1

IMS3110 INFORMATION SYSTEMS SECURITY

Week 2

IS SECURITY –Threats, Breaches and vulnerabilities

Lecturer: Sue FosterIMS3110

Weekly IS Security topics

BCP and disaster recoveryPresentation 7&8

Business continuity plans (BCP) and disaster recovery19 September10

Security policies etcPresentation 6

Security policies and procedures12 September9

Security design Presentation 5

Security design http://www.cert.org/archive/html/protect-critical -

systems.html

5 September8

E – commerce – internet securityPresentation 4

Internet security cont/d29 August7

Risk analysis Presentation 3

E-commerce - Internet security 22 August6

Risk managementAssignment 1 due = 5%Risk analysis 15 August5

IS Security access controls Presentation 1&2 (7.5%)

Risk management8 August4

Breaches, threats, vulnerabilitiesIS Security – access controlsAndrew Dixon – librarian – talk on accessing databases

and electronic journals, referencing internet sources etc.

Andrew is SIMS contact person at the library

1 August3

Introduction to IS security and the goals of IS Security

Presentations will be conducted in tutorials

IS Security – frameworkBreaches, threats, vulnerabilities

25 July2

No Tutorial this weekAssignment 1&2 handed out

Brief overview of the unit and unit outline Introduction to IS Security in organisations

18 July1

Tutorials Assessment Lecture TopicsDate (week beginning)Week

IMS3110

Assignments 1 and 2

l ASSIGNMENT 1 (5%)– Due Date: Week 5 beginning Monday, 15 August

– Overview of Assignment 2– Word count=1000 words

l ASSIGNMENT 2 (20%)– Due Date: Friday, 26 September – 5 pm – Option 1, 2 or 3 – 3000 words approx– Structured from Assignment 1

IMS3110

Lecture Objectives

l Know and understand threat classification scheme

l Know and understand the different types of threats

l Appreciate the possible complexity and severity of breaches

l Understand IS vulnerability to threats l Reflect on the CIA framework for all security

threats, breaches, vulnerabilities

2

IMS3110

Key Terms

l Threats Malicious codel Breaches Salami slicingl Vulnerabilities Wormsl Virus Trapdoors/backdoorl Hackers Controlsl Trojan horse Passwordsl CIA Denial of Servicel bomb

IMS3110

Threats

l Threats are possible attacks on targets such as information resources causing the system to lose confidentiality, integrity or availability (loss of CIA)

l Some threats manifest themselves in accidental occurrences and others are purposeful.

– Eg all hackers represent a potential danger or threat to an unprotected or vulnerable information system

(Whitman & Mattord, 2003)

IMS3110

Security Threats

l Availability– Denial of Service– Sabotage– Forces of nature

l Confidentiality/Privacy– Sniffing– Eavesdropping– Theft– Espionage

l Unauthorised access and data collection

l Integrity/Authenticity– Data/Message Tampering

l Identity– Masquerading

l Intellectual Property– Fraud– Piracy– Copyright infringement

ConfidentialityConfidentiality

IntegrityIntegrity AvailabilityAvailability

IMS3110

The goals of security are to provide:

ConfidentialityConfidentialityPrivacyPrivacy

IntegrityIntegrity AvailabilityAvailability

Accountability??

Non-repudiationAuthentication

3

IMS3110

Confidentiality

l Confidential data should only be accessed by authorised individuals

– How do we ensure this?l Data should be classified on a confidentiality

rating1 highly classified - 5 general use

l Authorised User Access should also be classified accordingly

l Ensures data integrity

IMS3110

Data Integrity

Whitman & Mattord (2003) state that “The quality or state of being whole, complete and uncorrupted .

Integrity of information is threatened when information is exposed to corruption, damage, destruction, modification or other disruption of its authentic state” p13

Data should be:– Correct – without error– Timely – up to date– Available as required

l http://gcn.com/23_20/security/26695-1.html

IMS3110

Government Computer News (GCN.com)07/26/04; Vol. 23 No. 20 Los Alamos cracks down on security By Wllson P. Dizard III GCN Staff

IMS3110

Availability

Whitman et al (2003) state, “Availability enables users who need to access to information to do so without interference or obstruction and to receive it in the required format. (p10)

– The property of being accessible and useable (without delay) upon demand by an AUTHORISED entity

– There should be no denial of service

4

IMS3110

Vulnerabilities

l A vulnerability is a weakness or fault in a system or protection mechanism that exposes information to attack or damage.

l Vulnerabilities can range from a flaw in a software package, to an unprotected system port or an unlocked door.

– (Whitman & Mattord, 2003 p29)

IMS3110

Vulnerabilities

l A vulnerability is a weakness in existing controls which might be exploited– Involves a possible threat to a target DUE

TO INADEQUATE CONTROLS

l Eg a hacker can illegally access a program and change the code:– Threat: the hacker – Threat type: Modifications– Target: program – Possibility: “can” due to ..

Inadequate access controls being in place

IMS3110

The Core Issues

THREATS

INFORMATION SYSTEM SECURITYDATA SECURITY =

Confidentiality, availability, integrity, Authenticity

BREACHES

Information system

VULNERABILITIES

IMS3110

"Laws of Vulnerabilities Gerhard Eschelbeck, chief technology officer, Qualys (2003)

l Companies have made significant strides in patching against vulnerabilities that threaten the perimeter, but fixing internal flaws is still a big problem, a researcher said Wednesday as he prepared to present his findings at the Black Hat security meetings in Las Vegas.

l At last year's annual Black Hat gathering, Gerhard Eschelbeck, the chief technology officer of Qualys, laid out what he dubbed the "Laws of Vulnerabilities," a number of observations about security flaws' behavior.

l Basing his research on statistical analysis of some 1.24 million vulnerabilities scanned over an 18-month period, Eschelbeck noted then that critical vulnerabilities, such as those exploited by Slammer, Code Red, and last summer's MSBlast, have a "half -life" of 30 days. In other words, about 50 percent of the vulnerable systems were patched within the first 30 days of a vulnerability's disclosure.

2004. l His revised research -- now based on a look at over 4 million critical vulnerabilities

collected from a two -and- a- half -year period -- points to a significant drop in half -life of threats to enterprises' perimeters.

l "The half -life went down from 30 days to just 21," said Eschelbeck. "That's a dramatic improvement."

Retrieved on 30 July 2004 and located athttp://www.internetweek.com/allStories/showArticle.jhtml?articleID=26100503

5

IMS3110

Hackers, Crackers and all that jazz

l Hackers– White hats– Black hats

l Script kiddiesl Crackers

Hacker Support Groups

DefConhttp://www.defcon.org/

Largest hacking convention in the world

Reference: http://rootprompt.org/article.php3?article=756

IMS3110

Hackers

l What are they?l What is the difference between white

hat hackers and black hat hackers?

IMS3110

Crackers

l Explore systems for the pure technical challenge

l Hobbyl Exploit systems without permission

– Data disclosure– Accidental damage

CIA!!!

IMS3110

Security Breach

A breach:l The disclosure, l modification or l destruction of a system’s information

resources– Data– Software– Hardware

6

IMS3110

Study in 2004 BY Computer Security Institute/FBI (CSI/FBI)

l 90% OF RESPONDENT ORGANISATIONS DETECTED COMPUTER SECURITY BREACHES WITHIN THE LAST 12 months

l 80% of these lost money to computer breaches up to $456m

l Internet attacks rose from 70% (2001) to 74% (2002)

IMS3110

Breaches To IS

l Breaches of information system security occurs when malicious code or unauthorised user:

– Gain unauthorised use of, or access to a computer system

– Copy or modify data and/or programs in the system, or release its information

– Destroy hardware, software, or data or lock the computer from proper user access

IMS3110

4,677 Viruses In First Six Months of 2004 by W. David Gardner, TechWeb News

(InternetWeek.comJuly 28, 2004, 12:00 PM EDT

l A firm specializing in the development of anti- virus and anti-spam software stated 4,677 new viruses were written in the firstsix months of 2004 -- an increase of 21 percent over the same period last year.

l The major viruses were Sasser, which had a 26.1 percent share of viruses, and variations of the Netsky virus, said Sophos analyst Graham Cluley.

l "About 70 percent of infected computers were infected by one German student," said Cluley.

l The student, 17 years old when he created the viruses, is awaiting trial in Germany. The teenager has been charged with writing both viruses.

IMS3110

SASSER WORM http://www.microsoft.com/security/incident/sasser.mspx

Virus Alert Severity Ratings – RED

l Published: June 18, 2004l The Sasser worm (W32.Sasser. And its variants is

circulating on the Internet. l This worm exploits the Local Security Authority

Subsystem Service (LSASS) issue that was addressed by the security update released on April 13 in conjunction with Microsoft Security Bulletin MS04-011.

7

IMS3110

Microsoft Virus Alert Severity Ratings – REDhttp://www.microsoft.com/security/incident/virus_severity_ratings.mspx

CRITICALA vulnerability related to Microsoft

software has been found, or an update is unavailable; two or more vectors of infection are known;

a new vector of infection is possible; the distribution potential is high; unique data destruction can occur; and a significant disruption of service has occurred.

IMS3110

Mydoom Worm

l The Mydoomworm installs a "back door" on infected computers, which virus writers can use to gain access to your PC. Variants of Mydoom are spreading to computers that have been infected with Mydoom.A.

l Microsoft urges you to take action to remove these worms and to help keep your computer safe from malicious intrusions.

IMS3110

The Blaster Worm

l The Blaster worm and its variants exploit a security issue related to the Remote Procedure Call (RPC) function.

l To help protect against this issue, Microsoft recommends that customers install the update released on September 10, 2003, in conjunction with Microsoft Security Bulletin MS03-039.

IMS3110

What is a worm??

Worms are malicious programs that replicate themselves constantly without requiring another program

Worms can continue replicating until they completely fill available resources; memory, hard drive space etc

CODE RED, NIMDA (ADMIN), SIRCAM AND KLEZ

Can use a variety of distribution vectors to programmatically distribute the virus – Polymorphic threat

8

IMS3110

Famous Breach: Internet Worm

l Spread on Internet, causing $100 million damagel Clogged memory but did not modify files or datal Cornell Commission reported on the incidentl Robert Morris was convicted in 1990 on one count of

the 1986 Computer Fraud and Abuse Act (New York)

l Increased public awareness of security problems (Eisenberg et al, 1989)

IMS3110

Significance Of The Case

l Used as a precedent for future hacker casesl Robert Morris was imprisonedl Commission set up by Cornell University

highlighted many controversial issuesl Liability placed with Cornell University for not

having adequate controls in place

IMS3110

Threat Classification

threats are grouped by activities:12 general categories organised into five main

groups:1 Inadvertent acts2 Deliberate acts3 Acts of God4 Technical failures5 Management failures

IMS3110

How Does This Help

l By examining each threat category in turn management can most effectively protect its information through policy, education and training, and technology controls.

l Each organisation should prioritise the real and present dangers based on its particular security situation, strategy and the exposure levels of its assets.

9

IMS3110

Threats To Information Security

Threat Group 5: Management failures

Equipment failureBugs, code problems, unknown loopholesAntiquated or outdated technologies

Threat Group 4: Technical failuresØTechnical hardware failures or errorsØTechnical software failures or errorsØTechnological obsolescence

Fire, flood, earthquake, lightningThreat Group 3: Acts of GodØForces of nature

Unauthorised access and/or data collectionBlackmail of information disclosureDestruction of systems or informationIllegal confiscation of equip or informationMalicious code, Viruses, worms, denial of service

Threat Group 2: Deliberate ActsØDeliberate acts of espionage or trespassØDeliberate acts of information extortionØDeliberate acts of sabotage or vandalismØDeliberate acts of theftØDeliberate software attacks

Accidents employee mistakesThreat Group 1: Inadvertent ActsActs of Human Error or failuresDeviations in quality of service by service providers

ExamplesCategories of threat

IMS3110

Deliberate Or Accidental

l Deliberate threats:– Attacks which are carried out intentionally eg an

unhappy employee installing a “logic bomb” in code, set to execute and destroy files, etc after their departure

l Accidental:– Unintentional attacks eg keying in a transaction

incorrectly

IMS3110

Interruption

l Following a threat attack, an information resource becomes damaged or inaccessible for a while.

l Typically information normally available from a source cannot be communicated to the desired destination, eg inability to access customer information

IMS3110

Interception

l An outsider gains access to the system in order to view data

l Enables an outsider to acquire and use internal data for their own advantage

l Eg intercept and decode electronic emissions

10

IMS3110

Modification

l An unauthorised person (insider or outsider) changes an information resource

– Eg Salami attack (slicing off portions of someone else’s data out of a record and accumulating it elsewhere to be used later)

IMS3110

Fabrication

l New data or transactions are entered into the system, having value to the perpetrator of the crime as a method of inserting incorrect information into the system in order to produce substantial errors

l Eg introduce a false withdrawal of funds transaction

IMS3110

THREAT TARGET AREAS

1. Physical securityHeating, ventilation

2. Natural hazardsFire, Flood

3. Hardware and software faults

Power/ equiment failureMalicious code

4. Media damage or destruction

Lack of an effective electronic records management process

5. Electromagnetic emanationsEavesdropping

6. Telecommunications compromise

Wire taps, traffic analysis

7. PeopleInside/Fraudoutside threats/Hackers

8. Data PrivacyData matching/profilingDisclosure of email

IMS3110

Malicious Code

Malicious code is a general term for programs that, when executed, would cause undesired results on a system. Users of the system usually are not aware of the program until they discover the damage:

l Virusesl Wormsl Trojan Horsesl Bombsl Trapdoorsl Salami slicing

11

IMS3110

Viruses

l Programs that replicate themselves, infecting programs or disks and damaging programs and /or data.

l Most companies encounter viruses. l Virus controls include:

– passwords– regular backups– antivirus programs

IMS3110

Trojan Horses

l program fragments that hide, and perform a disguised function.

l They can:– capture passwords, – disguise the introductions of viruses and worms;– spoof (trick) an individual into giving away access rights, file

ownership or other privileges– masquerade as someone else.

l A variation called the Trojan mule destroys itself after it has quietly completed its task

IMS3110

Bombs

l These are variants of the Trojan Horse. They are activated when a date, event or condition occurs, or when a period of time has elapsed after a given date event or condition.

l Typically they destroy data, programs or both.

l However they may take other malicious actions or send nasty messages.

IMS3110

Trapdoors

defined as: unauthorised undocumented code in the source document, that gives special privileges to certain users. (see SDLC phases – documentation)

l They are typically created during software development to facilitate such things as monitoring program performance, testing its features and making corrections and improvements in the code.

l Unfortunately they are not always removed at the end of software development. They may then be accidentally discovered and exploited by third parties.

BACKDOORSVirus leaves a trapdoor for a hacker to enter

12

IMS3110

Conclusion

l We have touched on the issues threatening information security and the impacts to information systems.

l As you can see the threats are multiplying exponentially and IT staff are finding it more and more difficult to keep up with the changes.

IMS3110

Revision Questions

l Briefly explain the concept of an information system security breach.

– How can security development be improved?

l Describe three major threats to an information system and discuss the impact these threats will have on the system and to the organisation in general

IMS3110

References

l Eisenberg et al, (1989) “The Cornell Commission: On Morris and the Worm” CACM, Vol 32, No 6

l Lock, K., Carr, H. H., & Warkentin, (1992) “Threats to information Systems: Today’s Reality, Yesterday’s Understanding”, MIS Quarterly, Vol 16 No 2, June

l Warman, A. R. (1993) “Computer Security Within Organisations”, MacMillan Information Systems Series, Ch. 1

l Whitman, M. E., & Mattord , H.J. (2003). Principles of Information Security. Canada: Thomson Learning, Inc.

IMS3110

Interesting Websites

Retrieved on July 2005 Located at:l http://www.microsoft.com/australia/security/e

ducators/default.aspxl http://www.securitypipeline.com/news/26100

463;jsessionid=TF2NU1PS24QQAQSNDBGCKHY

l Internetweek.com