Proactive approaches to solve security threats

1
Proactive approaches to solve security threats

• Mira Pandya
• Chetan Nanjunda

2
Contents

• Introduction
• Classification of viruses
• Attack and spread of viruses
• Four proactive security approaches
• Issues and future directions

3
Types of viruses

• Malicious logic
• rabbits and bacteria
• logic bombs
• Trojan horses
• Computer virus
• boot sector infectors
• executable infectors
• multipartite viruses
• TSR viruses
• stealth viruses
• encrypted viruses
• polymorphic viruses
• macro viruses
• Computer worms

4
Types of viruses (contd..)

• malicious logic is a set of instructions that
  cause a sites security policy to be violated.
• logic bomb is a program that performs an action
  violating the security policy when some external
  event occurs.
• Trojan horses is a program with an
  overt(documented or known) effect and a
  covert(undocumented or unexpected) effect.
• Computer virus is a program that inserts itself
  into one or more files and then performs some
  actions.
• polymorphic virus change their form each time
  they insert themselves into another program
• computer worm is a program that copies itself
  form one computer to another.

5
Attack and spread of viruses

• Viruses exploit security holes in
• Architecture
• Implementation
• Code
• Users mistakes

Virus
Virus
Represents a security hole
Proactive approach takes a holistic view to
eliminate security holes
6
Proactive approach I Architectural Security

• Facts
• Windows vs. Linux Viega Voas
• DOS primarily a single user system
• Process space protection
• Self protecting kernel
• Wired Equivalent Privacy
• Repetition of keystream
• Placement of CRC
• Inference
• architecture is the foundation
• there are no patches
• architectural design should last for a long time

7
Proactive approach II Implementation Security

• Facts
• Lack of bounds checking Linux Journal
• buffer overflow -overwrite a function's return
  address
• Internet Explorer
• never rewritten, only patched
• patches make code complex, which implies more
  bugs
• Inferences
• Write secure code - Defensive programming
• Separate code from data
• Stop patching start rewriting
• Formal development path
• abstract model, formal specification,
  implementation

8
Proactive approach III Kerkhoffs Principle by
Auguste Kerckhoffs

• Facts
• Netscape browser attack David Wagner
• executable reverse compiled to get the source
• weak random number generation exploited (pid,
  time)
• Skipjack algorithm NSABiham at el
• kept secret
• released in tamper resistant boxes
• huge security hole discovered after reverse
  engineering
• Inferences
• Obscurity implies brittleness, openness implies
  ductility Bruce Schneier
• Open source software Eric Raymond

a cryptosystem should be secure even if
everything about the system, except the key, is
public knowledge
9
Proactive approach IV Educate Users

• Facts
• default configurations
• open ports
• guessable passwords L0phtCrack
• rogue access points Matthew Gast
• Inferences
• monitor applications
• do not open ports unnecessarily
• clear users responsibility
• universal knowledge of computer security

10
Issues

• are we too late ?
• knowledge of threats ?
• cost ?

Future directions

• rapid growth of computers and electronic systems
• convergence of different types of systems
• present holds the key to future

11
Questions ?

• cnanjund_at_stevens.edu

12
Thank you!
13
Reference
Linux Journal http//www.linuxjournal.com/articl
e/6701 Viega Voas The Pros and Cons of Unix
and Windows Security Policies, IT Pro, SepOct
2000 David Wagner http//www.cs.berkeley.edu/da
w/papers/ddj-netscape.html NSA National
Security Agency http//www.nsa.gov/ Biham at el
"Cryptanalysis of Skipjack Reduced to 31 Rounds
using Impossible Differentials" Bruce Schneier
http//www.schneier.com/ Eric Raymond
http//www.catb.org/esr/ L0phtCrack
http//www.atstake.com/products/lc/ Matthew
Gast Seven Security Problems of 802.11 Wireless,
OReilly Network, 2002
14
(No Transcript)
15
(No Transcript)
16
(No Transcript)
17
(No Transcript)