View
2
Download
0
Category
Preview:
Citation preview
5MMSSI - Information Systems Security0 - Introduction
Fabien Duchene1
Karim Hossen1
1Laboratoire d’Informatique de Grenoble, VASCO teamGrenoble Institute of Technology - Ensimag
firstname.name@imag.fr
2011-2012Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 1/37 2011-2012 1 / 37
Outline
1 Your lecturersFabien DucheneKarim Hossen
2 Pedagogic contractAfter that course...EthicsWhat is expected from you?Resources
3 Security?Why?What?Basic definitions
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 2/37 2011-2012 2 / 37
Your lecturers Fabien Duchene
Fabien Duchene
Information Security2011: PhD student, LIG, France2010: Implementer, Pentester, Trainer Sogeti-ESEC, France2009: Security Engineering Intern, Microsoft, France
Teaching2010-2011: 4MMSR-Network Security, Ensimag, France2011: MS PKI ADCS 2008 R2, Sogeti-ESEC, France2010: Forefront, Microsoft TechDays 2010, Paris, France
http://car-online.fr/en/spaces/fabien duchene/PGP fingerprint: 8C16 9A97 BD01 19DC BA51 7361 60AC 98E9 E77D 3800
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 3/37 2011-2012 3 / 37
Your lecturers Karim Hossen
Karim Hossen
Career2011: PhD student, LIG, France2010: *** confidential ***2009: Automatic differentiation, INRIA, TROPICS
Teaching2010-2011: 4MMCAWEB - conceiving web application, Ensimag
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 4/37 2011-2012 4 / 37
Pedagogic contract After that course...
After that course...
You will be able to (non exhaustive list):find and exploit basic vulnerabilities in an application (eg: Android,web, ...)quote some legal issues regarding IT securityperform a risk analysis with methods such as EBIOS or MEHARIdiscuss and manipulate various security topics: Identity Federation,Wireless security, three factors authentication, role-based accesscontrol, encryption, ddos, html5, ipsec...perform forensics and reverse engineering on systemsexplain how iOS does prevent applications not from the Apple Storeto be loadedapprehend new IT security concepts in a large distributed corporateenvironment
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 5/37 2011-2012 5 / 37
Pedagogic contract Ethics
Ethics
If you find a vulnerability in an application/system/network that is NOTyours
Do not exploit it (prosecution)Report it responsiblyBe patient and comprehensive. Patching or correcting aconfiguration is a matter of risk management
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 6/37 2011-2012 6 / 37
Pedagogic contract What is expected from you?
Review the courses
Requirements:operating systems (4MMSEPS2 ”Systeme d’exploitation etprogrammation concurrente”)networks and protocols (3MMRTEL ”Introduction aux Reseaux deCommunication”)applied probability (3MMPA1 ”Probabilites appliquees”)assembly software (3MMCEP ”Conception et exploitation desprocesseurs” / ”Logiciel de base”)
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 7/37 2011-2012 7 / 37
Pedagogic contract What is expected from you?
What is expected from you?
BEFORE a lecture: (30 min / week)read and understand the slides (prepare questions)read some IT security news
DURING: actively and efficiently participatetake notes (some content is missing in your slide version)ask questions ... but also provide answers!
AFTER: (2H/week)memorize and perform oral feedback ... both the very same day wehad lecture!ExercisesPractical assessments: 5/20 (1H30/week) (2 p./group) 1
Final examination 2
Final challenge: 5/20 3 (individual mark)Written examination: 10/20
1Correction: the very next session by a randomly chosen student group2documents: only 1 two-sided A4 page allowed3knowledge from the practical assessments required
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 8/37 2011-2012 8 / 37
Pedagogic contract Resources
Resources
At EnsimagYour lecturersEnsiwiki:
5MMSSISecurIMAGA career in information security
Several tools / information sourcesHacktualities“MISC” french infosec magazineRSS, twitter (watch out selecting feeds you trust...)a feed Fabien likes: http://paper.li/corelanc0d3r
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 9/37 2011-2012 9 / 37
Security? Why?
Cyberwarfare
4
suspected chinese attack for Paris G20 files 5
200+ non-legitimate certificates certificates issued by Diginotar CAs 67
Stuxnet targeted industrial iranian nuclear plants 8 9
4[Wikipedia 2011a] cyberwarfare5[BBC 2011] Cyber attack on France targeted Paris G20 files6[F-Secure 2011] DigiNotar Hacked by Black.Spook and Iranian Hackers7[community 2011] Chromium Code Reviews8[Wikipedia 2011b] Stuxnet9[Nicolas Falliere and (Symantec) 2011] W32.Stuxnet Dossier
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 10/37 2011-2012 10 / 37
Security? Why?
Underground economy I
10
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 11/37 2011-2012 11 / 37
Security? Why?
Underground economy II
“Cybercrime is costing more than the drugs trade” 11
cybercrime in 2011worldwide: $114 billion ; 431 million victimsUSA: $32 billion, china: $25 billionFrance e1 billion (9 million victims)
porn:botnet: . 9,4 million USD for the Zeus botnet 12 Such botnetsusually combine spam and phishing.
10[Wired 2011] Crime, organized11[Symantec 2011] Norton Cybercrime report 201112[CLUSIF 2011] Panorama de la Cyber-criminalite - Annee 2010
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 12/37 2011-2012 12 / 37
Security? Why?
Business survivability I
Threats to business reputationSony Pictures: Lulzsec published usernames, passwordsYale university got 43.000 social security number stolen
Figure: Average number of identities exposed per data breach
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 13/37 2011-2012 13 / 37
Security? Why?
Business survivability II
RevengeEmployes: fired ones, hating their boss
LegalsPCI-DSS: electronic transactions a
Sarbanes-Oxley actb: auditor independenceCalifornia lawc : notify individual when Personally IdentifiableInformation know or believed to have been stolen
a[LLC 2010] PCI-DSS v2b[Sarbanes-Oxley Act] Sarbanes-Oxley Actc[Senator 2002] California law - amending SB 1386
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 14/37 2011-2012 14 / 37
Security? Why?
Hacktivism I
13
Some actions (2009..2011)Wikileaks:Anonymous: a
DDoS: paypal, mastercard, twitter, Tunisian gvtRiotsInformation release “leakflood”
Lulzsec: CIA website DDos, Sony passwords leakage (APT + SQLi),Nintendo, X-Factor, pron.com
a[Anonymous (hacktivist group)] Anonymous (hacktivist group)
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 15/37 2011-2012 15 / 37
Security? Why?
Hacktivism II
14
Is this bad?Militantism, protestsDangerous by some aspects:
some actions considered as cyber-criminalitygovernments fear civil disobedience
13[Hacktivism] Hacktivism14[CLUSIF 2011] Panorama de la Cyber-criminalite - Annee 2010
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 16/37 2011-2012 16 / 37
Security? What?
Security? I
Some security definitions“situation in which sbdy feels protected from dangerousness” ...relative!absolute security does not exist“security is a journey not a destination”“”“The only truly secure system is one that is powered off, cast in ablock of concrete and sealed in a lead-lined room with armed guards -and even then I have my doubts” a
a[Spafford 1989] Quotable Spaf
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 17/37 2011-2012 17 / 37
Security? What?
Security? II
Security is not about technologies ONLY[(Microsoft) 2004] Notions fondamentales de securite
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 18/37 2011-2012 18 / 37
Security? What?
Security? III
The attacker vs defender unevenness1. The defender has to protect all assets ; the attacker is free tochoose the weakest one2. the defender can only protect what he knows / is aware of ; theattacker can search for any vulnerable assets3. the defender has to be constantly vigilante ; the attacker canattack at any time4. the defender has to respect the rules (esp. law, money limits) ; theattacker can do anything
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 19/37 2011-2012 19 / 37
Security? What?
The 10 security laws
If a bad guy ... 15
1. can persuade you to run his program on...2. can alter the operating system on...3. has unrestricted physical access to ...4. can upload programs to
... your computer/website, it is not yours anymore!5: Weak passwords trump strong security6: A computer is only as secure as the administrator is trustworthy7: Encrypted data is only as (if not less) secure as the decryption key8: An out-of-date malware scanner is only marginally better than noscanner at all9: Absolute anonymity isn’t practical, in real life or on the Web10: Technology is not a panacea: ..people and procedures
15[The 10 immuable security laws] The 10 immuable security lawsFabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 20/37 2011-2012 20 / 37
Security? Basic definitions
security goals/objectives/properties I
confidentiality (data): 16
availability (system):integrity (data):authenticity (data):freshness (data):traceability (action):non-repudiation (action):privacy (identity):
16[SPaCiOS 2011] Analysis of the relevant concepts used in the case studies:applicable security concepts, security goals and attack behaviorsFabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 21/37 2011-2012 21 / 37
Security? Basic definitions
threat related vocabulary
threat: if happens invalidate at least one security goalvulnerability: property of a system that permits a threat to happenexploit: of a vulnerabilityattack: 1+ exploit(s)countermeasure: protects from threatshardening: implementing countermeasures in a systemsecurity policy:
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 22/37 2011-2012 22 / 37
Security? Basic definitions
Vulnerabilities impact classification
From the STRIDE classification17 18 .. in terms of impact!spoofing: usurpation of a legitimate user credentialtampering: alteration (modification or destruction) of data or systemrepudiation: unability to prove that an action has been performedinformation disclosure: leak of information (data, or systemconfiguration)denial of service: inability of the system to serve legitimate userselevation of privilege: gain of additional rights allowing the attackerto perform additional actions
17STRIDE = enjambee18[Microsoft 2005] STRIDE threat model
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 23/37 2011-2012 23 / 37
Appendix 0 - introduction summary
0 - introduction summary
pedagogic contrat: student behavior, practical assessmentsinfosec motivations: cybercrime, cyberwar, competitors, businessreputation, hacktivismsecurity properties: confidentiality, integrity, availability, freshness..basic security definitions: security policy, threat, vulnerability,exploit, attack ...
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 24/37 2011-2012 24 / 37
Appendix 5MMSSI - information systems security index
“5MMSSI - information systems security” index
1 - Selection of vulnerabilities and attacks2 - Security management: risk, legals, ethics3 - Cryptography and applications4 - Security testing techniques5 - Diverse security mechanisms: end-point, network, servers
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 25/37 2011-2012 25 / 37
Appendix For Further Reading
Ari Takanen Jared DeMott, Charlie Miller (2008). Fuzzing for SoftwareSecurity Testing and Quality Assurance.BBC (2011). Cyber attack on France targeted Paris G20 files.http://www.bbc.co.uk/news/business-12662596.CLUSIF (2011). Panorama de la Cyber-criminalite - Annee 2010. http://www.clusif.asso.fr/fr/production/ouvrages/pdf/CLUSIF-2011-Panorama-Cybercriminalite-annee-2010.pdf.community, Open source (2011). Chromium Code Reviews.http://codereview.chromium.org/7791032/diff/2001/net/base/x509_certificate.cc.Ensiwiki (2011). A career in information security.http://ensiwiki.ensimag.fr/index.php/A_career_in_Information_Security.F-Secure (2011). DigiNotar Hacked by Black.Spook and Iranian Hackers.http://www.f-secure.com/weblog/archives/00002228.html.
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 26/37 2011-2012 26 / 37
Appendix For Further Reading
LLC, PCI Security Standards Council (2010). PCI-DSS v2. https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf.Microsoft (2005). STRIDE threat model.http://msdn.microsoft.com/library/ms954176.aspx.(Microsoft), Cyril Voisin (2004). Notions fondamentales de securite.(Microsoft), Technet. The 10 immuable security laws.http://technet.microsoft.com/en-us/library/cc722487.aspx.Nicolas Falliere, Liam O Murchu and Eric Chien (Symantec) (2011).W32.Stuxnet Dossier.http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf.Nikam, Rajesh (2011). Introduction to Malware & Malware Analysis.http://chmag.in/article/sep2011/introduction-malware-malware-analysis.Senator (2002). California law - amending SB 1386.http://info.sen.ca.gov/pub/01-02/bill/sen/sb_1351-1400/sb_1386_bill_20020926_chaptered.html.
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 27/37 2011-2012 27 / 37
Appendix For Further Reading
SPaCiOS (2011). Analysis of the relevant concepts used in the casestudies: applicable security concepts, security goals and attack behaviors.http://www.spacios.eu.Spafford, Eugene H. (1989). Quotable Spaf.http://spaf.cerias.purdue.edu/quotes.html.Symantec (2011). Norton Cybercrime report 2011.http://www.symantec.com/about/news/resources/press_kits/detail.jsp?pkid=threat_report_16.Wikipedia. Anonymous (hacktivist group). https://secure.wikimedia.org/wikipedia/en/wiki/Anonymous(group).wikipedia. Hacktivism.https://secure.wikimedia.org/wikipedia/en/wiki/Hacktivism.Wikipedia. Sarbanes-Oxley Act.https://secure.wikimedia.org/wikipedia/en/wiki/Sarbanes\OT1\textendashOxley_Act.— (2011a). cyberwarfare.https://secure.wikimedia.org/wikipedia/en/wiki/Cyberwarfare.
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 28/37 2011-2012 28 / 37
Appendix For Further Reading
Wikipedia (2011b). Stuxnet.https://secure.wikimedia.org/wikipedia/en/wiki/Stuxnet.Wired (2011). Crime, organized. Available athttp://www.wired.com/magazine/2011/01/ff_orgchart_crime/.
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 29/37 2011-2012 29 / 37
Bonus slides
Some Information Security jobs
hacker 19
security researcher / vulnerability analystspenetration tester / auditors 20
software security testersIT security:
IT security mechanisms implementerCISO (Chief Information Security Officer)
19[Ari Takanen 2008] Fuzzing for Software Security Testing and QualityAssurance
20[Ensiwiki 2011] A career in information securityFabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 30/37 2011-2012 30 / 37
Bonus slides
Phishing
(.. of course some kind of money benefit would then be derived)
some phishing examplesemail from the XXX bank you have to change your passwordsome welfare service sent you some money (eg: “french CAF”)paypal urge you to log on to your account
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 31/37 2011-2012 31 / 37
Bonus slides
Spam
How they earn generate money?promoting fake drugs, porn websitesphishingtraffic broker to exploit vulnerabilities in browser (goal: trojaninstallation for instance to participate in a botnet)
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 32/37 2011-2012 32 / 37
Bonus slides
Botnet
dd
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 33/37 2011-2012 33 / 37
Bonus slides
Scamming
some rich guy from a far away country has no children and wants togive you 10 million USD but you first have to send 100USD to him
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 34/37 2011-2012 34 / 37
Bonus slides
Common misconceptions - best dummies quotes
“Our corporation is secure because...”firewall, IDS/IPSchecksums thus integrity guaranteedno networks connected to the internet
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 35/37 2011-2012 35 / 37
Bonus slides
MALicious softWARES (malwares) categorization I
21
virus: self-replicating program injecting into a “host” (script,process...)worm: autonomous self-replicating programtrojan hose: apparently useful software but with hidden maliciousfunctionalitiesspyware: gathers personal or confidential information without theuser consent and sends them to a remote serverbackdoor: permits remote code execution on the victim’s computerand opens a communication channel to which the attacker connectshacktool: tools used by attackers to get access to the system.hacktools try to exploit vulnerabilities
Fabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 36/37 2011-2012 36 / 37
Bonus slides
MALicious softWARES (malwares) categorization II
rootkit: actively hides from the OS, usually has the ability to interactat a low level (I/O such as keyboard, mouse, display..)rogue application: “fake” application which pose themselves assecurity solutions (eg: faking malware detections). Usually misleaduser to pay for a pretended removal of malwares.
21[Nikam 2011] Introduction to Malware & Malware AnalysisFabien Duchene, Karim Hossen (LIG) 5MMSSI-0-Introduction 37/37 2011-2012 37 / 37
Recommended