20/08/2022

🙠 🙢
Chapter 1:
Overview
Lecturer: Nguyễn Thị Thanh Vân – FIT - HCMUTE

Content
� Introduction
� Security concepts
� OSI security architecture
o Security attacks,
o Security Services
o Security Mechanisms
� Models for network (access) security
� Network security terminologies
� Defense in depth

1/15/2018 2

1
 20/08/2022

Introduction
� Changes in information security

physical Storage devices data transmission on

media network

1/15/2018 3

Introduction
Security

Physical Security Technological Security

Application OS Network
Security Security Security

2
 20/08/2022

The network to day

The current threat landscape

1/15/2018 6

3
 20/08/2022

Threat: the credentials - authentication and

authorization
� Applying the old concept of defense in depth is still a good
strategy to protect a user's identity
o strong pass -> frequent password changes -> MFA -> call back
feature

1/15/2018 7

Threat: Apps
� Security: How secure are these apps that are being
developed in-house and the ones that you are paying for
as a service?
� Company-owned versus personal apps: Users will have
their own set of apps on their own devices (BYOD
scenario). How do these apps jeopardize the company's
security posture and can they lead to a potential data
breach?

1/15/2018 8

4
 20/08/2022

Threat: Apps

1/15/2018 9

Threat: Data

1/15/2018 10

5
 20/08/2022

Network security Challenges

� Old techniques and broader results
o Viruses, malware, and trojans
o Lack of diligence and untrained employees
o Phishing and social engineering
o Targeted attack
o Crypto and ransomware

� The shift in the threat landscape

o In 2016, a new wave of attacks also gained mainstream visibility: is
called Government-sponsored cyber attacks: to steal information
that can be used against the hacked party

1/15/2018 11

Security concepts
� Computer Security: The protection an information system
in order to attain the applicable objectives of preserving of
information system resources: (CIA Triad)
o Integrity: Prevents unauthorized modification of S&I
o Availability: Prevents disruption of service and productivity.
o Confidentiality: Prevents unauthorized disclosure
of systems and information

(includes hardware, software,

firmware, information/ data,
and telecommunications)

1/15/2018
Availability 12

6
 20/08/2022

Computer Security Objectives

� Confidentiality
o Data confidentiality: not made available or disclosed to unauthorized
individuals
o Privacy: all individual information may be collected and stored and by
whom and to whom that information may be disclosed

� Integrity
o Data integrity: are changed only in a specified and authorized manner
o System integrity: System performs its intended function in an
undamaged manner, avoid to unauthorized handling of the system

� Availability
o Assures that systems work promptly and service is not denied to
authorized users

1/15/2018 13

CIA Triad

1/15/2018 14

7
 20/08/2022

Additional Concepts – CIA Triad+

� Authentication
o Verifying that users are who
they say they are and that each
input arriving at the system
came from a trusted source

� Accountability
(nonrepudiation)
o The security goal that
generates the requirement for
actions of an entity to be traced
uniquely to that entity

1/15/2018 15

The OSI security architecture

❖ ITU-T3 Recommendation
X.800, Security Architecture
for OSI.
❖ The OSI security architecture:
Security
▪ defines a systematic approach. attack
▪ is useful to managers in organizing
the task of providing security

Security
Security
mechanis
service
m

1/15/2018 16

8
 20/08/2022

The OSI security architecture

� Security attack:
o Any action that compromises the security of information owned
by an organization.
� Security mechanism:
o A process (or a device incorporating such a process) that is
designed to detect, prevent, or recover from a security attack.
� Security service:
o A processing or communication service that enhances the
security of the data processing systems and the information
transfers of an organization. The services are intended to
counter (cope) security attacks, and they make use of one or
more security mechanisms to provide the service

1/15/2018 17

Security attack
� A means of classifying security
attacks, used both in RFC 4949
o A passive attack attempts to
learn or make use of
information from the system
but does not affect system
resources
o An active attack attempts to
alter system resources or affect
their operation

1/15/2018 18

9
 20/08/2022

Passive attacks
� Passive attacks are in the nature of eavesdropping on,
or monitoring of, transmissions.
� The goal of the opponent is to obtain information that is
being transmitted (namespace, IP range, employee, phone numbers…)
� Passive attacks are very difficult to detect, because they
do not involve any alteration of the data

Passive Attack

Release of
Message Contents Traffic Analysis
(Interception)
1/15/2018 19

Passive attacks
an opponent learns
the contents of Hi, I am Bob
information in
transmissions.

Hi, I am Bob Hi, I am Bob

1/15/2018
related goals?
20

10
 20/08/2022

Passive attacks
determine the location and
identity of communicating
hosts and could observe the
frequency and length of
messages being exchanged
Meet me
Meet me at
at
Cinemax
Cinemax

Phhw ph dw
flqhpda

1/15/2018
related goals? 21

Active attacks
� Involve some modification of the data stream or the
creation of a false stream
� Difficult to prevent because of the wide variety of
potential physical, software, and network vulnerabilities
� Goal is to detect attacks and to recover from any
disruption or delays caused by them

Active
Attack

Denial of
Masquerade
Replay Modification Service
(Fabrication)
(Interuption)
1/15/2018 22

11
 20/08/2022

Active attacks: Masquerade

• Takes place when one entity
pretends to be a different entity
• Usually includes one of the
other
forms of active attack

related goals? 23
1/15/2018

Active attacks: Replay

• Involves the passive capture of
a data unit and its subsequent Transfer
Rs.1000 to
retransmission to produce an Darth.
unauthorized effect

Transfer Rs.1000
Transfer Rs.1000 to Darth.
to Darth.

1/15/2018
related goals? 24

12
 20/08/2022

Active attacks: Modification of messages

• Some portion of a legitimate Transfer
message is altered, or messages Rs.10,000 to
are delayed or reordered to Darth.
produce an unauthorized effect

Transfer Rs.1,000
to Darth. Transfer Rs.10,000
to Darth

25
1/15/2018
related goals?

Active attacks: denial of service

• Prevents or inhibits the

normal use or management
of communications facilities

1/15/2018
related goals? 26

13
 20/08/2022

Handling attacks

• Prevention
Passive • Hard to detect
attacks • Easy to stop

• Detection and
Active Recovery
attacks • Easy to detect
• Hard to stop
1/15/2018 27

Taxonomy of attacks with

relation to security goals

1/15/2018
OSI 28

14
 20/08/2022

Security service (X.800)

1/15/2018 29

1. Data Confidentiality
� The protection of transmitted data from passive
attacks
o Broadest service protects all user data transmitted
between two users over a period of time
o Narrower forms of service includes the protection of a
single message or even specific fields within a message

� The protection of traffic flow from analysis

o This requires that an attacker not be able to observe the
source and destination, frequency, length, or other
characteristics of the traffic on a communications facility
� some kind of encryption technology is used to
achieve confidentiality

1/15/2018 30

15
 20/08/2022

Taxonomy of Cryptography

20/08/2022 31

Symmetric encryption algorithms

A block cipher:
- processes the plaintext input in fixed-size blocks
- produces a block of ciphertext of equal size for each plaintext block.

16
 20/08/2022

DES Structure
The process of encrypting a 64-bit
block with DES:
o Initial permutation - IP
o 16 calculation loops using key
o Permutation end (be the inverse
of IP)

20/08/2022 33

Triple DES with two keys

� The 1st and 3rd stages use k1 The 2nd stage uses k2.
� Uses
o reverse cipher
� Attack
o known-plaintext

20/08/2022 34

17
 20/08/2022

General design of AES

� AES has defined three versions, with 10, 12, 14 rounds.
� The round keys are always 128 bits.

20/08/2022 35

Asymmetric Encryption with public key

confidentiality

20/08/2022 36

18
 20/08/2022

Asymmetric Encryption with private key

authentication and signature

20/08/2022 37

Procedure of RSA
● Encryption, decryption, and key generation in RSA

● Encryption: C = Me mod n, M < n using public key

● Decryption: M = Cd mod n using private key
● Signature: S = Md mod n, M < n using private key
● Verification: M = Se mod n using public key

19
 20/08/2022

Key Management
 Symmetric-key distribution
 Key-distribution center: KDC
 Session key
 KERBEROS
 Servers
 Operation
 Symmetric-key agreement
 Diffie-Hellman key agreement
 Public-key distribution
 Public announcement
 CA
 X.509

Ex, Symmetric /Asymmetric encryption

20/08/2022 40

20
 20/08/2022

2. Data integrity
� Can apply to a stream of messages, a single message,
or selected fields within a message
� Connection-oriented integrity service, one that deals with
a stream of messages, assures that messages are
received as sent with no duplication, insertion,
modification, reordering, or replays
� A connectionless integrity service, one that deals
with individual messages - provides protection against
message modification only

1/15/2018 41

3. Authentication
� assuring that a communication is accurate
o A single message: assures the recipient that the message is
from the source that it claims to be from
o An ongoing interaction: assures the 2 entities are accurate and
there is not a 3rd party can masquerade as 1 of the 2 legitimate
parties
� 2 specific authentication services are defined in X.800:
o Peer entity authentication: Provides for the corroboration
(verification) of the identity of a peer entity in a system
o Data origin authentication: Provides for the corroboration of the
source of a data unit

1/15/2018 42

21
 20/08/2022

Implementing Authentication

Quiz: An attacker correctly guesses Alice’s password and logins in as her. Is this a case of...
� False positive
� False Negative

1/15/2018 43

Means of Authentication
Something the individual knows Something the individual process
Password Smart card
PIN, Physical key
Answer Token

Something the individual is (Static biometrics)

fingerprint
retina,
Face
iris

Something the individual does (Dynamic biometric)

Voice,
Handwriting
1/15/2018 Typing rhythm 44

22
 20/08/2022

Authentication
� GOTPass: users employ “images and a one-time
numerical code” in order to secure password.
o using patterns and images instead of letters and numbers
o the generated digits random code

1/15/2018 45

Password-based Authentication - Threat

� Guessing the password for a given user allows impersonation
� Impersonating a real login program
� Keylogging to steal a password
� Four basic techniques are in use:

• User education
• Computer-generated passwords
• Reactive password checking
• Complex password policy
� Do not store passwords, but store something that is derived from
them
o Use a one-way hash function and store the result
o The password file is readable only for root/admin

1/15/2018 46

23
 20/08/2022

Pass-based Authentication –
Hash Functions

Password Quiz
1. If we do not have a trusted path between a user and the system, what
problem may occur. Check the correct answer(s):
User is not able to log into the system
User may provide the password to a malicious program

2. In the past, hashed passwords were stored in a publicly readable file

/etc/passwd. Why were shadow password files added instead of
making/etc/passwd file readable only to privileged users?

Shadow files are more efficient to access

There is other public information in /etc/passwd file that various
utilities need

24
 20/08/2022

Hash Function Characteristics Quiz

1. The hash function used for computing hashed password values
should meet the following requirements. Check the correct
answer(s):
Provide more efficient storage of password related information
Produce different hashed values for distinct passwords

Its inverse should be very hard to compute

2. How many unique four digits PINs are possible? Check the correct
answer:
1,000
100,000

10,000
1,000,000

4. Non-repudiation
� Prevents either sender or receiver from denying a
transmitted message
� Nonrepudiation, Origin
Proof that the message was sent by the specified party.

� Nonrepudiation, Destination
Proof that the message was received by the specified
party

1/15/2018 50

25
 20/08/2022

Non-repudiation Digital signature

1/15/2018 51

Non-repudiation Digital signature

� To make these assurances, the content must be digitally
signed by the content creator,
� Using a signature that satisfies the following criteria:
o The digital signature is valid.
o The certificate associated with the digital signature is current (not
expired).
o The signing person or organization, known as the publisher, is
trusted.
o The certificate associated with the digital signature is issued to
the signing publisher by a reputable certificate authority (CA).

1/15/2018
OSI 52

26
 20/08/2022

5. Access Control (Authorization)

� The ability to limit and control the access to host
systems and applications via communications links
o each entity trying to gain access must first be identified, or
authenticated

1/15/2018 53

5. Access Control (Authorization)

� ACL is used by many OS to determine whether
users are authorized to conduct different actions
o the mandatory access control (MAC): computer system
o the discretionary access control (DAC): users
o the role-based access control (RBAC): MAC (in special)
� The Bell-LaPadula Model: certain level of access.

1/15/2018 54

27
 20/08/2022

ACL
MAC

DAC

RBAC

55

Access Control (Authorization)

� BRAC Model:
the system decides
exactly which users are
allowed to access
which resources—but
the system does this in
a special way

1/15/2018 56

28
 20/08/2022

Role-Based
Access Control

- RBAC3 includes RBAC0 plus the

added functionality of both RBAC1
and RBAC2
- An RBAC0 system contains the
four types of entities (the minimum
functionality for an RBAC system):
• User: An individuals
• Role: A named job function
• Permission: mode of access
• Session: : A mapping between
a user and an activated subset of
the set of roles to which the user is
assigned

Access control lists

� Access control lists focus on the objects
o Typically implemented at operating system level
o Windows NT uses ACLs
o an ACL be stored In trusted part of the system
� An ACL corresponds to a column in the access control matrix
Ex: [a.out: (jason, {r,w,x}), (mick, {r,x})]
� How would a reference monitor that uses ACLs check the
validity of the request (jason, a.out, r)?

Objects trash a.out allfiles.txt

Subjects
jason {r,w} {r,w,x} {r,w}
mick {r,x} {r}

29
 20/08/2022

Capability lists

� A capability list corresponds to a row in the access control

matrix
Ex [jason: (trash, {r,w}), (a.out, {r,w,x}), (allfiles.txt, {r,w})]
� How would such a reference monitor check the validity of
the request (jason, a.out, r)?

Objects trash a.out allfiles.txt

Subjects
jason {r,w} {r,w,x} {r,w}
mick {r,x} {r}

Security Mechanism
� The mechanisms are divided into those that are implemented
in a specific protocol layer,
o TCP
o Application

� Feature designed to detect, prevent, or recover from a

security attack

� No single mechanism that will support all services required

� However, one particular element underlies many of the

security mechanisms in use:
o cryptographic techniques

1/15/2018 60

30
 20/08/2022

Specific Security Mechanism

algorithms to transform data
E(M,K)

assure the integrity of a data

prove the data source

ensure the identity of an entity

The insertion of bits into gaps in data

stream to prevent traffic analysis
Enable selection/ change of particular
secure routes for data
Use a trusted third party to assure certain
properties of a data exchange

1/15/2018 enforce access rights to resources.61

General Security Mechanism

Trusted The insertion of bits into gaps in data
Functionality stream to prevent traffic analysis

Security The marking the security attributes of a

Label resource.

Event Detection of security-relevant events.

General
Detection

Security an independent review and examination

Audit Trail of system records and activities

Security Deals with requests from mechanisms ->

Recovery
takes recovery actions
1/15/2018 62

31
 20/08/2022

Relationship Between Security Services

and Mechanisms

1/15/2018 63

Relationship Between Security objective

and Mechanisms
SECURITY
MECHANISM

1. ENCIPHERMENT ⮚DATA
CONFIDENTIALITY
2. DATA INTEGRITY
3. DIGITAL SIGNATURE
⮚DATA INTEGRITY
4. AUTHENTICATION
EXCHANGE
⮚AUTHENTICATION
5. TRAFFIC PADDING
6. ROUTING CONTROL
⮚NONREPUDIATION
7. NOTARIZATION
8.
1/15/2018 ACCESS CONTROL 64
⮚ACCESS CONTROL

32
 20/08/2022

A Model for Network Security

1/15/2018 65

A Model for Network Security

� A security-related transformation:
o encryption of the message: opponent is unreadable,
o addition of a code: verify the identity of the sender.
� Some secret information:
o shared by the two principals and, opponent is unknown.
o ex, encryption key used in conjunction with the transformation
� A trusted third party:
o achieve secure transmission. ex, distributing the secret
information to the two principals while keeping it from any
opponent.
o adjudicate disputes (disagreements) between the two principals
concerning the authenticity of a message transmission.

1/15/2018 66

33
 20/08/2022

A Model for Network Security

� Using this model requires us to:
o design a suitable algorithm for the security transformation

o generate the secret information (keys) used by the algorithm

o develop methods to distribute and share the secret information

o specify a protocol enabling the principals to use the

transformation and secret information for a security service

1/15/2018 67

A Model for Network Access Security

� Protect an information system from unwanted access.
o Hacker: with no harmful intent, simply gets satisfaction from
breaking and entering a computer system.
o The intruder can be a displeased employee who wishes to do
damage or a criminal who seeks to exploit computer assets for
financial gain

1/15/2018 68

34
 20/08/2022

A Model for Network Access Security

� Using this model requires us to:
o Select appropriate gatekeeper functions to identify users
o Implement security controls to ensure only authorized users
access designated information or resources

� Note that model does not include:

o monitoring of system for successful penetration
o monitoring of authorized users for misuse
o audit logging for forensic uses, etc.

1/15/2018 69

Defense in depth

Lock, Camera

UTM, Firewall, VPN, Routers,…

VLAN, IPS, IDS,…

OS, Update Management, Enpoint Security,…

Application Control, Antivirus,…

AAA, Encryption, Digital Signature…

1/15/2018 70

35
 20/08/2022

Network security appliances

20/08/2022 71

Network security appliances

� Next-gen Firewall
� IRS
� SIEM
� SOC
� SOAR
� SD-WAN

20/08/2022 72

36
 20/08/2022

Summary
� Security concepts
• Confidentiality,
• Integrity,
• Availability
o Authentication
o Nonrepudiation (Accountability)

� X.800 security architecture

o Security attacks,
o services,
o mechanisms

� Models for network (access) security

� Defense in depth

1/15/2018 73

37