Cryptography The art or science encompassing the principles and methods of transforming an

intelligible message into one that is unintelligible, and then retransforming that message back to
its original form Plaintext The original intelligible message

Cipher text The transformed message

Cipher An algorithm for transforming an intelligible message into one that is unintelligible by

transposition and/or substitution methods

Key: Some critical information used by the cipher, known only to the sender& receiver

Encipher (encode) The process of converting plaintext to cipher text using a cipher and a key

Decipher (decode) the process of converting cipher text back into plaintext using a cipher and a

key

Cryptanalysis The study of principles and methods of transforming an unintelligible message

back into an intelligible message without knowledge of the key. Also called code breaking

Cryptology Both cryptography and cryptanalysis

Code An algorithm for transforming an intelligible message into an unintelligible one using a

code-book

Cryptography

Cryptographic systems are generally classified along 3 independent dimensions:

Type of operations used for transforming plain text to cipher text

All the encryption algorithms are based on two general principles: substitution, in which each

element in the plaintext is mapped into another element, and transposition, in which

elements in the plaintext are rearranged.

(i) The number of keys used

If the sender and receiver uses same key then it is said to be symmetric key (or)

single key (or) conventional encryption.

If the sender and receiver use different keys then it is said to be public key encryption.

(ii) The way in which the plain text is processed

A block cipher processes the input and block of elements at a time, producing output block for

each input block.

(iii) A stream cipher processes the input elements continuously, producing output element
one at a time, as it goes along.

Cryptanalysis

The process of attempting to discover X or K or both is known as cryptanalysis. The strategy

used by the cryptanalysis depends on the nature of the encryption scheme and the information
available to the cryptanalyst.

There are various types of cryptanalytic attacks based on the amount of information
known to the cryptanalyst.

Cipher text only – A copy of cipher text alone is known to the cryptanalyst.

Known plaintext – The cryptanalyst has a copy of the cipher text and the corresponding

plaintext.

Chosen plaintext – The cryptanalysts gains temporary access to the encryption machine. They
cannot open it to find the key, however; they can encrypt a large number of suitably chosen
plaintexts and try to use the resulting cipher texts to deduce the key.

Chosen cipher text – The cryptanalyst obtains temporary access to the decryption
machine, uses it to decrypt several string of symbols, and tries to use the results to deduce the
key.

STEGANOGRAPHY
A plaintext message may be hidden in any one of the two ways. The methods of steganography
conceal the existence of the message, whereas the methods of cryptography render
the message unintelligible to outsiders by various transformations of the text.

A simple form of steganography, but one that is time consuming to construct is one in which an
arrangement of words or letters within an apparently innocuous text spells out the real message.
e.g.,

(i) the sequence of first letters of each word of the overall message spells out the real (Hidden)
message.

(ii) Subset of the words of the overall message is used to convey the hidden message.

Various other techniques have been used historically, some of them are

Character marking – selected letters of printed or typewritten text are overwritten in pencil. The
marks are ordinarily not visible unless the paper is held to an angle to bright light.

Invisible ink – a number of substances can be used for writing but leave no visible trace until heat

or some chemical is applied to the paper.

Pin punctures – small pin punctures on selected letters are ordinarily not visible unless the

paper is held in front of the light. Typewritten correction ribbon – used between the lines typed

with a black ribbon, the results of typing with the correction tape are visible only under a strong

light.

Drawbacks of steganography

Requires a lot of overhead to hide a relatively few bits of information.

Once the system is discovered, it becomes virtually worthless.

Symmetric and public key algorithms

Encryption/Decryption methods fall into two categories.

Symmetric key

Public key

In symmetric key algorithms, the encryption and decryption keys are known both to sender

and receiver. The encryption key is shared and the decryption key is easily calculated from it.

In many cases, the encryption and decryption keys are the same.

In public key cryptography, encryption key is made public, but it is computationally

infeasible to find the decryption key without the information known to the receiver.

1. Symmetric·Key Cryptography

In symmetric-key cryptography, the same key is used by both parties. The sender uses this

key and an encryption algorithm to encrypt data; the receiver uses the same key and the

corresponding decryption algorithm to decrypt the data.

2. Asymmetric-Key Cryptography:

In asymmetric or public-key cryptography, there are two keys: a private key and a public

key. The private key is kept by the receiver. The public key is announced to the public.
A message is to be transferred from one party to another across some sort of internet. The two

parties, who are the principals in this transaction, must cooperate for the exchange to take place.

A logical information channel is established by defining a route through the internet from source
to destination and by the cooperative use of communication protocols (e.g., TCP/IP) by the

two principals.

Using this model requires us to:

– design a suitable algorithm for the security transformation

– generate the secret information (keys) used by the algorithm

– develop methods to distribute and share the secret information

– specify a protocol enabling the principals to use the transformation and secret information

for a security service

Using this model requires us to: – select appropriate gatekeeper functions to identify users

– implement security controls to ensure only authorized users access designated

information or resources

• Trusted computer systems can be used to implement this model

Definition of a Security Policy:

A security policy is a formal statement of the rules by which people who are given access to an
organization’s technology and information assets must abide.”

Why Create a Security Policy?

• To create a baseline of your current security posture

• To set the framework for security implementation
• To define permitted and non permitted behaviors
• To help determine necessary tools and procedures
• To communicate consensus and define roles
• To define how to handle security incidents

Implementation of a security policy as a continuous process

Network security is a continuous process built around a security policy it involves four steps
which are:

• Step 1: Secure
• Step 2: Monitor
• Step 3: Test
• Step 4: Improve
 Step 1: Secure the Network

Implement security solutions to stop or prevent unauthorized access or activities , and to protect
information. It involves the following processes

➢ Authentication
➢ Encryption
➢ Firewalls
➢ Vulnerability patching

Step 2: Monitor Security

This step detects violations to the security policy. It involves system auditing and real-time
intrusion detection. It validates the security implementation in Step 1

Step 3: Test Security

This step validates the effectiveness of the security policy through system auditing and
vulnerability scanning

Step 4: Improve Security

This step uses information from the monitor and test phases to make improvements to the
security implementation. It adjusts the security policy as security vulnerabilities and risks are
identified

PHYSICAL SECURITY
Physical access by a person may be allowed depending on payment, authorization, etc. Also there
may be one-way traffic of people. These can be enforced by personnel such as a border guards, a
doorman, a ticket checker, etc., or with a device such as a turnstile.
There may be fences to avoid circumventing this access control. An alternative of access control
in the strict sense (physically controlling access itself) is a system of checking authorized
presence, e.g. Ticket controller (transportation). A variant of an access control is exit control, e.g.
a shop (checkout) or a country.

In physical security, the term access control refers to the practice of restricting entrance to a
property, a building, or a room to authorized persons. Physical access control can be achieved by
a human (a guard, bouncer, or receptionist), through mechanical means such as locks and keys, or
through technological means such as access control systems like the mantrap. Within these
environments, physical key management may also be employed as a means of further managing
and monitoring access to mechanically keyed areas or access to certain small assets.

Physical access control is a matter of who, where, and when. An access control system
determines who is allowed to enter or exit, where they are allowed to exit or enter, and when they
are allowed to enter or exit. Historically this was partially accomplished through keys and locks.
When a door is locked only someone with a key can enter through the door depending on how the
lock is configured.

Mechanical locks and keys do not allow restriction of the key holder to specific times or dates.
Mechanical locks and keys do not provide records of the key used on any specific door and the
keys can easily be copied or transferred to an unauthorized person. When a mechanical key is lost
or the key holder is no longer authorized to use the protected area, the locks must be re-keyed.

Access control system operation

When a credential is presented to a reader, the reader sends the credential’s information, usually a
number, to a control panel, or a highly reliable processor.
The control panel compares the credential's number to an access control list, grants or denies the
presented request, and sends a transaction log to a database.
When access is denied based on the access control list, the door remains locked.
If there is a match between the credential and the access control list, the control panel operates a
relay that in turn unlocks the door.

There are three types (factors) of authenticating information in any access control system:
 something the user knows, e.g. a password, pass-phrase or PIN
 something the user has, such as smart card
 something the user is, such as fingerprint, verified by biometric measurement

Passwords are a common means of verifying a user's identity before access is given to
information systems. In addition, a fourth factor of authentication is now recognized: someone
you know, where another person who knows you can provide a human element of authentication
in situations where systems have been set up to allow for such scenarios

Physical security measures

The most essential security measures one should implement in an organization include:

1: Lock up the server room

Even before you lock down the servers, in fact, before you even turn them on for the first time,
you should ensure that there are good locks on the server room door. Of course, the best lock in
the world does no good if it isn’t used, so you also need policies requiring that those doors be
locked any time the room is unoccupied, and the policies should set out who has the key or key-
code to get in.

The server room is the heart of your physical network, and someone with physical access to the
servers, switches, routers, cables and other devices in that room can do enormous damage.

2: Set up surveillance

Locking the door to the server room is a good first step, but someone could break in, or someone
who has authorized access could misuse that authority. You need a way to know who goes in and
out and when. A log book for signing in and out for example, is the most elemental way to
accomplish this, however, it has a lot of drawbacks. A person with malicious intent is likely to
just bypass it.

3: Make sure the most vulnerable devices are in that locked room

Remember, it’s not just the servers you have to worry about. A hacker can plug a laptop into a
hub and use sniffer software to capture data traveling across the network. Make sure that as many
of your network devices as possible are locked in the server room, or if they need to be in a
different area, it should be in a locked closet elsewhere in the building.

4: Use rack-mount servers

Rack mount servers not only take up less server room space; they are also easier to secure. They
can easily be locked into closed racks that, once loaded with several servers, can then be bolted to
the floor, making the entire package almost impossible to move, much less to steal.
5: Don’t forget the workstations

Hackers can use any unsecured computer that’s connected to the network to access or delete
information that’s important to the business. Workstations at unoccupied desks or in empty
offices (such as those used by employees who are on vacation or have left the company and not
yet been replaced) or at locations easily accessible to outsiders, such as the front receptionist’s
desk, are particularly vulnerable.

6: Keep intruders from opening the case

Both servers and workstations should be protected from thieves who can open the case and grab
the hard drive. It’s much easier to make off with a hard disk in your pocket than to carry a full
tower off the premises. Many computers come with case locks to prevent opening the case
without a key. You can get locking kits from a variety of sources for very low cost, such as the
one at Innovative Security Products.

7: Protect the portables

Laptops and handheld computers pose special physical security risks. A thief can easily steal the
entire computer, including any data stored on its disk as well as network logon passwords that
may be saved.

Handhelds can be locked in a drawer or safe or just slipped into a pocket and carried on when
you leave the area. Motion sensing alarms such as the one at SecurityKit.com are also available
to alert you if your portable is moved.

For portables that contain sensitive information, full disk encryption, biometric readers, and
software that “phones home” if the stolen laptop connects to the Internet can supplement physical
precautions.
8: Pack up the backups

Backing up important data is an essential element in disaster recovery; however, the information
on those backup tapes, disks, or discs can be stolen and used by someone outside the company.
Many IT administrators keep the backups next to the server in the server room. They should be
locked in a drawer or safe at the very least. A set of backups should be kept off site, and you must
take care to ensure that they are secured in that offsite location.

9: Disable the drives

If you don’t want employees to copy company information to removable media, you can disable
or remove floppy drives, USB ports, and other means of connecting external drives. Simply
disconnecting the cables may not deter technically savvy workers. Some organizations go so far
as to fill ports with glue or other substances to permanently prevent their use, although there are
software mechanisms that disallow it. Disk locks, such as the one at SecurityKit.com, can be
inserted into floppy drives on those computers that still have them to lock out other diskettes.

10: Protect your printers

You might not think about printers posing a security risk, but many of today’s printers store
document contents in their own on-board memories. If a hacker steals the printer and accesses its
memory, he or she may be able to make copies of recently printed documents. Printers like
servers and workstations have the ability to store important information and should be located in
secure locations and bolted down so that nobody can walk off with them.

Physical controls support and work with administrative and technical (logical) controls to supply
the right degree of access control.

Physical Control Components

Network Segregation
Network segregation can be carried out through physical and logical means. A section of the
network may contain web servers, routers, and switches, and yet another network portion may
have employee workstations.
Each area would have the necessary physical controls to ensure that only the permitted
individuals have access into and out of those sections.

i)Perimeter Security
The implementation of perimeter security depends upon the company and the security
requirements of that environment.
One environment may require employees to be authorized by a security guard by showing a
security badge that contains picture identification before being allowed to enter a section.
Another environment may require no authentication process and let anyone and everyone into
different sections.

Perimeter security can also encompass closed-circuit TVs that scan the parking lots and waiting
areas, fences surrounding a building, lighting of walkways and parking areas, motion detectors,
sensors, alarms, and the location and visual appearance of a building. These are examples of
perimeter security mechanisms that provide physical access control by providing protection for
individuals, facilities, and the components within facilities.

ii) Computer Controls

Each computer can have physical controls installed and configured, such as locks on the cover so
that the internal parts cannot be stolen, the removal of the floppy and CD-ROM drives to prevent
copying of confidential information, or implementation of a protection device that reduces the
electrical emissions to thwart attempts to gather information through airwaves.

iii) Work Area Separation

Some environments might dictate that only particular individuals can access certain areas of the
facility.
iv) Data Backups
Backing up data is a physical control to ensure that information can still be accessed after an
emergency or a disruption of the network or a system.

v) Cabling
There are different types of cabling that can be used to carry information throughout a network.
Some cable types have sheaths that protect the data from being affected by the electrical
interference of other devices that emit electrical signals.

Some types of cable have protection material around each individual wire to ensure that there is
no crosstalk between the different wires. All cables need to be routed throughout the facility in a
manner that is not in people’s way or that could be exposed to any danger of being cut, burnt,
crimped, or eavesdropped upon.

vi) Control Zone

It is a specific area that surrounds and protects network devices that emit electrical signals. These
electrical signals can travel a certain distance and can be contained by a specially made material,
which is used to construct the control zone.

The control zone is used to resist penetration attempts and disallow sensitive information to
“escape” through the airwaves. A control zone is used to ensure that confidential information is
contained and to hinder intruders from accessing information through the airwaves.
Companies that have very sensitive information would likely protect that information by creating
control zones around the systems that are processing that information

Examples of Physical Control

(i) Fences
(ii) Locks
(iii) Badge system
(iv)Security guard
(v) Biometric system
 (vi)Mantrap doors
(vii) Lighting
(viii) Motion detectors
 Closed-circuit TVs
 Alarms
 Backups

DATABASE SECURITY
Database security concerns the use of a broad range of information security controls to protect
databases (potentially including the data, the database applications or stored functions, the
database systems, the database servers and the associated network links) against compromises of
their confidentiality, integrity and availability.

It involves various types or categories of controls, such as technical, procedural/administrative

and physical. Database security is a specialist topic within the broader realms of computer
security, information security and risk management.

Security risks to database systems include:

 Unauthorized or unintended activity or misuse by authorized database users, database

administrators, or network/systems managers, or by unauthorized users or hackers (e.g.
inappropriate access to sensitive data, metadata or functions within databases, or
inappropriate changes to the database programs, structures or security configurations);
 Malware infections causing incidents such as unauthorized access, leakage or disclosure
of personal or proprietary data, deletion of or damage to the data or programs, interruption
or denial of authorized access to the database, attacks on other systems and the
unanticipated failure of database services;
 Overloads, performance constraints and capacity issues resulting in the inability of
authorized users to use databases as intended;
  Physical damage to database servers caused by computer room fires or floods,
overheating, lightning, accidental liquid spills, static discharge, electronic
breakdowns/equipment failures and obsolescence;
 Design flaws and programming bugs in databases and the associated programs and
systems, creating various security vulnerabilities (e.g. unauthorized privilege escalation),
data loss/corruption, performance degradation etc.;
 Data corruption and/or loss caused by the entry of invalid data or commands, mistakes in
database or system administration processes, sabotage/criminal damage etc.

Many layers and types of information security control are appropriate to secure a database. These
may include:

 Access control
 Auditing
 Authentication
 Encryption
 Integrity controls
 Backups
 Application security – softwares to monitor

APPLICATIONS AND SYSTEMS DEVELOPMENT SECURITY

Security Development Controls

1. Administration Control
The administrative controls are defined by the top management in an organization.

Examples of Administrative Controls

(i) Security policy

(ii) Monitoring and supervising
(iii) Separation of duties
(iv)Job rotation
(v) Information classification
(vi)Personnel procedures
(vii) Investigations
(viii) Testing
(ix)Security-awareness and training

2. Policy and Procedures

(i) A security policy is a high-level plan that states management’s intent pertaining to how
security should be practiced within an organization. It also includes actions are
acceptable, and what level of risk the company is willing to accept. This policy is derived
from the laws, regulations, and business objectives that shape and restrict the company.
(ii) The security policy provides direction for each employee and department regarding how
security should be implemented and followed. It also includes the repercussions for non-
compliance. Procedures, guidelines, and standards provide the details that support and
enforce the company’s security policy.

3. Personnel Controls
(i) Personnel controls indicate how employees are expected to interact with security
mechanisms, and address noncompliance issues pertaining to these expectations.
(ii) Change of Status: These controls indicate what security actions should be taken when an
employee is hired, terminated, suspended, moved into another department, or promoted.
(iii) Separation of duties: The separation of duties should be enforced so that no one
individual can carry out a critical task alone that could prove to be detrimental to the
company.

4. Supervisory Structure
Management must construct a supervisory structure which enforces management members
to be responsible for employees and take a vested interest in their activities. If an employee
 is caught hacking into a server that holds customer credit card information, that employee
and her supervisor will face the consequences?

5. Security-Awareness Training
This control helps users/employees understand how to properly access resources, why
access controls are in place and the ramification for not using the access controls properly.

6. Testing
This control states that all security controls, mechanisms, and procedures are tested on a
periodic basis to ensure that they properly support the security policy, goals, and objectives
set for them.

The testing can be a drill to test reactions to a physical attack or disruption of the network, a
penetration test of the firewalls and perimeter network to uncover vulnerabilities, a query to
employees to gauge their knowledge, or a review of the procedures and standards to make sure
they still align with business or technology changes that have been implemented.

INTERNET SECURITY
Internet security is a branch of computer security specifically related to the Internet, often
involving browser security but also a part of network security on a more general level as it
applies to other applications or operating systems. Its objective is to establish rules and measures
to use against attacks over the Internet.
The Internet represents an insecure channel for exchanging information leading to a high risk of
intrusion or fraud, such as phishing. Different methods have been used to protect the transfer of
data over the internet, including encryption. Some of the Common IT security measures used
includes:

Common IT security measures

Access control ensures that individuals can only access data and services for which they are
authorized. Some of the common IT security measures include:
(i) Physical control of access to premises and computers
(ii) A clean desk policy so that sensitive or confidential information (including passwords) is
not left lying around
(iii) Individual passwords that randomly mix letters and characters, and are regularly
changed and not shared with others
(iv)Network restrictions to prevent access to other computer systems and networks
(v) Application controls to ensure individuals are limited in the data or service they can
access
(vi)Restrictions on what can be copied from the system and stored on pen drives, memory
sticks or cds/dvds
(vii) Limits on the sending and receiving of certain types of email attachments

Modern operating systems and network software have the ability to achieve most of this, but you
still need to manage the registration of users and user authentication systems – e.g. passwords.

Other IT security measures

Security software
Security software can help detect and remove computer viruses and other malware. Without
protection, malware can damage your IT system, access confidential data or create further
security holes for hackers to exploit.

Data encryption
Encryption scrambles data, and is used to protect information that is being held on a computer,
stored on external media such as DVDs or transmitted over a network.

Firewall
A firewall is a hardware or software security device that filters information passing between
internal and external networks. It controls access to the internet by internal users, and prevents
outside parties from gaining access to your network.
Intrusion detection
These products monitor system and network activity to spot potential security breaches. If a
detection system suspects an attack, it can generate an alarm, such as an email alert, based upon
the type of activity it has identified.

THREATS IN NETWORK
Main aims of threats are to compromise confidentiality, integrity applied against data, software,
hardware by nature accidents, non-malicious humans and malicious attackers.
What Makes A Network Vulnerable?
(i) Anonymity – leaving no trace for identification
(ii) Many Points Of Attack
(iii) Sharing
(iv) Complexity Of System
Threat originate mainly from :
(i) Port scan
(ii) Social Engineering - getting favour from employee and getting info from network
(iii) Reconnaissance - investigations by hackers
(iv)Operating System and Application fingerprinting
(v) Bulletin Boards and chats
(vi)Availability of Documentation

Threats In Transit: Eavesdropping and Wiretapping

The term eavesdrop implies overhearing without expanding any extra effort. For example we
can say that an attacker is eavesdropping by monitoring all traffic passing through a node.
The more hostile term is wiretap, which means intercepting communication through some
effort.
Choices of wiretapping are:
1. Cable
2. Microwave
3. Satellite Communication
 4. Optical Fiber
5. Wireless
From, a security stand point we should assume all communication links between network nodes
that can broken. For this reason commercial network users employ encryption to protect the
confidentiality of their communication.

Protocol Flaws:
Each protocol is identified by its Request For Comment (RFC) number. In TCP, the sequence
number of the client increments regularly which can be easily guessed and also which will be
the next number.
Impersonation:
In many instances, there is an easier way than wiretapping for obtaining information on a
network: impersonate another person or process.
In impersonation, an attacker has several choices:
i. Guess the identity and authentication details of the target
ii. Disable authentication mechanism at the target computer
iii. Use a target that will not be authenticated
iv. Use a target whose authentication data are known
Spoofing:
Obtaining the network authentication credentials of an entity(a user, an account, a process, a
node, a device) permits an attacker to create a full communication under the entity’s identity.
Examples of spoofing are masquerading, session hijacking, and man-in-the-middle attacks.
i. In a masquerade one host pretends to be another.
ii. Session hijacking is intercepting and carrying on a session begun by another entity.
iii. Man-in-the-middle attack is a similar form of attack, in which one entity intrudes between
two others.

Message Confidentiality Threats:

An attacker can easily violate message confidentiality (and perhaps integrity) because of the
public nature of networks. Eavesdropping and impersonation attacks can lead to a
confidentiality or integrity failure.
Here we consider several other vulnerabilities that can affect confidentiality.
i. Misdelivery
ii. Exposure
iii. Traffic Flow Analysis
Message Integrity Threats:
In many cases, the integrity or correctness of a communication is at least as important as its
confidentiality. In fact for some situations, such as passing authentication data, the integrity of
the communication is paramount.
Threats based upon failures of integrity in communication
i. Falsification of messages
ii. Noise
confidentiality. In fact for some situations, such as passing authentication data, the integrity
of the communication is paramount. Threats based upon failures of integrity in communication
i. Falsification of messages
ii. Noise