Back More light on computer security
D. Murali
| In computer security, there is not always a direct trade-off between prevention and detection. The more you invest in prevention, the more you may have to invest in detection to be certain that prevention works. |
PROTECTION measures involve three things, viz. prevention, detection, and reaction. For example, protection of credit card number may rely on encryption; detection happens when an unauthorised transaction appears on your statement; and reaction is in the form of reporting to the card-issuer.
In some cases, the damage may be irreversible, points out Dieter Gollmann of Hamburg University of Technology in Computer Security, second edition, from Wiley India (www.wwwdreamtech.com) .
For instance, "your competitors may have got hold of a product design you had spent years developing, reached the market before you, and be reaping all the benefits while you are going out of business."
In such a situation, prevention is your only sensible method of protecting your assets, advises Gollmann.
"There is not always a direct trade-off between prevention and detection. Practice shows that the more you invest in prevention, the more you may have to invest in detection to be certain that prevention works."
The author discusses `the fundamental dilemma of computer security,' which is that `security-unaware users have specific security requirements but usually no security expertise'. The dilemma appears in many disguises, and its resolution is currently the most pressing challenge, says Gollmann.
However, he adopts a no-nonsense approach to security, by assuring readers that computer security need not be seen as `a very complex issue'.
A disciplined approach to software development and a good understanding of a few essential security principles will carry you a long way, assures Gollmann.
The chapter on `managing passwords' reasons that `repeated authentication' addresses the problem of TOCTTOU (that is, `time of check to time of use'). If you are worried about dictionary attacks, but cannot hide the password file, think of `password salting', advises the author.
"When a password is encrypted for storage, additional information, the salt, is appended to the password before encryption. The salt is then stored with the encrypted password."
There are exercises at the end of each chapter. Try this, after a discussion of `access control': "You are given a set of categories. Implement a lattice-based need-to-withhold policy where you selectively withdraw access rights from subjects."
Gollmann also provides leads for `further reading', not in the form of a dry list but value-added with comments and insights.
For example, at the end of a chapter on `reference monitors', Gollmann writes: "An excellent account of the techniques used in the design of secure multi-user operating systems is available in Gasser (1988), which is out of print but available on the Web at... "
The Trusted Computer System Evaluation Criteria (TCSEC) a.k.a. the Orange Book, brought out by the US Department of Defense in 1985 was the first to gain wide acceptance, notes the author in a chapter on security evaluation.
The Commission of the European Communities responded with ITSEC (Information Technology Security Evaluation Criteria) in 1991, and Canada has CTCPEC (Canadian Trusted Computer Product Evaluation Criteria). Common Criteria (or CC) were born in 2004 after "various organisations in charge of national security evaluations came together in the Common Criteria Editing Board." CC became the international standard ISO 15048.
Gollmann devotes chapters to discuss the security of networks, software, distributed systems and databases. The chapter on `mobility' informs that the Bluetooth security architecture was designed for personal area networks.
"Attacks like Bluesnarf retrieve personal data from devices with flawed implementation of access control. Roaming profiles of users can be established when Bluetooth devices are configured to broadcast their identities on request."
Constructive read, as your first line of defence.
Notoriously tough network certifications!
FOR those going for SND, SNRS, SNPA, IPS and CSVPN exams, Cisco (www.ciscopress.com) has put together a `practice pack' in the form of CCSP Flash Cards, written by Grant Moerschel and Behzad Behtash.
CCSP stands for `Cisco Certified Security Professional'. Unlike other certification exams, the Cisco exams (which are `notorious as being some of the most difficult certifications in the networking industry') require that students truly understand the material, instead of just memorising answers, notes the introduction.
The book comes with a CD containing 1,000-plus flash cards, 500 practice test questions and `electronic copies of the 400 Quick Reference Sheets'. Flash cards are a quick and effective study aid, notes the introduction."They have been used to complement classroom training and significantly boost memory retention."
Section 1 titled `network security overview' begins with the poser, "What type of a threat does a disgruntled employee pose to an organisation?" and it is followed by, "What type of an attack involves an intruder attempting to discover and map the systems, services, and vulnerabilities in your network?" Right behind the page are answers: internal and reconnaissance.
Now, try these questions: "Which global command disables source routing, an IP feature allowing packets with a predefined route to override local routes? What is a TCP three-way handshake? What settings are specified in files ending with .pcf? List a security concern associated with split tunnelling? Name two reasons why attacking systems has become easier over the years?"
Quick reference sheets guide readers through topics, and the style is fast and easy. For instance, the `five phases of an attack' are explained as probe, penetrate, persist, propagate, and paralyse.
"The techniques used in the probe and penetrate phases vary because of the constant development of new attack vectors.
Accordingly, it is difficult to identify attacks until containment and development of a signature to describe the behaviour occur," explains the book.
From another `quick reference' one learns that `sensor blocking' or `shunning' is "an IPS (intrusion prevention system) signature response action that prevents an attacker who has triggered a signature from further access to the target."
Do you know that sensors ship with thousand and more `built-in signatures', which fire when misuse occurs?
"Each signature is assigned to an engine that is optimised to examine a particular type of communication.
When a signature `fires', there is a match between observed network activity and some definition of misuse found within a signature."
Essential read if the certifications exams are around the corner, and you don't want to burn the midnight oil.
Tailpiece
"He said, `Open sesame!'"
"And the cave opened?"
"No, he then pulled out the old SIM card to put into the new handset."
© Copyright 2000 - 2009 The Hindu Business Line