Secure Shell (SSH) - gozips.uakron.edu
Download
Report
Transcript Secure Shell (SSH) - gozips.uakron.edu
2440: 141
Web Site Administration
Introduction to Security
Instructor: Enoch E. Damson
Information Security
Consists of the procedures and measures taken to
protect each component of information systems
Protecting data, hardware, software, networks, procedures
and people
The concept of information security is based on the
C.I.A triangle (according to the National Security
Telecommunications and Information Security
Committee – NSTISSC)
C – Confidentiality
I – Integrity
A – Availability
Introduction to Security
2
Confidentiality
Addresses two aspects of security with subtle differences
Prevents unauthorized individuals from knowing or
accessing information
Safeguards confidential information and disclosing secret
information only to authorized individuals by means of
classifying information
Introduction to Security
3
Integrity
Ensures data consistency and accuracy
The integrity of the information system is measured by the
integrity of its data
Data can be degraded into the following categories:
Invalid data – not all data is valid
Redundant data – the same data is recorded and stored in several
places
Inconsistent data – redundant data is not identical
Data anomalies – one occurrence of repeated data is changed and the
other occurrences are not
Data read inconsistency – a user does not always read the last
committed data
Data non-concurrency – multiple users can access and read data at the
same time but loose read consistency
Introduction to Security
4
Availability
Ensures that data is accessible to authorized
individuals to access information
An organization’s information system can be
unavailable because of the following security issues
External attacks and lack of system protection
Occurrence of system failure with no disaster recovery
strategy
Overly stringent and obscure security procedures and
policies
Faulty implementation of authentication processes, causing
failure to authenticate customers properly
Introduction to Security
5
Information Security Architecture
The model for protecting logical and physical assets
The overall design of a company’s implementation of the
C.I.A triangle
Components range from physical equipment to logical
security tools and utilities
Introduction to Security
6
Components of Information Security
Architecture
The components of information security architecture are:
Policies and procedures – documented procedures and
company policies that elaborate on how security is to be
carried out
Security personnel and administrators – people who
enforce and keep security in order
Detection equipment – devices to authenticate users and
detect and equipment prohibited by the company
Introduction to Security
7
Components of Information Security
Architecture…
Other components of information security
architecture include:
Security programs – tools to protect computer system’s
servers from malicious code such as viruses
Monitoring equipment – devices to monitor physical
properties, users, and important assets
Monitoring applications – utilities and applications used to
monitor network traffic and Internet activities, downloads,
uploads, and other network activities
Auditing procedures and tools – checks and controls to
ensure that security measures are working
Introduction to Security
8
Levels of Security
The levels of security include:
Highly restrictive
Moderately restrictive
Open
Introduction to Security
9
Levels of Security…
Before deciding on a level of security, answer these
questions:
What must be protected?
From whom should data be protected?
What costs are associated with security being breached and
data being lost or stolen?
How likely is it that a threat will actually occur?
Are the costs to implement security and train users to use a
secure network outweighed by the need to provide an
efficient, user-friendly environment?
Introduction to Security
10
Highly Restrictive Security Policies
Include features such as:
Data encryption
Complex password requirements
Detailed auditing and monitoring of computer/network access
Intricate authentication methods
Policies that govern use of the Internet/e-mail
Might require third-party hardware and software
Implementation cost is high
Cost of a security breach is high
Introduction to Security
11
Moderately Restrictive Security
Policies
Most organizations can opt for this type of policy
Requires passwords, but not overly complex ones
Auditing detects unauthorized logon attempts, network resource misuse,
and attacker activity
Most network operating systems contain authentication, monitoring, and
auditing features to implement the required policies
Infrastructure can be secured with moderately priced off-the-shelf
hardware and software (firewalls, etc)
Costs are primarily in initial configuration and support
Introduction to Security
12
Open Security Policies
Policy might have simple or no passwords, unrestricted access
to resources, and probably no monitoring and auditing
May be implemented by a small company with the primary
goal of making access to basic data resources
Internet access should probably not be possible via the
company LAN
Sensitive data, if it exists, might be kept on individual
workstations that are backed up regularly and are physically
inaccessible to other employees
Introduction to Security
13
Securing the Web Environment
Both Linux and Windows need to configured carefully to
minimize security risks
Keep software patches up to date
Web servers with static pages are relatively easy to protect
than those with dynamic pages
To secure transmission, data may be encrypted with Secure
Socket Layer (SSL) and Secure Shell (SSH)
To isolate a Web server environment:
Firewalls may be used to block unwanted access to ports
Proxy servers may be used to isolate computers
To discover whether and how attackers have penetrated a
system, intrusion detection software may be used
Introduction to Security
14
Identifying Threats and
Vulnerabilities
Hackers sometimes want the challenge of penetrating
a system and vandalizing it – other times they are
after data
Data can be credit card numbers, user names and
passwords, other personal data
Information can be gathered by hackers while it is
being transmitted
Operating system flaws can often assist hackers
Introduction to Security
15
Types of Attacks & Vulnerabilities
Some of the numerous methods to attack systems are as
follows:
Virus – code that compromises the integrity and state of a system
Worm – code that disrupts the operation of a system
Trojan horse – malicious code that penetrates a computer system or
network by pretending to be legitimate code
Denial of service – the act of flooding a Web site or network system
with many requests with the intent of overloading the system and
forcing it to deny service to legitimate requests
Spoofing – malicious code that looks like legitimate code
Bugs – software code that is faulty due to bad design, logic, or both
Introduction to Security
16
Types of Attacks & Vulnerabilities…
Other methods to attack systems include:
Email spamming – E-mail that is sent to many recipients
without their permission
Boot sector virus – code that compromises the segment in
the hard disk containing the program used to start the
computer
Back door – an intentional design element of some
software that allows developers of a system to gain access
to the application for maintenance or technical problems
Rootkits and bots – malicious or legitimate software code
that performs functions like automatically retrieving and
collecting information from computer systems
Introduction to Security
17
Examining TCP/IP
TCP/IP was not designed to be secure but to allow systems to
communicate
Hackers often take advantage of the ignorance about TCP/IP to
access computers connected to the Internet
The following are parts of the IP header most relevant to
security
Source address – start-point IP address
Destination address – end-point IP address
Packet identification, flags, fragment offset
Total length – length of packet in bytes
Protocol – TCP, UDP, ICMP
Introduction to Security
18
Vulnerabilities of DNS
Historically, DNS has had security problems
BIND is the most common implementation of DNS and
some older versions had serious bugs
Current versions of BIND have been more secure
Introduction to Security
19
Vulnerabilities in Operating
Systems
Operating systems are large and complex
Hence, more opportunities for attack
Inattentive administrators often fail to implement
patches when available
Some attacks, such as buffer overruns, can allow the
attacker to take over the computer
Introduction to Security
20
Vulnerabilities in Web servers
Static HTML pages pose virtually no problem
Programming environments and databases add
complexity that a hacker can exploit
Introduction to Security
21
Vulnerabilities of E-mail Servers
By design, e-mail servers are open
E-mail servers can be harmed by a series of very large
e-mail messages
Sending an overwhelming number of messages at the
same time can prevent valid users from accessing the
server
Viruses can be sent to e-mail users
Retrieving e-mail over the Internet often involves
sending your user name and password as clear text
Introduction to Security
22
Security Basics
Some of the basic security rules are as follows:
Security and functionality are inversely related – the more
security you implement, the less functionality you will have,
and vice versa
No matter how much security you implement and no
matter how secure your site is, if hackers want to break in,
they will
The weakest link in security is human beings
Introduction to Security
23
Security Methods
People
Physical limits on access to hardware and documents
Through the processes of identification and authentication,
make certain that the individual is who he/she claims to be
through the use of devices, such as ID card, eye scans,
passwords
Training courses on the importance of security and how to
guard assets
Establishments of security policies and procedures
Introduction to Security
24
Security Methods…
Applications
Authentication of users who access applications
Business rules
Single sign-on (a method for signing on once for different
applications and Web sites)
Introduction to Security
25
Security Methods…
Network
Firewalls – to block network intruders
Virtual private network (VPN) – a remote computer
securely connected to a corporate network
Authentication
Introduction to Security
26
Security Methods…
Operating System
Authentication
Intrusion detection
Password policy
Users accounts
Introduction to Security
27
Security Methods…
Database Management Systems
Authentication
Audit mechanism
Database resource limits
Password policy
Introduction to Security
28
Security Methods…
Data Files
File permissions
Access monitoring
Introduction to Security
29
Securing Access to Data
Securing data on a network has many facets:
Authentication and authorization – identifying who is
permitted to access which network resources
Encryption/decryption – making data unusable to anyone
except authorized users
Virtual Private Networks (VPNs) – allowing authorized
remote access to a private network via the public Internet
Firewalls – installing software/hardware device to protect a
computer or network from unauthorized access and attacks
Introduction to Security
30
Securing Access to Data…
Other facets of securing data on a network include:
Virus and worm protection – securing data from software
designed to destroy data or make computer or network
operate inefficiently
Spyware protection – securing computers from
inadvertently downloading and running programs that
gather personal information and report on browsing and
habits
Wireless security – implementing unique measures for
protecting data and authorizing access to the wireless
network
Introduction to Security
31
Securing Data Transmission
To secure data on a network, you need to encrypt the
data
Secure Socket Layer (SSL) is commonly used to encrypt
data between a browser and Web server
Secure Shell (SSH) is a secured replacement for Telnet
Introduction to Security
32
Securing the Operating System
Use the server for only necessary tasks
Minimize user accounts
Disable services that are not needed
Make sure that you have a secure password
Introduction to Security
33
Securing Windows
Some services that are not needed in Windows for most
Internet-based server applications may be turned off
Examples include:
Alerter
Computer browser
DHCP client
DNS client
Messenger
Server
Workstation
Also, the registry can be used to alter the configuration to
make it more secure such as disabling short file names
Introduction to Security
34
Securing Linux
Only run needed daemons
Generally, daemons are disabled by default
The command netstat -l gives you a list of daemons
that are running
Use chkconfig to enable and disable daemons
chkconfig imap on would enable imap
Introduction to Security
35
Securing E-mail
Tunneling POP3 can prevent data from being seen
Microsoft Exchange can also use SSL for protocols it uses
Set a size limit for each mailbox to prevent someone from
sending large e-mail messages until the disk is full
Introduction to Security
36
Securing the Web Server
Enable the minimum features
If you do not need a programming language, do not enable
it
Make sure programmers understand security issues
Implement SSL where appropriate
Introduction to Security
37
Authenticating Web Users
Both Apache and IIS use HTTP to enable authentication
If HTTP tries to access a protected directory and fails then:
it requests authentication from the user in a dialog box
Accesses directory with user information
Used in conjunction with SSL
Introduction to Security
38
Using a Firewall
A firewall implements a security policy between networks
Limit access, especially from the Internet to your internal
computers
Restrict access to Web servers, e-mail servers, and other
related servers
Introduction to Security
39
Types of Filtering
Packet filtering
Looks at each individual packet
Based on rules, it determines whether to let it pass through the firewall
Circuit-level filtering (stateful or dynamic filtering)
Controls complete communication session, not just individual packets
Allows traffic initialized from within the organization to return, yet
restricts traffic initialized from outside
Application-level
Instead of transferring packets, it sets up a separate connection to
totally isolate applications such as Web and e-mail
Introduction to Security
40
Using a Proxy Server
A proxy server delivers content on behalf of a user or server
application
Proxy servers need to understand the protocol of the
application that they proxy such as HTTP or FTP
Forward proxy servers isolate users from the Internet
Users contact proxy server which gets Web page
Reverse proxy servers isolate Web server environment from
the Internet
When a Web page is requested from the Internet, the proxy server
retrieves the page from the internal server
Introduction to Security
41
Using Intrusion Detection Software
Intrusion detection is designed to show you that your
defenses have been penetrated
With Microsoft Internet Security and Acceleration (ISA)
Server, it only detects specific types of intrusion
In Linux, Tripwire tracks changes to files
Introduction to Security
42
Tripwire
Tripwire allows you to set policies that allow you to
monitor any changes to the files on the system
Tripwire can detect file additions, file deletions, and
changes to existing files
By understanding the changes to the files, you can
determine which ones are unauthorized and then try
to find out the cause of the change
Introduction to Security
43
Implementing Secure Authentication
and Authorization
Administrators must control who has access to the
network (authentication) and what logged on users
can do to the network (authorization)
Network operating systems have tools to specify options
and restrictions on how/when users can log on to network
File system access controls and user permission settings
determine what a user can access on a network and what
actions a user can perform
Introduction to Security
44
Cryptography
The science of encrypting and decrypting information to
ensure that data and information cannot be easily understood
or modified by unauthorized individuals
Allows encryption of data from its original form into a form that can
only be read with a correct decryption key
Some of security functions addressed by cryptography
methods are:
Authentication
Privacy
Message integrity
Provisions of data signatures
Introduction to Security
45
Vocabulary of Cryptography
Cryptanalysis – the process of evaluating cryptographic algorithms to
discover their flaws
Cryptanalyst – a person who uses cryptanalysis to find flaws in
cryptographic algorithms
Cryptographer – a person trained in the science of cryptograpy
Alphabet – set of symbols used in cryptographic to either input or output
messages
Plaintext (cleartext or raw data) – the original data in its raw form
Cipher (algorithm) – a cryptographic encryption algorithm for transforming
data from one form to another
Cyphertext - the encrypted data
Introduction to Security
46
Encryption
The act of encoding readable data into a format
that is unreadable without a decoding key
Decryption – the act of decoding encoded data back into
the original readable format
Encryption provides privacy (confidentiality)
Introduction to Security
47
Encryption Methodology
There are two elements in encryption:
Encryption method (ciper or algorithm) – specifies the
mathematical process used in encryption
Key – the special string of bits used in encryption
Introduction to Security
48
Types of Cryptographic Ciphers
Ciphers fall into one of two major categories:
Symmetric (single-key) ciphers – the same key is used to
both encryption and decryption
Asymmetric (public-key) ciphers – different keys are used
for encryption and decryption
Introduction to Security
49
Symmetric (Single Key) Ciphers
The most common and simplest form of encryption
Both parties in the encryption process use the same key and must
keep the key secret
Symmetric ciphers are divided into:
Steam ciphers – encrypt the bits of message one at a time
Block ciphers – encrypt a number of bits as a single unit
Some symmetric ciphers include:
Data Encryption Standard (DES), Triple-DES, DESX, RDES, Blowfish,
Twofish, AES (Advanced Encryption Standard), and IDEA (International
Data Encryption Algorithm), Serpent
Introduction to Security
50
Asymmetric (Public Key) Ciphers
There are two keys for each party
The sender and receiver each has a private and public key
Public key – senders will encrypt data using non-secure connections with the receivers’
public key
Private key – the receivers use their private keys to decrypt data
The only person who can decrypt the ciphertext is the owner of the private key that
corresponds to the public key used for the encryption
Well regarded asymmetric techniques include: RSA (Rivest, Shamir, and Adleman),
DSS (Digital Signature Standard), and EIGamal
Internet protocols using asymmetric ciphers include: Secure Socket Layer (SSL),
Transport Layer Security (TLS), Secure Shell (SSH), Pretty Good Privacy (PGP), and
GNU Privacy Guard (GPG)
Introduction to Security
51
Encryption Example
Alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ
Plaintext: Meet me on the corner
Cipher (algorithm): C = P + K
C – the ciphertext character
P – the plaintext character
K – the value of the key
Key: 3
The algorithm simply states that to encrypt a plaintext character (P) and generate a
ciphertext (C), add the value of the key (K) to the plaintext character
Shift the plaintext character to the right of the alphabet by three characters
D replaces A, E replaces B, F replaces C, etc
The following message is generated:
Ciphertext: Phhw ph rq wkh fruqhu
Introduction to Security
52
Authentication
One purpose of encryption is to prevent anyone who
intercepts a message from being able to read the
message
It brings authorization (confidentiality) – only authorized
users can use data
In contrast, authentication proves the sender’s identity
Introduction to Security
53
Forms of Authentication
There are many forms of authentication:
Passwords
Authentication cards – ATMs use these with coded
information
Biometrics – measures body dimensions like finger-print
analyzers
Public key authorization – uses digital signatures
Digital signature – the electronic version of a physical signature
Introduction to Security
54
Security Experts
Two of the most prominent computer security
organizations are the CERT Coordination Center
(CERT/CC) and the Systems Administration,
Networking, and Security (SANS) Institute
CERT/CC – a federally funded software engineering institute
operated by Carnegie Mellon University
SANS – a prestigious and well-regarded education and
research organization with members including some of the
leading computer security experts in the country
Introduction to Security
55
Security Resources
Computer Security Resources
http://www.sans.org (SANS Institute)
http://www.cert.org (CERT/CC)
http://www.first.org (FIRST – Forum of Incident Response
and Security Teams)
http://csrc.nist.gov (NIST – National Institute of Standards
and Technology, Computer Security Resource Center)
http://www.securityfocus.com (Security Focus Forum)
Introduction to Security
56