CO CO 447 CO COURSE INTRODUCTION SE SECU CURIT RITY P PROP OPER ERTIE IES SE SECU CURE D RE DESIG SIGN Dr. Ben Livshits
Hi High-Le Level el Course e Lo Logistics cs 2 https://co447.doc.ic.ac.uk/
Cou Course Log ogistics 3 Monday, Wednesday 2-hour time slot for the class Instructors Dr Ben Livshits, Dr Soteris Dimitriou Course TAs Ms. Dominika Woszczyk, Mr. Daniel Perez Email doc-staff-447@imperial.ac.uk Piazza https://piazza.com/class/k0r3cj25uu0137
Wh What Helps You to Be Prepared for the Class Classes Cl Practica Pr cal knowledge You should ideally have maturity in both the ¨ Recommended (not required) ¨ mathematics of computer science and in the prerequisites are CO331 (Web engineering of computer systems and network security) This means that you should: have a good ¨ understanding of data structures and ¨ CO211 Operating systems algorithms; be comfortable writing programs from scratch in C, Java, and a scripting ¨ CO212 Networks and language like Python or JavaScript; be Communications comfortable writing and debugging assembly code; and be reasonably comfortable in a ¨ Related courses: command-line Unix development environment (gdb, gcc, etc). ¤ CO408H Privacy Enhancing Techniques You should also have a good understanding of ¨ computer architecture, operating systems, and ¤ CO409 Cryptography computer networks. It would also help to know a bit about programming languages and ¤ CO440 Software Reliability compilers. It would also be helpful to be ¤ CO470 Program Analysis. comfortable with web technologies such as HTML and JavaScript
Fi First-Da Day y Su Survey 5 https://docs.google.com/f orms/d/1nL2hquKDC4- eUG67X9yIBeD- xhust97pLkuyN5SnafE
Do Do NOT Be Be Scared ¨ Likely, nobody here has satisfied ev every single pr prerequi quisite . This is not the point. ¨ Most important thing of all: Eagerness to learn! ¤ ThisWe expect you to push yourself to learn as much as possible ¤ is a 400-level course. ¤ We expect you to be a strong, independent learner capable of learning new concepts from the lectures, the readings, and on your own.
Participation M Matters! s! ¨ This is an optional course ¨ I assume you are here because you want to be here ¨ I also assume that you intend to use what you learn later in life ¨ We only have a few chances to interact during the term ¨ You don’t get as much from this course if you don’t participate
Cou Course Reading: Textbook ook 8 ¨ The book is easy to read ¨ Not nearly as dry as an average textbook ¨ Has read-world illustrations and war stories ¨ Has lots of details not covered in lecture ¨ Proposes a different narrative focusing on the developer, which is good
Other Helpful Bo Books (online) ¨ Ross Anderson, “Security Engineering” (1st edition) ¤ Focuses on design principles for secure systems ¤ Wide range of entertaining examples: banking, nuclear command and control, burglar alarms ¤ You should all at least look at the Table of Contents for this book (2nd edition available for purchase) ¨ Menezes, van Oorschot, and Vanstone, “Handbook of Applied Cryptography” ¨ Many many other useful books exist (not all online)
Ro Role of Research 10 10 ¨ This is a 400-level course ¨ It is one of the goals to ge get you interested you in research in computer science
Re Reading Re Research Papers 11 11
Pa Paper Summaries 12 12
Cou Course Structure Ba Basics We Web Mo Mobile To Topics
Se Secu curity y Con Conce cepts 1. Authentication 2. Authorization 3. Confidentiality 4. Data/message integrity 5. Accountability 6. Availability 7. Non-repudiation
1) A Authentication ¨ Identity Verification ¨ How can Bob be sure that he is communicating with Alice? ¨ Three general strategies: ¤ Something you kn know w (i (i.e., Passwo words) ¤ Something you hav have (i.e .e., ., Tokens) ns) ¤ Something you are are (i.e .e., ., Biometri trics) cs)
Something Y You K Know ¨ Example: Passwords ¤ Pros: n Simple to implement n Simple for users to understand ¤ Cons: n Easy to crack (unless users choose strong ones) n Passwords are reused many times ¨ One-time Passwords (OTP): different password used each time, but it is difficult for user to remember all of them
Something Y You H Have ¨ OTP Cards (e.g. SecurID): generates new password each time user logs in ¨ Smart Card: tamper-resistant, stores secret information, entered into a card-reader ¨ Strength of authentication depends on difficulty of forging
Yb Ybikey 18 18
Or Or Maybe I Have a Browser Cookie 19 19 Cookie is part of subsequent requests
Bi Biom ometrics cs 20 20 ¨ Pros: “raises the bar” Technique Effectiveness Acceptance ¨ Cons: false negatives/positives, Palm Scan 1 6 social acceptance, key Iris Scan 2 1 management Retinal Scan 3 7 ¤ False positive: authentic Fingerprint 4 5 user rejected Voice Id 5 3 ¤ False negative: impostor accepted Facial 6 4 Recognition Signature 7 2 Dynamics
Final N Notes ¨ Two-factor Authentication: Methods can be combined (i.e. ATM card & PIN) ¨ Who is authenticating who? ¤ Person-to-computer? ¤ Computer-to-computer? ¨ Three types (e.g. SSL): ¤ Client Authentication: server verifies client’s id ¤ Server Authentication: client verifies server’s id ¤ Mutual Authentication (Client & Server) ¨ Authenticated user is a “ Pr Principal ”
2) 2) Au Authorization ¨ Checking whether a user has permission to conduct some action ¨ Identity vs. Authority ¨ Is a “subject” (Alice) allowed to access an “object” (open a file)? ¨ Access Control List : mechanism used by many operating systems to determine whether users are authorized to conduct different actions
Co Configuring Mailing List Permissions 23 23
Ac Access Control Lists (ACL CLs) ¨ Set of three-tuples Table 1-1. A Simple ACL ¤ <User, Resource, User Resource Privilege Privilege> Alice /home/Alice/* Read, write, ¤ Specifies which users execute are allowed to access which resources with which privileges Bob /home/Bob /* Read, write, execute ¨ Privileges can be assigned based on roles (e.g. ad admin )
Access C ss Control M Models ¨ ACLs used to implement these models ¨ Ma Mandatory : computer system decides exactly who has access to which resources ¨ Di Discretionary (e.g. UNIX): users are authorized to determine which other users can access files or other resources that they create, use, or own ¨ Ro Role-Ba Based (Non-Discretionary): user’s access & privileges determined by role
Recommend
More recommend
