimmermann
Uses public key encryption, signature scheme, hash function, secret key encryption, compression function and email compatibility.

S/MIME = Secure/Multipurpose Internet Mail Extension

Another security enhanced email system.
Similar to PGP which is uses signature scheme, session key and secret key encryption.

Function of S/MIME:

Enveloped data
Signed data
Clear-signed data
Signed and enveloped data

Applications of Email Security

PGPmail
Expressmail
POTP Securemail
SecretAgent
Safe-mail
PrivacyX
Stealth Messages
YNN
HyperSend

WEB SECURITY

Includes three parts which are security of server, security of client and network traffic security between a browser and a server.

Network security can considered at different levels, examples:

Network level: Use IPSec
Transport level: Use SSL or TLS
Application level: Use PGP, S/MIME or SET

Secure Socket Layer (SSL)

Developed by Netscape
Main part of SSH contain several protocol which are SSL Handshake Protocol, SSL Change Cipher Spec Protocol, SSL Alert Protocol and SSL Record Protocol
Basically, SSH is used to secure the transmission between a client and server.

Secure Electronic Transaction (SET)

Open encryption and security specification designed to protect credit card transaction on the Internet.

Features:

Confidentiality of information
Integrity of data
Cardholder account authentication
Merchant authentication

Participants:

Cardholder
Merchant
Issuer
Acquirer
Payment gateway
Certification authority

The sequence of events required for a transaction are as follows:

The customer obtains a credit card account with a bank that supports electronic payment and SET
The customer receives an X.509v3 digital certificate signed by the bank.
Merchants have their own certificates
The customer places an order
The merchant sends a copy of its certificate so that the customer can verify that it's a valid store
The order and payment are sent
The merchant requests payment authorization
The merchant confirms the order
The merchant ships the goods or provides the service to the customer
The merchant requests payment

SECURITY AND HTTP

By default, HTTP not hugely secure
It does not support for HTTP-authentication

LECTURE 5: Security in Network

2009-10-09T10:44:00.000-07:00

INTRODUCTION

Computer Networks = Interconnected collection of autonomous computers.

CLASSIFICATIONS OF NETWORKS

Broadcast Networks

Single communication channel tat is shared by all the machines on the network
Allow the possibility of addressing a packet to all destinationd by using a special code in the address field.
When a packet with this code is transmitted, it is received and processed by every machine in the network. This is called broadcasting.

Point-to-Point Networks

Consist of many connections between individuals pairs of machines.
From source to destination, a packet may have to first visit one or more intemediate machines.
Often multiple routes of different lengths are possible, so routing algorithms play an important role in point-to-point networks.

Distance is important as a classification metric because different techniques are used at different scales

Local Area Networks (LAN)

Georgraphically close group of computers that can talk to each other.
Privately-owneed networks within a single building or campus of up to a few kilometres in size.
Wide;y used to connect personal computers and workstations in company offices or factories to share resources

Metropolitan Area Networks (MAN)

Bigger version of LAN.
Normally uses similar technology
Might cover a group of nearby corporate offices or a city and might be either private or public
Can support both data and voice and might even be related to the local cable television network.

Wide Area Networks (WAN)

Spans a large geographical area, often a country or continent.and often associated with a large organization.
Can be made up of any combination and numbrs of WANs, LANs or single computers.

NETWORK TOPOLOGY

Star

Ring

Mesh

Bus

OSI MODEL

WHO CAN CAUSE SECURITY PROBLEMS??

Student - Have fun snooping on people's email
Hacker - Test out someone's security system
Sales rep - Claim to represent all of Europe not just Androrra
Businessman - Discover a competitor's strategic marketing plan
Ex-employee - Get revenge for being fired
Accountant - Embezzle money from a company
Stockbroker - Deny a promise made to a customer by email
Con-man - Steal credit card numbers for sale
Spy - Learn an enemy's military strength
Terrorist - Steal germ warfare secret

INTERTWINED AREAS IN NETWORK SECURITY PROBLEMS

Secrecy
Authentication
Non-Repudiation
Integrity Control

NETWORK SECURITY ISSUES

Sharing
Complexity of System
Unknown perimeter
Many points of Attack
Unknown Path

SECURITY EXPOSURE

Privacy
Data Integrity
Authenticity
Covert Channels

NETWORK SECURITY THREATS

Threats = circumstances, condition, or event with the potential to cause harm to personnel and/or network resources in the form of destruction, disclosure, modification of data, denial of service or fraud, waste and abuse.Network security threats include impersonation, eavesdropping, denial of service, packet relay and packet modification.

Impersonating

Common ways to identify and authenticate users include the use of physical keys, account names and passwords and biometrics checks.

Eavesdropping

Allows cracker to make a complete transcript of network activity. As a result, a cracker can obtain sensitive information, such as passwords.

Denial of Service

Multi-user, multi-tasking operating system are subject to DoS attacks where one user can user can render the system unusable for legitimate users by "hogging" a resource or damaging or destroying resources so that they cannnot be used.Three common form of network DoS attacks are service overloading, message floading and signal floading.

Packet Relay

Refers to the recording and re-transmission of message packets in the network. It is a significant threat for programs that require authentication sequences.

Packet Modification

Significant integrity threat, which involves one system intercepting and modifying a packet destined for another system.

NETWORK SECURITY CONTROL

Encryption = technique used to safeguard information while it is stored within a network node.

Link Encryption VS End-to-end Encryption

Security within hosts

Msg exposed in sending host Msg encrypted in sending host

Msg exposed in intermediate nodes Msg encrypted in intermediate nodes

Roles of User

Applied by sending host Applied by sending process

Invisible to user User applies encryption

Host maintains encryption User must find algorithm

One facility for all users User selects encryption

Can be done in harware Software implementation

All or no msg encryption User chooses to encrypt or not

Implementation Concerns

Requires one key per host pair Requires one key per user pair

Provides node authentication Provides user authentication

Access Control

Port protection
Automatic Call-back
Differentiated Access Rights
Node Authentication

User Authentication

Password
Challenge-response system

Authentication in Distributed System

Kerberos

Firewall Characteristics

Entire All relation link or activity from within out have to pass firewall.
Done or Conducted by block limiting either through physical all accessing to local and also in configuration.
Only enlisted activity recognized which can pass firewall by arranging policy of at local security.
Have to tie or strong relative to attack weakness.

Types of firewall

Screening router

~Simplest
~Sees only addresses and service protocol type
~Auditing difficult
~Screens based on connection rules
~Complex addressing rules can make configuration tricky

Proxy gateways

~Somewhat complex
~Sees full text of communication
~Can audit activity
~Screes based on behavior of proxies
~Simple proxies can substitute for complex addressing rules

Guards

~Most complex
~Sees full text of communications
~Can audit activity
~Screens based on interpretation of msg content
~Complex guard functionality can limit assurance

Intrusion Detection System (IDS)

Device or software tools or hardware tools that monitor activity to identify malicious or suspicious events.
Use to detect unauthorized access to a computer or network.
Required to detect all type of malicious network traffic and computer usage.
Compose of several components which are sensor, console and engine.
Correcting system configuration error
Installing and operating traps to record information about intruders

Types of IDS

Signature-based Intrusion Detection
Heuristic Intrusion Detection

LAB 4 - Modern cryptography

2009-09-22T10:43:00.000-07:00

This week, we learn how to implement private and public key using RSA algorithms. We also learn how to implement Data Encryption Standard (DES) Algorithms.

ENCRYPTION USING DES ALGORITHMS

All these tables are used during DES process:

LECTURE 4: AUTHENTICATION AND ACCESS CONTROL

2009-09-15T22:42:00.000-07:00

Authentication
*Password
*Biometric

Access control
*Matrix
*List
*Unix access control

-Verification of identity of someone who generated some data
-Relates to identity verification
-classifications of identity verification:
+by something known e.g. password
+by something possessed e.g. smart card, passport
+by physical characteristics (biometrics) e.g. finger prints, palm prints, retina, voice
+by a result of involuntary action : signature

Password

Protection of passwords

Don’t keep your password to anybody
Don’t write or login your password at everywhere
Etc.

Choosing a good password
Criteria:
-Hard to guess and easy to remember

Characteristics of a good password
-Not shorter than six characters
-Not patterns from the keyboard
Etc.

Calculations on password
*Password population, N =rs
*Probability of guessing a password = 1/N
*Probability of success, P=nt/N

Techniques for guessing passwords
*Try default passwords.8
*Try all short words, 1 to 3 characters long.
*Try all the words in an electronic dictionary(60,000).
*Collect information about the user’s hobbies, family names, birthday, etc.
*Try user’s phone number, social security number, street address, etc.
*Try all license plate numbers
*Use a Trojan horse
*Tap the line between a remote user and the host system.

What is Biometric?

*The term is derived from the Greek words bio (= life) and metric (= to measure)
*Biometrics is the measurement and statistical analysis of biological data
*In IT, biometrics refers to technologies for measuring and analysing human body characteristics for authentication purposes
*Definition by Biometrics Consortium – automatically recognising a person using distinguishing traits

Verification vs Identification

*Verification (one-to-one comparison) –confirms a claimed identity
-Claim identity using name, user id, …
*Identification (one-to-many comparison) – establishes the identity of a subject from a set of enrolled persons
-Employee of a company?
-Member of a club?
-Criminal in forensics database?

Static vs. dynamic biometric methods

*Static (also called physiological) biometric methods – authentication based on a feature that is always present
*Dynamic (also called behavioural) biometric methods – authentication based on a certain behaviour pattern

Classification of biometric methods

Static
Fingerprint recognition
Retinal scan
Iris scan
Hand geometry

Dynamic
Signature recognition
Speaker recognition
Keystroke dynamics

LAB 3 - Classic cryptography

2009-08-20T10:41:00.000-07:00

During this lab, we will implement the Caesar Cipher and Vigenere Cipher for Symmetric Cryptography.

As in the previous lecture, we already know that cryptography is divided into 2 main categories which is symmetric and asymmetric. In symmetric encipherment, plaintext is encrypted and decrypts using the same key whereas asymmetric encipherment is using different keys to encrypt and decrypt a plaintext.

Below is an example of symmetric encipherment using Caesar Cipher

The Caesar Cipher is formed by shifting the letters of the original alphabet. For example by replacing each letter of the alphabet with the letter three places down the alphabet. It is monoalphabetic as only one letter in plaintext is exchanged for one letter of ciphertext.

Plaintext alphabet A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Ciphertext key D E F G H I J KLM NO P Q RS T U V W X Y Z A B C

A caesar cipher with a key 3

For an example the plain text below can be encrypted using key 3 to get the cipher text

THE ATTACK TONIGHT START AT EIGHT, REGROUP AT STATION A

Plaintext

WKHDWWDFNWRQLJKWVWDUWDWHLJKWUHJURXSDWVWDWLRQD

Ciphertext

Example of symmetric cryptography using Vigenere Cipher

Vigenere table

The cipher text encrypted using Caesar cipher method is easily broken by using a brute force attack. An attacker can easily try every combinations of character to break the code as the number of possibility is just 26. In order to improve the deciphering process we can used the vigeneré cipher method. The Vigenère cipher is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. It is a simple form of polyalphabetic substitution. You can refer to the Vigenere table for making it easier to encrypt a plaintext using this method.

A key is needed to encrypt a plaintext; a key can be a word or a phrase. To have a strong cipher text it is advised to use different key on each encryption. This will prevent from a brute force attack on a second message if the first message has been intercepted.

Vigenere Cipher

LECTURE 3: Modern cryptography

2009-08-15T10:37:00.000-07:00

The topic covered in this lecture are:

Modern cryptography algorithm
Block and stream
DES
AES
MAC
Digital Signature, RSA

DES
* Provides a high level of security
* The security depends on keys, not the secrecy of the algorithm
* The security is capable of being evaluated
* The algorithm is completely specified and easy to understand
* It is efficient to use and adaptable
* Must be available to all users
* Must be exportable

LAB 2 - The goals of information technology security

2009-07-29T10:25:00.000-07:00

During this lab, we need to do 4 tasks which is:

Task 1-Using NTFS to Secure Local Resources
Task 2- Data Confidentiality
Task 3- Data Availibility
Task 4- Data Integrity

Basically, in this lab we learn how to determine if the partition is NTFS or FAT32. Besides that, we also learn how to implement confidentiality, availability and integrity in Windows Server 2003.

TASK 1- Using NTFS to Secure Local Resources.

1. Open your winserv03 virtual machine
2. Log on to the Windows 2003 server as Administrator.
3. Click [Start].
4. Click [Run].
5. Type cmd to invoke the command line. (The FAT partition in
this lab will be designated as drive letter D.)
6. At the command line type chkntfs d: to verify that the drive
is not using NTFS. You will see the m7. To convert a FAT disk to NTFS you need to type at the
command line convert d: /fs:ntfs
7. If the drive has a volume label, enter it when prompted.
Windows will then convert the drive to NTFS. Note: If you
convert the system partition you will have to reboot for the
conversion to take place.
8. At the command line type chkntfs d: to verify that the drive
is now NTFS.essage, “D: is not
9. Close all Windows and log off.

TASK 2::Data Confidentiality.

Once a secure file system is installed, you can begin to think about
data confidentiality. Data confidentiality refers to making sure that
only those intended to have access to certain data actually have
that access. With the FAT file system, this is not possible at the
local level, but with NTFS you can lock down both folders and files
locally. NTFS can be used to protect data from intruders who may
have physical access to the computer containing the data. In this
lab, you will create a folder and files, assign NTFS permissions,
then verify whether or not the data is confidential.

Creating user account
1. Two user-level accounts: User1 and User2
a. To create user account go to [Start] |
[Administrative Tools] | [Computer Management].
b. Choose [Local User and Groups] and double click
on the [user] folder.
c. To create new user right click on the pane and from
the pop-up menu choose [New User] and fill up the
necessary information such as username and
password (use easy to remember password e.g.
abc123)

LAB 1- Introduction to Virtualization and VMware

2009-07-29T06:24:00.001-07:00

During lab 1 session, we are introducing to VMware workstation and need to install VMware.But, of course the first thing that we must understand is the meaning of the VIRTUALIZATION. What is virtualization?Virtualization mean the creation of the a virtual of something, such as an operating system, a server, a storage devices or network resources. (http://searchservervirtualization.techtarget.com)

Virtual Machine can be defined as an efficient and isolated duplicate of real machine. This environment is created by using Virtual Machine Monitor which provide a second layer on a machine for another operating system which it run on.

VMware Workstation make it possible for PC user to use Multiple Operating System Concurrently on the same PC. User can create and run multiple virtual machine on desktop or laptop computer. It also let us create virtual machine and installed any different type of operating system.

VMware Workstation installation

This is simple step by step on how to install VMware Workstation:

1.Download VMware Workstation from http://www.vmware.com/download/ws/. Then, double click the VMware launcher to start the installation wizards.

2. Click NEXT and choose Typical setup type

3. Choose the location for VMware Workstation installation. Then, click NEXT

4. Configure the shortcuts for the VMware Workstation and click NEXT

5. Click INSTALL. This will take several minutes to finish

6. Enter the serial number for the VMware Workstation.

7. Click FINISH and restart the computer.

LECTURE 2 : Basic Cryptograpy

2009-07-25T08:07:00.000-07:00

This lecture will cover about the cryptography concept, cryptography algorithms, Monoalphabetic, Polyalpabetic and Transposition

CRYPTOGRAPHY CONCEPT

Basically, cryptography concept is about the idea of a cipher system which is to distinguish information in such a way that its meaning is unintelligible to an unauthorized person..or in Malay..satu system yg digunakan untuk membezakan maklumat yg ingin disampaikan supaya maklumat tersebut tidak boleh dibaca oleh orang yg tidak berkenaan..(lebih kurang cam 2 ler mksudnye..=))

The concept of cryptography or we can say the art of secret writing can be divided into 2 types which are

Steganography

- hiding messages
- Message does not changed
- Does not involve key

Cryptography

- scrambling messages
- messages changes
- does involve key

SECURITY TOOLS

The earliest information is encrypt using scytale
On the World War II a machine call enigma machine is used as a mechanical crypto machine.

CRYPTOGRAPHY TERMINOLOGY

plaintext- original message
cipher text - coded message
cipher - algorithm for transforming plaintext to ciphertext
key - info used in cipherknown only to sender/receiver
encipher - converting plaintext to ciphertext
decipher - recovering ciphertext from plaintext
cryptography - study of encryption principle/method
cryptanalysis - study of principles/method of deciphering ciphertext without knowing key
cryptology - field of cryptography + cryptanalysis

CRYPTOGRAPHY ALGORITHMS

Three independent dimension:

The number of key used

- symmetric or asymmetric??

The type of operations used for transforming plaintext to ciphertext

- substitution?? or transposition?? or product..

The way in which the plaintext is processed

- block or stream??

LECTURE 1 : Introduction to Information Security

2009-07-18T20:04:00.000-07:00

Before we go further, lets check out what is the meaning of SECURITY!!!!!

SECURITY = Quality or state of being secure that is to be free from danger & to be protected from adversaries

3 SECURITY AREA which are D.P.R:

D- Detection. Example tool is scanner
P- Prevention. Example tools are Firewall, proxy
R- Recovery. Example tool is cryptography

SECURITY ARCHITECTURE

- Defined by ITU-T Recommendation X.800 that called OSI security Architecture.

- Useful to manager as a way of organizing the task of providing security.
- It was developed as an international standard, computer and communication vendors have developed security features for their products and services that relate to the structured definition of services and mechanisms.
- Focus on security attacks, security mechanisms and security services.

3 SECURITY PRINCIPLES which are C.I.A:

C- Confidentiality
I- Integrity
A- Availability

SECURITY POLICY = Set of rules to apply to security relevant activities in a security domain. There are THREE level of security which are Objectives, Organizational and System.

2 type of SECURITY ATTACKS:

Passive Attack - Monitoring the transmission

Category : Release of message content and traffic analysis

Active Attack - involved modification of the data

Category : masquerade, replay, Denial of Services (DoS)

METHODS OF DEFENSE:

Prevent - by block or close the attack
Deter - making the attack harder
Deflect - making another target more effective
Recover - from effects

Methods of defense in control are including encryption, software control,hardware control, policies and physical control. The definition of encrytion of ENCRYPTION is the formal name for scrambling data so that interpretation is meaningless without the intruder’s knowing how the scrambling was done.Furthermore, encryption is the basis of protocols that enable us to provide security while accomplishing an important system or network task. It clearly addresses the need for confidentiality data and can be used to ensure integrity.

Software Controls can be divided into Internal Program Control, OS and Network Sytem Control, Independent Control and Development Control.

Hardware Controls are the hardware devices used in providing the computer security. For examples smart card implementations of encryption, lock or cable limiting access, Firewall, Intrusion detection systems and many more...:-)

Besides software and hardware control, Policies and Procedure Controls are very important to support the importance of security policy and ensure their proper use.

"Controls must be used and used properly to be effective". Basically, there are several aspect that need to be considered when enhance the effectiveness of controls such as awareness of the problems, probability of use overlapping controls and periodic review.

SECURITY SERVICES

Here are some definition of the security services that are defined from X.800 and also RFC 2828

X.800: A security service as a service provided by a protocol layer of communicating open systems which ensure adequate security of the systems or of data transfers.
Service that is provided by a system to give a specific kind of protection to system resources where security services implement security policies and are implemented by security mechanisms.

Authentication

Access Control

Data Confidentiality

Data Integrity

Non-repudiation

Authentication

Authentication is an assurance that the communicating entity is the one claimed. It has 2 specific services which are peer entity authentication and data origin authentication.

Access Control

Access control is the prevention of the unauthorized use of a resource. It specific service is to prevent and authorized use of a resource.

Data Confidentiality

Data confidentiality is the protection of data from unauthorized disclosure. It specific service are connection confidentiality, connectionless confidentility, selective-field confidentiality and traffic flow confidentiality.

Data Integrity

Data integrity is assurance that data received is as sent by an authorized entity. It have 5 specific services which are Connection Integrity with Recovery, Connection Integrity without Recovery,Selective-field Connection Integrity, Connectionless Integrity and Selective-field Connectionless Integrity.

Non-Repudiation

Non-repudiation is a protection against denial by one of the parties in a communication.There are 2 specific services which are Nonrepudiation, Origin and Nonrepudiation, Destination.

SECURITY MECHANISMS

Security mechanisms is any process that is designed to detect, prevent or recover from security attack. It is defined by X.800 to provide and support security services.

This mechanisms can be divided into 2 classes which are:

1. Specific Security Mechanisms

Authentication exchange
Data integrity
Encipherment
Traffic padding
Access control
Digital signature
Natarization
Routing Control

2. Pervasive Security Mechanisms

Trusted functionality
Security recovery
Security label
Security audit trait
Event detection