What High School Students Should Know About Cyber Security and Privacy

CS4HS WorkshopAugust 2012

Rebecca WrightRutgers University

www.cs.rutgers.edu/~rebecca.wright

Today’s Computing Landscape• Today’s high school students are growing up in a

world with widespread use of networked communication and computers:– the Internet, WWW, social computing, cloud

computing, smart phones, and more!• Users are content providers, not just consumers.

• Computing, especially data-intensive computing, drives advances in almost all fields.

“Big data”

Today’s Computing Landscape (2)• Embedded systems in cars, medical devices,

household appliances, and other consumer products.• Critical infrastructure heavily reliant on software for

control and management, with increasing human interaction (e.g., Smart grid).

• Internet boundaries and international boundaries are not always aligned.

• Users tend to demand functionality over security/privacy (but want both).

What Every HS Student Should Know

• Minimally, students should know some basic concepts and best practices around cyber security and privacy.– analogous to knowing basic keyboarding skills and how to use important

applications like Powerpoint and Word.– these could be covered in a general-purpose technology class, study skills

seminars, or take-home or on-line activities to complete at home.

• Some (ideally all!) should also learn more advanced concepts:

­ These could be covered as part of a general computing course, or as a more specialized advanced computing or mathematics course.

­ Topics could include cryptography, methods and tools for secure communication, privacy, anonymity, and deanonymization, etc.

­ Some modules can be used in other courses (more later).

Basic Concepts and Best Practices

• password security– don’t use the same password for everything– change your passwords regularly– don’t tell your passwords to anyone else– password managers (such as LastPass and

1Password) can help

• back up important documents– important for when attacks or

accidents occur

Basic Concepts and Best Practices (2)

• privacy, understanding what is and isn’t private

• online safety­ good resources at www.safekids.org and

www.staysafeonline.org.– covers social media usage,

cyberbullying, photo sharing, implicitly even sexting, password security, no hacking, no illegal downloads, respect and tolerance.

What Every HS Student Should Know

• Minimally, students should know some basic concepts and best practices around cyber security and privacy.– analogous to knowing basic keyboarding skills and how to use important

applications like Powerpoint and Word.– these could be covered in a general-purpose technology class, study skills

seminars, or take-home or on-line activities to complete at home.

• Some (ideally all!) should also learn more advanced concepts:

­ These could be covered as part of a general computing course, or as a more specialized advanced computing or mathematics course.

­ Topics could include cryptography, methods and tools for secure communication, privacy, anonymity, and deanonymization, etc.

­ Some modules can be used in other courses (more later).

Example 1: Privacy

• Means different things to different people, to different cultures, and in different contexts.

• Appropriate uses of data:– What is appropriate?– Who gets to decide?– What if different stakeholders disagree?

• Simple approaches to “anonymization” don’t work in today’s world where many data sources are readily available.

• Thinking about users, uses, and usability is critical.­ Includes recognizing that different parties have different goals

and values.

Personally Identifiable Information• Many current privacy policies and solutions are based on the

concept of “personally identifiable information” (PII).

• However, this concept is not robust in the face of today’s realities.

• Any interesting and relatively accurate data about someone can be personally identifiable if you have enough of it and appropriate auxiliary information.

• In today’s data landscape, both of these are often available.

• Examples: Sweeney’s work [Swe90’s], AOL web search data [NYT06], Netflix challenge data [NS08], social network reidentification [BDK07], …

Reidentification• Sweeney: 87% of the US population can be uniquely

identified by their date of birth, 5-digit zip code, and gender.

• AOL search logs released August 2006: user IDs and IP addresses removed, but replaced by unique random identifiers. Some queries provide information about who the querier is, others give insight into the querier’s mind.

Birth dateZip codeGender

“Innocuous” databasewith names.

Allows complete or partial reidentification of individuals in sensitive database.

Netflix Case Study (1)

• Netflix has been accused of violating US privacy laws in five separate lawsuits filed during 2011. These lawsuits argue that Netflix holds onto customer information (credit card numbers and rental histories) long after customers cancel their memberships, claimed to be in violation of the Video Privacy Protection Act (VPPA). Evidence includes customers receiving e-mail messages after unsubscribing saying things like “We’d love to have you come back. We’ve retained all of your video choices.”

Netflix Case Study (2)• In 2006, Netflix held a contest challenging computer scientists to make

a better move-recommendation algorithm. The reward would pay $1 million to the winners. Data was made available to contestants including 100 million ratings and the date of each rating, with unique ID numbers in place of customers’ names and with some errors introduced to protect privacy.

• Soon after the contest began, a University of Texas professor and his PhD student identified several NetFlix users by comparing their “anonymous” reviews in the Netflix data to ones posted on the Internet Movie Data Base website. Revelations included information about their political leanings and sexual orientation.

• In 2009, a woman sued Netflix because it revealed information that could lead others to draw conclusions about her closeted sexual orientation. This led in part to the cancellation of a second Netflix Prize competition in 2010.

Case Study Privacy Questions1. What private information is collected and how is it collected?2. Could someone’s privacy be violated? Why and how, or why

not?3. Who could benefit from sharing the private information or from

combining it with information from other sources? Would such acts be justifiable?

4. How could privacy violations be prevented in this situation? Are the technological strategies for better protecting privacy?

5. What are the pros, cons, and compromises resulting from the sharing of private information in this situation?

6. How has this case study affected your thinking about privacy?

Example 2: User Authentication• Initial idea behind passwords:– a good password should be easy to remember but hard to guess.– if this holds, then passwords can be used as an authentication

mechanism.• It turns out this ideal is quite difficult to achieve.– things that are easy to remember are often easy to guess as well,

particularly if the guesser has some information about you.– people often forget their passwords, so backup methods are

needed. (These could also be called “security workaround mechanisms.”)

Three Kinds of Authenticators

• Something You Know– Passwords, life questions, pass

phrases/images/sequences/etc.• Something You Have– A magnetic strip card– Hardware challenge/response devices and cryptographic

calculators (such as RSA’s SecureID)• Something You Are– Biometrics such as fingerprint scans, iris scans– Characteristics such as keystroke typing patterns

Difficulties with Passwords• Online guessing attacks:

– if an attacker has a good idea what the password is, or if the system allows unlimited guesses, they can simply try to log in as you.

– most systems have some kind of lockout after a small number of failed attempts.• Offline guessing attacks:

– many systems have stored or communicated values based on user passwords that don’t directly reveal the password, but allow an attacker to determine whether a guess is correct or not.

– these “checkable records” can be used to mount an offline guessing attack.– if a password is known to be a single English word in the English dictionary (of about

250,000 words) and each one could be checked in 1 millisecond, then the password could be identified in less than 250,000 milliseconds, or 250 seconds, under 5 minutes.

– this is why longer, more random passwords using a larger character set is advisable!• Backup mechanisms are often weaker (especially if talking to a human is

involved: read the account of the recent hacking of a Wired reporter!)

Difficulties with Tokens

• people don’t like to carry them around.• they can be lost, so need to be used with an

additional mechanism (2-factor authentication).• a common 2-factor authentication mechanism

involves a password plus a hardware device.• among other benefits, this can be used to

ensure that there is no checkable record that can be used for an offline dictionary attack.

Difficulties with Biometrics

• False positives (someone else’s fingerprint is recognized as yours) and false negatives (your own fingerprint is not recognized as yours).

• theft (stealing a finger, with or without its person attached – both bad!)

• forgery of the biometric (“gummy” fingers made from gelatin based on “lifted” fingerprints)

• forgery of the sensor (how easily this is doable depends on the setting)

• revocation not possible

Today and The Future

• All three of these are currently in use.• Passwords remain the standard for

widespread application, despite their issues.• Two-factor authentication involving hardware

tokens is common for many business uses.• Biometrics are coming into more widespread

use, particularly in some government applications (and in the movies).

What Every HS Student Should Know

• Minimally, students should know some basic concepts and best practices around cyber security and privacy.– analogous to knowing basic keyboarding skills and how to use important

applications like Powerpoint and Word.– these could be covered in a general-purpose technology class, study skills

seminars, or take-home or on-line activities to complete at home.

• Some (ideally all!) should also learn more advanced concepts:

­ These could be covered as part of a general computing course, or as a more specialized advanced computing or mathematics course.

­ Topics could include cryptography, methods and tools for secure communication, privacy, anonymity, and deanonymization, etc.

­ Some modules can be used in other courses (more later).

More info: dimacs.rutgers.edu/VCTAL or vctal@dimacs.rutgers.edu

VCTAL Modules

• In testing:– It’s an Electrifying Idea! explores whether it’s time to buy

an electric car by examining its cost to own and convenience to operate.

– Heart Transplants, the NFL Draft, and Computational Thinking explores how groups of people make decisions on whom to select out of a group of eligible candidates.

– Network Capacity Expansion and Utilization uses simple simulations to help students think about congestion and capacity when constructing networks and choosing routes.

– Internet Privacy employs a series of case studies and activities to highlight privacy issues and solutions.

VCTAL Modules• In development:

– Fair and Stable Matching explores how to match players from two distinct sets, each with preferences on the other, when we want the resulting matches to be both stable and fair.

– Tomography and Reconstruction introduces the science of examining internal structures with external measurements.

– Foolproof Codes and Ciphers moves from use of code in WWII to more current uses of codes.

– Polynomiography and Art encourages computational thinking through one of the most basic and fundamental tasks in sciences and mathematics: solving a polynomial equation.

– Tragedy of the Commons – or Is It? looks at what makes most real-life commons, such as Internet access, robust and self-stabilizing.

– Connect Four and Games That Can Be More than Just Fun challenges students to find an efficient algorithm to produce perfect play from any configuration.

VCTAL: Internet Privacy Module• Day 1: discussion of privacy, information pooling hands-on

activity.• Days 2 and 3: privacy case studies:

– Netflix: Who’s Watching What You Watch?– Facebook’s Missing Beacon– 23andMe and You and You?!– Google Auto Complete– Are Loyalty Cards Loyal to You?– Should Foursquare Know Where You Aren’t?

• Day 4: secure multiparty computation (optional, more mathematical hands-on activity)

• Day 5 and out-of-class project: Compute-a-Date project.

More info: dimacs.rutgers.edu/VCTAL or vctal@dimacs.rutgers.edu

What High School Students Should Know About Cyber Security and Privacy

CS4HS WorkshopAugust 2012

Rebecca WrightRutgers University

www.cs.rutgers.edu/~rebecca.wright