security objectives and design
play

Security Objectives and Design Information Security Management Dr - PowerPoint PPT Presentation

Apr 04, 2023 •160 likes •1.55k views

Security Objectives and Design Information Security Management Dr Hans Georg Schaathun University of Surrey Autumn 2010 Week 2 Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 Week 2 1 / 54 The session Outline

  1. Security Design Real Security Challenges Question If it is that simple, why are there so many security issues? Security was not prioritised when the system was built. Now, it is a priority Too expensive to rebuild from scratch Most developers are not trained for security Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 11 / 54

  2. Security Design Real Security Challenges Question If it is that simple, why are there so many security issues? Security was not prioritised when the system was built. Now, it is a priority Too expensive to rebuild from scratch Most developers are not trained for security Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 11 / 54

  3. Security Design Real Security Challenges Question If it is that simple, why are there so many security issues? Security was not prioritised when the system was built. Now, it is a priority Too expensive to rebuild from scratch Most developers are not trained for security Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 11 / 54

  4. Security Design Real Security Challenges KISS Keep it simple, stupid What can we learn from the ideal design approach? When the task is to secure an existing, complex system? Consider simple components first asset by asset – how can they be accessed? interface by interface – how can they be (ab)used? user by user – what can they do? Analyse the composite sybsystems ... when you understand the components fully Throughout the module, look for ways to break the system or problem into smaller, simpler pieces. Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 12 / 54

  5. Security Design Real Security Challenges KISS Keep it simple, stupid What can we learn from the ideal design approach? When the task is to secure an existing, complex system? Consider simple components first asset by asset – how can they be accessed? interface by interface – how can they be (ab)used? user by user – what can they do? Analyse the composite sybsystems ... when you understand the components fully Throughout the module, look for ways to break the system or problem into smaller, simpler pieces. Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 12 / 54

  6. Security Design Real Security Challenges KISS Keep it simple, stupid What can we learn from the ideal design approach? When the task is to secure an existing, complex system? Consider simple components first asset by asset – how can they be accessed? interface by interface – how can they be (ab)used? user by user – what can they do? Analyse the composite sybsystems ... when you understand the components fully Throughout the module, look for ways to break the system or problem into smaller, simpler pieces. Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 12 / 54

  7. Security Design Real Security Challenges KISS Keep it simple, stupid What can we learn from the ideal design approach? When the task is to secure an existing, complex system? Consider simple components first asset by asset – how can they be accessed? interface by interface – how can they be (ab)used? user by user – what can they do? Analyse the composite sybsystems ... when you understand the components fully Throughout the module, look for ways to break the system or problem into smaller, simpler pieces. Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 12 / 54

  8. Security Design Real Security Challenges KISS Keep it simple, stupid What can we learn from the ideal design approach? When the task is to secure an existing, complex system? Consider simple components first asset by asset – how can they be accessed? interface by interface – how can they be (ab)used? user by user – what can they do? Analyse the composite sybsystems ... when you understand the components fully Throughout the module, look for ways to break the system or problem into smaller, simpler pieces. Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 12 / 54

  9. Security Design Real Security Challenges On Eating an Elephant? How do you eat an elephant? Take one little bit if more elephant, go to (1) Throughout the module, look for ways to cut bits off the elephant. Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 13 / 54

  10. Security Design Real Security Challenges On Eating an Elephant? How do you eat an elephant? Take one little bit if more elephant, go to (1) Throughout the module, look for ways to cut bits off the elephant. Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 13 / 54

  11. Security Design Real Security Challenges On Eating an Elephant? How do you eat an elephant? Take one little bit if more elephant, go to (1) Throughout the module, look for ways to cut bits off the elephant. Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 13 / 54

  12. Security Design Real Security Challenges On Eating an Elephant? How do you eat an elephant? Take one little bit if more elephant, go to (1) Throughout the module, look for ways to cut bits off the elephant. Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 13 / 54

  13. Security Design CObIT Outline The session 1 Security Design 2 Security and Simplicity Real Security Challenges CObIT Perimeter Defences 3 The fundamental dilemma 4 Summary 5 Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 14 / 54

  14. Security Design CObIT The CObIT Information Criteria Effectiveness Efficiency Confidentiality Integrity Availability Compliance Reliability Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 15 / 54

  15. Security Design CObIT Security is a means CObIT — Control Objectives for IT The Information Criteria is more than security Security is a means to reaching objectives Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 16 / 54

  16. Security Design CObIT Security is a means CObIT — Control Objectives for IT The Information Criteria is more than security Security is a means to reaching objectives Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 16 / 54

  17. Security Design CObIT Security is a means CObIT — Control Objectives for IT The Information Criteria is more than security Security is a means to reaching objectives Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 16 / 54

  18. Security Design CObIT Effectiveness and Efficiency Effectiveness relevance and suitability of information Information has to serve business processes accuracy, consistency and usability. Efficiency information with optimum use of resources minimise the cost of providing information and services Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 17 / 54

  19. Security Design CObIT The CIA Triad Security Criteria Confidentiality against unauthorised disclosure Integrity against unauthorised modification and falsification Availability for authorised users Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 18 / 54

  20. Security Design CObIT Compliance and Reliability Compliance deals with the adherence to laws, regulations and rontractual agreements businesses need to obey the laws of the land stick to contracts with clients and suppliers observe constent enforcement of own guidelines and policies Reliability – Reliable Management Information appropriate information and metrics to support management of the organisation meta-information to allow management of the other criteria managing to meet requirements and make surplus Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 19 / 54

  21. Perimeter Defences Outline The session 1 Security Design 2 Perimeter Defences 3 City Walls The Man-Machine Scale The User End Product and System The fundamental dilemma 4 Summary 5 Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 20 / 54

  22. Perimeter Defences City Walls Outline The session 1 Security Design 2 Perimeter Defences 3 City Walls The Man-Machine Scale The User End Product and System The fundamental dilemma 4 Summary 5 Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 21 / 54

  23. Perimeter Defences City Walls Classic Security Measure Walls protect the City Strict Access Control Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 22 / 54

  24. Perimeter Defences City Walls Trust within the City Walls Whom do you have to trust under a wall-type defence? Whom do you protect against? Assumption A City Wall defence assumes The enemy is outside the walls 1 We can trust anyone inside the walls 2 Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 23 / 54

  25. Perimeter Defences City Walls Trust within the City Walls Whom do you have to trust under a wall-type defence? Whom do you protect against? Assumption A City Wall defence assumes The enemy is outside the walls 1 We can trust anyone inside the walls 2 Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 23 / 54

  26. Perimeter Defences City Walls Security Perimeter City Walls form a perimeter The perimeter defines the scope of the security mechanism Protection against threats originating outside the perimeter No protection againts inside threats Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 24 / 54

  27. Perimeter Defences City Walls Security Perimeter City Walls form a perimeter The perimeter defines the scope of the security mechanism Protection against threats originating outside the perimeter No protection againts inside threats Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 24 / 54

  28. Perimeter Defences City Walls Security Perimeter City Walls form a perimeter The perimeter defines the scope of the security mechanism Protection against threats originating outside the perimeter No protection againts inside threats Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 24 / 54

  29. Perimeter Defences City Walls Security Perimeter City Walls form a perimeter The perimeter defines the scope of the security mechanism Protection against threats originating outside the perimeter No protection againts inside threats Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 24 / 54

  30. Perimeter Defences City Walls Perimeter Security Perimeter Security (or Perimeter Defences) refer to wall-like mechanisms protecting a large system/organisation ... like a city wall Simple organisation: concentrate all your resources on the perimeter maintain complete control of who and what is in the city Other examples: high-security buildings system-level access control fire-walls Most data centres are secured this way Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 25 / 54

  31. Perimeter Defences City Walls Perimeter Security Perimeter Security (or Perimeter Defences) refer to wall-like mechanisms protecting a large system/organisation ... like a city wall Simple organisation: concentrate all your resources on the perimeter maintain complete control of who and what is in the city Other examples: high-security buildings system-level access control fire-walls Most data centres are secured this way Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 25 / 54

  32. Perimeter Defences City Walls Perimeter Security Perimeter Security (or Perimeter Defences) refer to wall-like mechanisms protecting a large system/organisation ... like a city wall Simple organisation: concentrate all your resources on the perimeter maintain complete control of who and what is in the city Other examples: high-security buildings system-level access control fire-walls Most data centres are secured this way Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 25 / 54

  33. Perimeter Defences City Walls Perimeter Security Perimeter Security (or Perimeter Defences) refer to wall-like mechanisms protecting a large system/organisation ... like a city wall Simple organisation: concentrate all your resources on the perimeter maintain complete control of who and what is in the city Other examples: high-security buildings system-level access control fire-walls Most data centres are secured this way Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 25 / 54

  34. Perimeter Defences City Walls The fall of the wall Why don’t modern cities have walls? Walls work very well when you trust your insiders 1 large populations cannot be controlled ... complexity becomes overwhelming you don’t want or need to deal with outsiders 2 why don’t we trust a Greek bearing gifts? the walls prevent trade Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 26 / 54

  35. Perimeter Defences City Walls The fall of the wall Why don’t modern cities have walls? Walls work very well when you trust your insiders 1 large populations cannot be controlled ... complexity becomes overwhelming you don’t want or need to deal with outsiders 2 why don’t we trust a Greek bearing gifts? the walls prevent trade Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 26 / 54

  36. Perimeter Defences City Walls The fall of the wall Why don’t modern cities have walls? Walls work very well when you trust your insiders 1 large populations cannot be controlled ... complexity becomes overwhelming you don’t want or need to deal with outsiders 2 why don’t we trust a Greek bearing gifts? the walls prevent trade Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 26 / 54

  37. Perimeter Defences City Walls The fall of the wall Why don’t modern cities have walls? Walls work very well when you trust your insiders 1 large populations cannot be controlled ... complexity becomes overwhelming you don’t want or need to deal with outsiders 2 why don’t we trust a Greek bearing gifts? the walls prevent trade Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 26 / 54

  38. Perimeter Defences City Walls The fall of the wall Why don’t modern cities have walls? Walls work very well when you trust your insiders 1 large populations cannot be controlled ... complexity becomes overwhelming you don’t want or need to deal with outsiders 2 why don’t we trust a Greek bearing gifts? the walls prevent trade Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 26 / 54

  39. Perimeter Defences City Walls The fall of the wall Why don’t modern cities have walls? Walls work very well when you trust your insiders 1 large populations cannot be controlled ... complexity becomes overwhelming you don’t want or need to deal with outsiders 2 why don’t we trust a Greek bearing gifts? the walls prevent trade Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 26 / 54

  40. Perimeter Defences City Walls The fall of the wall Why don’t modern cities have walls? Walls work very well when you trust your insiders 1 large populations cannot be controlled ... complexity becomes overwhelming you don’t want or need to deal with outsiders 2 why don’t we trust a Greek bearing gifts? the walls prevent trade Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 26 / 54

  41. Perimeter Defences City Walls The fall of the wall Why don’t modern cities have walls? Walls work very well when you trust your insiders 1 large populations cannot be controlled ... complexity becomes overwhelming you don’t want or need to deal with outsiders 2 why don’t we trust a Greek bearing gifts? the walls prevent trade Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 26 / 54

  42. Perimeter Defences The Man-Machine Scale Outline The session 1 Security Design 2 Perimeter Defences 3 City Walls The Man-Machine Scale The User End Product and System The fundamental dilemma 4 Summary 5 Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 27 / 54

  43. Perimeter Defences The Man-Machine Scale Security Perimeters We discussed perimeters in terms of perimeter defences let’s extend the concept of a perimeter Every security control defines a perimeter Abstract or Concrete perimeters Only by recognising the perimeter can we understand ... which threats we control (outside) and which entities we have to trust (inside) This will become clearer as we proceed Remember to look for the perimeters when we discuss controls ... Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 28 / 54

  44. Perimeter Defences The Man-Machine Scale Security Perimeters We discussed perimeters in terms of perimeter defences let’s extend the concept of a perimeter Every security control defines a perimeter Abstract or Concrete perimeters Only by recognising the perimeter can we understand ... which threats we control (outside) and which entities we have to trust (inside) This will become clearer as we proceed Remember to look for the perimeters when we discuss controls ... Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 28 / 54

  45. Perimeter Defences The Man-Machine Scale Security Perimeters We discussed perimeters in terms of perimeter defences let’s extend the concept of a perimeter Every security control defines a perimeter Abstract or Concrete perimeters Only by recognising the perimeter can we understand ... which threats we control (outside) and which entities we have to trust (inside) This will become clearer as we proceed Remember to look for the perimeters when we discuss controls ... Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 28 / 54

  46. Perimeter Defences The Man-Machine Scale Security Perimeters We discussed perimeters in terms of perimeter defences let’s extend the concept of a perimeter Every security control defines a perimeter Abstract or Concrete perimeters Only by recognising the perimeter can we understand ... which threats we control (outside) and which entities we have to trust (inside) This will become clearer as we proceed Remember to look for the perimeters when we discuss controls ... Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 28 / 54

  47. Perimeter Defences The Man-Machine Scale Security Perimeters We discussed perimeters in terms of perimeter defences let’s extend the concept of a perimeter Every security control defines a perimeter Abstract or Concrete perimeters Only by recognising the perimeter can we understand ... which threats we control (outside) and which entities we have to trust (inside) This will become clearer as we proceed Remember to look for the perimeters when we discuss controls ... Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 28 / 54

  48. Perimeter Defences The Man-Machine Scale Security Perimeters We discussed perimeters in terms of perimeter defences let’s extend the concept of a perimeter Every security control defines a perimeter Abstract or Concrete perimeters Only by recognising the perimeter can we understand ... which threats we control (outside) and which entities we have to trust (inside) This will become clearer as we proceed Remember to look for the perimeters when we discuss controls ... Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 28 / 54

  49. Perimeter Defences The Man-Machine Scale The Man-Machine Scale ✬ ✩ ✬ ✩ applications ✬ ✩ services operating ✗ ✔ system ✞ ☎ OS kernel ✝ ✆ hardware ✖ ✕ ✫ ✪ ✫ ✪ ✫ ✪ Where on the scale do you put your controls (perimeters)? Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 29 / 54

  50. Perimeter Defences The Man-Machine Scale Example Operating System Access Control OS requires username and password on the console when the box boots on remote login ‘Where’ is the security perimeter? What is inside and what is outside? Perimeter defence between software and terminal (keyboard/screen) software inside; user outside No defence between software and core hardware (harddisk) the perimeter is not closed! Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 30 / 54

  51. Perimeter Defences The Man-Machine Scale Example Operating System Access Control OS requires username and password on the console when the box boots on remote login ‘Where’ is the security perimeter? What is inside and what is outside? Perimeter defence between software and terminal (keyboard/screen) software inside; user outside No defence between software and core hardware (harddisk) the perimeter is not closed! Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 30 / 54

  52. Perimeter Defences The Man-Machine Scale Example Operating System Access Control OS requires username and password on the console when the box boots on remote login ‘Where’ is the security perimeter? What is inside and what is outside? Perimeter defence between software and terminal (keyboard/screen) software inside; user outside No defence between software and core hardware (harddisk) the perimeter is not closed! Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 30 / 54

  53. Perimeter Defences The Man-Machine Scale Example Operating System Access Control OS requires username and password on the console when the box boots on remote login ‘Where’ is the security perimeter? What is inside and what is outside? Perimeter defence between software and terminal (keyboard/screen) software inside; user outside No defence between software and core hardware (harddisk) the perimeter is not closed! Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 30 / 54

  54. Perimeter Defences The Man-Machine Scale Example Operating System Access Control OS requires username and password on the console when the box boots on remote login ‘Where’ is the security perimeter? What is inside and what is outside? Perimeter defence between software and terminal (keyboard/screen) software inside; user outside No defence between software and core hardware (harddisk) the perimeter is not closed! Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 30 / 54

  55. Perimeter Defences The Man-Machine Scale Perimeter Observation Operating System Access Control Multi-dimensional there is a physical dimension – hardware there is a more abstract dimension – software A user is outside the security perimeter until a successful login The OS surrounds the entire system in a software sense attacks through software interfaces are prevented The hardware is also inside the OS perimeter but the OS does not control the hardware (except peripheral devices, like the terminal) Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 31 / 54

  56. Perimeter Defences The Man-Machine Scale Perimeter Observation Operating System Access Control Multi-dimensional there is a physical dimension – hardware there is a more abstract dimension – software A user is outside the security perimeter until a successful login The OS surrounds the entire system in a software sense attacks through software interfaces are prevented The hardware is also inside the OS perimeter but the OS does not control the hardware (except peripheral devices, like the terminal) Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 31 / 54

  57. Perimeter Defences The Man-Machine Scale Perimeter Observation Operating System Access Control Multi-dimensional there is a physical dimension – hardware there is a more abstract dimension – software A user is outside the security perimeter until a successful login The OS surrounds the entire system in a software sense attacks through software interfaces are prevented The hardware is also inside the OS perimeter but the OS does not control the hardware (except peripheral devices, like the terminal) Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 31 / 54

  58. Perimeter Defences The Man-Machine Scale Perimeter Observation Operating System Access Control Multi-dimensional there is a physical dimension – hardware there is a more abstract dimension – software A user is outside the security perimeter until a successful login The OS surrounds the entire system in a software sense attacks through software interfaces are prevented The hardware is also inside the OS perimeter but the OS does not control the hardware (except peripheral devices, like the terminal) Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 31 / 54

  59. Perimeter Defences The Man-Machine Scale Vulnerabilities in lower layers City walls can be flown over or dug under. The OS can control vulnerabilities in the software layers Hardware is a lower and therefore unprotected layer we can dig under the defence, through hardware Can you think of examples of how to dig under the OS access control? Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 32 / 54

  60. Perimeter Defences The Man-Machine Scale Vulnerabilities in lower layers City walls can be flown over or dug under. The OS can control vulnerabilities in the software layers Hardware is a lower and therefore unprotected layer we can dig under the defence, through hardware Can you think of examples of how to dig under the OS access control? Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 32 / 54

  61. Perimeter Defences The Man-Machine Scale Vulnerabilities in lower layers City walls can be flown over or dug under. The OS can control vulnerabilities in the software layers Hardware is a lower and therefore unprotected layer we can dig under the defence, through hardware Can you think of examples of how to dig under the OS access control? Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 32 / 54

  62. Perimeter Defences The Man-Machine Scale Hardware attacks Boot the box from a removable medium (USB stick) mount the harddrive and edit the password as superuser The box should only boot from the authorised harddrive. Remove the harddrive and mount it on a different box replace the password file as superuser Physical locks on the cabinet In both cases we run an unauthorised OS with access to assets of the authorised OS Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 33 / 54

  63. Perimeter Defences The Man-Machine Scale Hardware attacks Boot the box from a removable medium (USB stick) mount the harddrive and edit the password as superuser The box should only boot from the authorised harddrive. Remove the harddrive and mount it on a different box replace the password file as superuser Physical locks on the cabinet In both cases we run an unauthorised OS with access to assets of the authorised OS Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 33 / 54

  64. Perimeter Defences The Man-Machine Scale Hardware attacks Boot the box from a removable medium (USB stick) mount the harddrive and edit the password as superuser The box should only boot from the authorised harddrive. Remove the harddrive and mount it on a different box replace the password file as superuser Physical locks on the cabinet In both cases we run an unauthorised OS with access to assets of the authorised OS Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 33 / 54

  65. Perimeter Defences The Man-Machine Scale Hardware attacks Boot the box from a removable medium (USB stick) mount the harddrive and edit the password as superuser The box should only boot from the authorised harddrive. Remove the harddrive and mount it on a different box replace the password file as superuser Physical locks on the cabinet In both cases we run an unauthorised OS with access to assets of the authorised OS Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 33 / 54

  66. Perimeter Defences The Man-Machine Scale Hardware attacks Boot the box from a removable medium (USB stick) mount the harddrive and edit the password as superuser The box should only boot from the authorised harddrive. Remove the harddrive and mount it on a different box replace the password file as superuser Physical locks on the cabinet In both cases we run an unauthorised OS with access to assets of the authorised OS Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 33 / 54

  67. Perimeter Defences The User End Outline The session 1 Security Design 2 Perimeter Defences 3 City Walls The Man-Machine Scale The User End Product and System The fundamental dilemma 4 Summary 5 Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 34 / 54

  68. Perimeter Defences The User End The Man-Machine Perimeters The onion model might have been drawn like this. ✬ ✩ ✬ ✩ hardware ✬ ✩ OS kernel ✤ ✜ operating system ✗ ✔ services ✞ ☎ applications ✝ ✆ user ✖ ✕ ✣ ✢ ✫ ✪ ✫ ✪ ✫ ✪ Now, the user is the lower layer Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 35 / 54

  69. Perimeter Defences The User End Digging through the human layer How can you exploit the user to circumvent security? Bribery ; Blackmail ; Extortions Evesdropping ; Surveillance Phishing Not to speak of carelessness ... Passwords stuck under the keyboard Easy-to-guess passwords Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 36 / 54

  70. Perimeter Defences The User End Digging through the human layer How can you exploit the user to circumvent security? Bribery ; Blackmail ; Extortions Evesdropping ; Surveillance Phishing Not to speak of carelessness ... Passwords stuck under the keyboard Easy-to-guess passwords Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 36 / 54

  71. Perimeter Defences The User End Digging through the human layer How can you exploit the user to circumvent security? Bribery ; Blackmail ; Extortions Evesdropping ; Surveillance Phishing Not to speak of carelessness ... Passwords stuck under the keyboard Easy-to-guess passwords Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 36 / 54

  72. Perimeter Defences The User End Digging through the human layer How can you exploit the user to circumvent security? Bribery ; Blackmail ; Extortions Evesdropping ; Surveillance Phishing Not to speak of carelessness ... Passwords stuck under the keyboard Easy-to-guess passwords Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 36 / 54

  73. Perimeter Defences The User End Digging through the human layer How can you exploit the user to circumvent security? Bribery ; Blackmail ; Extortions Evesdropping ; Surveillance Phishing Not to speak of carelessness ... Passwords stuck under the keyboard Easy-to-guess passwords Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 36 / 54

  74. Perimeter Defences The User End Controls in the human layer How can you protect against the attacks in the human layer? Dr Hans Georg Schaathun Security Objectives and Design Autumn 2010 – Week 2 37 / 54

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Conflicting objectives in design Common design objectives: Minimizing mass ( sprint bike;

Conflicting objectives in design Common design objectives: Minimizing mass ( sprint bike;

Conflicting objectives in design Common design objectives: Minimizing mass ( sprint bike; satellite components ) Minimizing volume ( mobile phone; minidisk player ) Objectives Minimizing environmental impact ( packaging, cars ) Maximizing

450 views • 24 slides
What Security can learn from Design Douglas Wilson Nguyet Vuong Security Person, Design

What Security can learn from Design Douglas Wilson Nguyet Vuong Security Person, Design

What Security can learn from Design Douglas Wilson Nguyet Vuong Security Person, Design Person, Formerly at Uptycs, Mandiant VP of Design at Civil Media Company @dallendoug @nguyetv INTRO / Who We Are We are Nguyet & Doug Collectively,

634 views • 39 slides
Chapter 7: Unix Security Chapter 7: 1 Objectives Understand the security features provided

Chapter 7: Unix Security Chapter 7: 1 Objectives Understand the security features provided

Chapter 7: Unix Security Chapter 7: 1 Objectives Understand the security features provided by a typical operating system. Introduce the basic Unix security model. See how general security principles are implemented in an actual

733 views • 59 slides
M eeting Critical Security Objectives with Security-Enhanced Linux Peter A. Loscocco

M eeting Critical Security Objectives with Security-Enhanced Linux Peter A. Loscocco

M eeting Critical Security Objectives with Security-Enhanced Linux Peter A. Loscocco Information Assurance Research G roup National Security Agency Co-author: Stephen D. Smalley, NAI Labs 1 roup Inform ation A ssurance R esearch G

476 views • 43 slides
Broadway Street Design Preliminary Design Phase Design Objectives & Issues: Roadway

Broadway Street Design Preliminary Design Phase Design Objectives & Issues: Roadway

Broadway Street Design Preliminary Design Phase Design Objectives & Issues: Roadway Water Distribution Sanitary Sewer Stormwater Looking for your input on priorities Design Phasing Current - Preliminary Design

377 views • 16 slides
The Vital Need for Privacy and Security by Design Ann Cavoukian, Ph.D. Executive Director

The Vital Need for Privacy and Security by Design Ann Cavoukian, Ph.D. Executive Director

The Vital Need for Privacy and Security by Design Ann Cavoukian, Ph.D. Executive Director Global Privacy & Security by Design Centre Technion Summer School on Cyber Security Haifa, Israel September 9, 2020 Lets Dispel The Myths

929 views • 55 slides
CCM4350 Security Architecture and Engineering Lecture 2 Security Design Principles 15.10.2012

CCM4350 Security Architecture and Engineering Lecture 2 Security Design Principles 15.10.2012

CCM4350 Security Architecture and Engineering Lecture 2 Security Design Principles 15.10.2012 1 Content of Todays Lecture Summary and Wrap up on Security Terminology The Fundamental Dilemma of Security Five Design Principles

801 views • 25 slides
Design Jam Objectives: 1. Introduce Design Thinking Overview 2. Introduce Design Thinking

Design Jam Objectives: 1. Introduce Design Thinking Overview 2. Introduce Design Thinking

Design Jam Objectives: 1. Introduce Design Thinking Overview 2. Introduce Design Thinking Methods 3. Experience a Design Jam How Might We identify aspects of a good How Might We question? Not too broad nor too narrow. If too

735 views • 27 slides
Visual Design Visual Design Objectives Gestalt Principles Creating Organization and Structure

Visual Design Visual Design Objectives Gestalt Principles Creating Organization and Structure

Visual Design Visual Design Objectives Gestalt Principles Creating Organization and Structure Typography UI Visual Design Objectives What are the goals of an effective interface? Information communication 1. - enforce desired relationships

455 views • 34 slides
Visual Design Visual Design Objectives Gestalt Principles Creating Organization and Structure

Visual Design Visual Design Objectives Gestalt Principles Creating Organization and Structure

Visual Design Visual Design Objectives Gestalt Principles Creating Organization and Structure Typography UI Visual Design Objectives What are the goals of an effective interface? Information communication 1. - enforce desired relationships

1.16k views • 36 slides
Objectives Goals of Cryptography Security Services Security Mechanisms Relationship

Objectives Goals of Cryptography Security Services Security Mechanisms Relationship

Overview on Modern Cryptography Debdeep Mukhopadhyay Assistant Professor Department of Computer Science and Engineering Indian Institute of Technology Kharagpur INDIA -721302 Objectives Goals of Cryptography Security Services

658 views • 16 slides
Questionnaire Design Research Methods. Questionnaire Design 1 1 Objectives To understand:

Questionnaire Design Research Methods. Questionnaire Design 1 1 Objectives To understand:

Questionnaire Design Research Methods. Questionnaire Design 1 1 Objectives To understand: Objectives of questionnaires Advantages and disadvantages Design of questionnaires Type of questions used Common problems and

1.03k views • 99 slides
What Security can learn from Design (An Intro to Design Thinking) Douglas Wilson Nguyet Vuong

What Security can learn from Design (An Intro to Design Thinking) Douglas Wilson Nguyet Vuong

What Security can learn from Design (An Intro to Design Thinking) Douglas Wilson Nguyet Vuong Security Person, Design Person, Formerly at Uptycs, Mandiant VP of Design at Civil Media Company @dallendoug @nguyetv We are Nguyet & Doug

1.42k views • 45 slides
PeopleSoft Security Reports November 2011 1 1 Learning Objectives Discuss the main

PeopleSoft Security Reports November 2011 1 1 Learning Objectives Discuss the main

PeopleSoft Security Reports November 2011 1 1 Learning Objectives Discuss the main objectives of the security review Explain the purpose of the PeopleSoft Security reports Demonstrate ways to manage the information in the reports

491 views • 35 slides
Design-Build Presentation Objectives- Why Design-Build? What is the rush? What is the

Design-Build Presentation Objectives- Why Design-Build? What is the rush? What is the

22420 US 550-US160 Connection South Design-Build Presentation Objectives- Why Design-Build? What is the rush? What is the Difference How does that affect How I contribute My insurance Methods of Project Delivery CDOTs

321 views • 20 slides
Design for Security Serena Chen | @Sereeena | OReilly Velocity 2018 Usability Security

Design for Security Serena Chen | @Sereeena | OReilly Velocity 2018 Usability Security

Design for Security Serena Chen | @Sereeena | OReilly Velocity 2018 Usability Security Good user experience design and good security cannot exist without each other Everyone deserves to be secure without being experts We need to

1.34k views • 112 slides
Public Consultation Event For the Development of a Municipal Solid Waste Management Strategic

Public Consultation Event For the Development of a Municipal Solid Waste Management Strategic

Public Consultation Event For the Development of a Municipal Solid Waste Management Strategic Plan Public Consultation Event #2 Tyler H. Peters , P.Eng. October 24, 2009 Project Manager Greenview Environmental Management Limited Killaloe

523 views • 34 slides
ENVIRONMENTAL COMMISSION WORK SESSION August 23, 2018 PROJECT BACKGROUND Future information to

ENVIRONMENTAL COMMISSION WORK SESSION August 23, 2018 PROJECT BACKGROUND Future information to

ENVIRONMENTAL COMMISSION WORK SESSION August 23, 2018 PROJECT BACKGROUND Future information to be delivered to Environmental Commission: Cost of service analysis Peer community benchmarking - Costs - Programs & performance

662 views • 11 slides
Lets Talk Some Trash Let s Talk Some Trash A April 19, 2012 il 19 2012 Danielle Forget Shield,

Lets Talk Some Trash Let s Talk Some Trash A April 19, 2012 il 19 2012 Danielle Forget Shield,

Lets Talk Some Trash Let s Talk Some Trash A April 19, 2012 il 19 2012 Danielle Forget Shield, P.E. 9 Seconds Waste is Fascinating Waste is Fascinating U d Undercover Dirty Jobs Dirty Jobs B Boss Toy Story 3 The Pitch The Sopranos p

401 views • 15 slides
Waste Collection Methodology Review. Political Cabinet 27 th February 2018 Jim Perkins

Waste Collection Methodology Review. Political Cabinet 27 th February 2018 Jim Perkins

Appendix A1 Waste Collection Methodology Review. Political Cabinet 27 th February 2018 Jim Perkins Strategic Waste Lead Waste e Managem ement ent Servic vices es Slide 1 Reason for Review. Current collection vehicle fleet needs

127 views • 12 slides
Housing, Taxes, and Racial Wealth Inequality Login at: https://results.zoom.us/j/873308801 or dial

Housing, Taxes, and Racial Wealth Inequality Login at: https://results.zoom.us/j/873308801 or dial

April 2019 RESULTS U.S. Poverty National Webinar Housing, Taxes, and Racial Wealth Inequality Login at: https://results.zoom.us/j/873308801 or dial (929) 436-2866 or (669) 900- 6833, Meeting ID: 873 308 801. RESULTS is a movement of passionate,

465 views • 45 slides
I Inequality: Is privilege the lit I i il th problem? problem? Max Rashbrooke and Lisa

I Inequality: Is privilege the lit I i il th problem? problem? Max Rashbrooke and Lisa

I Inequality: Is privilege the lit I i il th problem? problem? Max Rashbrooke and Lisa Marriott Institute for Governance and Policy Studies School of Accounting and Commercial Law Victoria University of Wellington Overview Overview

533 views • 21 slides
Grounded Action Transformation for Robot Learning in Simulation Josiah Hanna and Peter Stone

Grounded Action Transformation for Robot Learning in Simulation Josiah Hanna and Peter Stone

Grounded Action Transformation for Robot Learning in Simulation Josiah Hanna and Peter Stone Josiah Hanna and Peter Stone Grounded Action Transformation for Robot Learning in Simulation 1 Reinforcement Learning for Physical Robots Learning on

308 views • 26 slides
Boiler Monitoring For Superior Performance NE Biomass Hea:ng

Boiler Monitoring For Superior Performance NE Biomass Hea:ng

Boiler Monitoring For Superior Performance NE Biomass Hea:ng EXPO April 10, 2014 Performance Monitoring Graphical tracking of boiler performance

229 views • 6 slides

More recommend