# Presentation: 426585

## Privacy and Security:Practical Considerations

- Science Applications International Corporation
- Common Criteria Testing Laboratory
- Robert Williamson,
- AVP, SAIC CCTL
- June 9, 2005

## Concern for Practical IT Security

-   Things that need to be protected
-    Root causes of IT threats
-    External threats
-    Internal threats
-    Exploits

## Specific IT Security Context

- Organizations with research grants
- Things that need to be protected
-   Data
-   Analysis
-   Reporting
-   Critical program resources (e.g. funding, personnel)

## Data

- Resident source data for research input
- Portable media
- Servers (university, government, medical facilities)
- Local data to facilitate analysis
- Copies of resident data
- Extracts from resident data
- Locally created

## Local Data Copy for Analysis

- Local storage – perhaps on a server
- Remote access – type and purpose
- Authenticated for use
- Access to data
- Input
- Change data, alter format
- Report

## Tools for Analysis

- Programs
- Program assurance
- Program integrity
- Program Source
- Locally written
- Development paradigm
- Documentation
- Testing
- Share ware
- Purchase (SPSS)

## Reporting

- Report generation
- Extracts, drafts
- Report distribution
- Extracts for focused review
- Drafts for technical review
- Drafts for peer review
- Final for sponsor review
- Final for public distribution
- Press Releases

## Critical Program Resources

- Grant Management
- Purpose – maintain focus
- Progress – milestone reviews
- Directives – from sponsor
- Contacts – knowledgeable sources
- Funding
- Accounts
- Charges

## In this order of importance
Policies
Behavior
Technology

- Policies
- Behavior
- Technology

- Root Causes of Security Problems

**Notes:**
Theme:  Many think that IT security means countering technical vulnerabilities.  Poor policies and inappropriate behavior are larger challenges. 

## Policy
Reactionary security architectures and firewalls
Not supported by administrators, users, or vendors
Not reflected in contracts, procurements, or practices
Not integrated with technology evolution

- Reactionary security architectures and firewalls
- Not supported by administrators, users, or vendors
- Not reflected in contracts, procurements, or practices
- Not integrated with technology evolution

- Root Causes of Security Problems

**Notes:**
Theme:  Many think that IT security means countering technical vulnerabilities.  Poor policies and inappropriate behavior are larger challenges. 

## Behavior
Lack of awareness, training, and certification on security
“Code of Conduct” is not enforced or well defined 
Lessons learned are not shared or internalized
Passwords are easy to guess or easy to compromise
Inadequate personnel screening and exit procedures

- Lack of awareness, training, and certification on security
- “Code of Conduct” is not enforced or well defined
- Lessons learned are not shared or internalized
- Passwords are easy to guess or easy to compromise
- Inadequate personnel screening and exit procedures

- Root Causes of Security Problems

**Notes:**
Theme:  Many think that IT security means countering technical vulnerabilities.  Poor policies and inappropriate behavior are larger challenges. 

## Technology
Insufficient access control for increasingly powerful diagnostic tools
Holes in firewalls and perimeter buffer zones (DMZ)
Inadequate software change controls
Immature software
Inability to determine attacks launched
Inability to determine successful attacks

- Insufficient access control for increasingly powerful diagnostic tools
- Holes in firewalls and perimeter buffer zones (DMZ)
- Inadequate software change controls
- Immature software
- Inability to determine attacks launched
- Inability to determine successful attacks

- Root Causes of Security Problems

**Notes:**
Theme:  Many think that IT security means countering technical vulnerabilities.  Poor policies and inappropriate behavior are larger challenges. 

## Technology Threat Sources

**Technology Threat**** ****Sources**

**Unintentional**

**Intentional**

**Outsider**

-   Software bugs
-   System overloads
-   Hardware failures
-   Poorly trained administrators
-       and custodians
-   Errors and accidents

-   Dishonest or disgruntled employee, partner,
-       outsource employee, contract employee

-   Hacker/Phreaker
-   Competitor
-   Fraudster
-   Terrorist

**Insider**

**Notes:**
Theme:  Hackers aren’t our only threat.
“Most of the incidents (83%) were executed physically from within the insider’s organization and took place during normal business hours.”

## Insider Threat

- 	“Most of the incidents (83%) were executed physically from within the insider’s organization and took place during normal business hours.”
- Intelligence Alert from the World Wide ISAC – August 26, 2004

**Notes:**
Theme:  You never know who you can trust until it’s too late.

## Insider Threats

- Read Insider Threat Study: Computer System Sabotage in Critical Infrastructure Sectors (http://www.cert.org/)
- Insider threats are avoided using appropriate policies and IT products that provide assurance

## Insider vs Outsider Threats

- Read Insider Threat Study: Computer System Sabotage in Critical Infrastructure Sectors (http://www.cert.org/)
- Polled 500 security and law enforcement executives on issues related to electronic crimes
- 70 percent of respondents identified whether outsiders or insiders were responsible for an e-crime or intrusion committed in 2003,
- 71% reported that one or more attacks were known or suspected to have come from outsiders compared to
- 29% from insiders. Respondents identified current or former employees and contractors

## IT Products with Security Features

- Use IT security products that have
- Documented design
- All external interfaces are documented
- All external interfaces that enforce security are thoroughly tested
- Guidance documents are examined against the design and guidance is tested.

## IT Products with Security Features

- Select products that have completed a third party review of their security functions
- ISO 9000 – repeatability
- ICSA (_[http://www.icsalabs.com/](http://www.icsalabs.com/)__)_
- feature tests, standard tests
- Common Criteria (_[http://niap.nist.gov/cc-scheme/](http://niap.nist.gov/cc-scheme/)__)_
- Evaluate design,
- Evaluate guidance and map to design
- Evaluate vendor tests and map to design and guidance
- Test product, search for vulnerabilities.

## External Threats - Attack Tools are Now Easier to Deploy

**High**

**Low**

**1980**

**1985**

**1990**

**1995**

**2000**

**password guessing**

**self-replicating code**

**password cracking**

**exploiting known vulnerabilities**

**disabling audits**

**back doors**

**Hijacking sessions**

**scanners/sweepers**

**sniffers**

**packet spoofing**

**GUI**

**automated probes**

**denial of service**

**SONET **
**backbone attacks**

**Tools & **
**Techniques**

**Threat**

***Skills & Knowledge Required***

***Sophistication***

**“****stealth” / advanced scanning techniques**

**burglaries**

**network mgmt. diagnostics**

**network element Trojans**

**PAD to PAD **

**Y2K enabled**
**hacking**

- Sources:
**CERT****®**** Coordination Center**
**Network Reliability and Interoperability Council**

**Distributed **
**denial of **
**service /**
**advanced **
**virus / worm**
**techniques**

## Exploits – Social Engineering

- Social Engineering
- The act of tricking another person into telling confidential information by posing as an authorized individual to that information.  *All-in-one CISSP Certification*
- Advancements in Technology are making it easier
- Internet search engines and databases provide abundant information. *Hi nurse, I am Doctor [fil in name]*
- Art of Subversive Psychology
- “Increased security measures make psychological attacks easier because users think data is safe.” (Susan Thunder - psychological attacker)
- Dumpster Diving
- One person’s trash is another person’s treasure

## Exploits – Phishing

- Type of spoofing or social engineering that baits humans into revealing information that should be protected
- Solicited through email and links to fraudulent websites
- Spyware, addware

**Notes:**
Theme:  Phishing is a very nefarious practice in that the bait looks very authentic.

## Exploits – Phishing example (Regions Bank)

**Fake (Phisher’s) Website**

**Actual Bank Website**

**Notes:**
The two screen captures show the fake website set up by the phisher on the left, and the actual equivalent bank website on the right.
Key differences/notes:
The bank website (right) uses SSL for encryption, as shown by the small yellow “lock” in the bottom right hand corner of the browser window.  No SSL for the phisher site.
The bank website has a note specifically stating that Regions will not send e-mails requesting user authentication information, and asking for such phishing e-mails to be forwarded to phishing@regions.com for investigation.
Apparently in reaction to the note in 2. above, the phishing e-mails now have “phishing@regions.com” as their forged return address (see the previous slide).
Other than those differences, the look-and-feel of the fake site is a relatively effective copy of the actual bank site.

## Exploiting Wireless

**Local Area Network**

**IEEE 802.11**
**Wireless**

**IEEE 803.2**
**Wire**

**Access**
**Point**

-  Radio and Light-based Wireless
-  Eavesdropping
-  Jamming
-  Weak Encryption
-  Inadequate Network Configuration

**Notes:**
Theme: War driving has become a favorite activity.
Business is going mobile to keep pace with the faster pace of business and the desire for employees, partners, and customers to communicate wherever they are at a reasonable cost. Today’s wireless access falls into two categories, private Local Area Networks to access networked resources and Public Wide Area Networks as Extranets and access points. 
The rapid spread of wireless communications presents new opportunities for hackers, disgruntled employees, and others who are curious, interested in causing mischief that will disrupt your operations, or intent on obtaining your sensitive information.  We have already seen joke-programs and malicious application-based programs targeted at the Palm Pilot operating system and a email virus similar to the “I love You” virus that hit the wireless network of Madrid, Spain-based Telefonica SA. Computer viruses and Trojan Horse programs are following the same development paths they did in the wired world. 

Hackers have already posted tools to leverage published exploits that allow them to passively monitor a wireless network and even break the Wired Equivalent Privacy encryption, if it is even employed. 

## Exploiting Web Traffic

- Server

**Internet**

**Please Send Me Content!**

**HTML, Audio, Video, ActiveX, Javascript, Java, Web Bug, Malicious Code**

**OK!**

- Cross-site Scripting
- Parameter Tampering
- Hidden Field Manipulation
- Backdoors and Debug Options
- Stealth Commanding
- Spyware

- Forceful Browsing
- Application Buffer Overflows
- Third Party Misconfigurations
- Malicious Requests
- Malicious Response – Script Viruses
- Malicious Applications – Mobile Code

**Notes:**
Theme:  That website you visited on your office computer may have sent you “sleeping” code that wakes up when you access the accounts payable application program.
SANS NewsBites  March 26, 2003, Vol. 5, Num. 12 Top of the News
Conflict in Iraq Sparks Hundreds of Web Defacements
Email Viruses Spreading: Claim To Have Iraq News and Pictures

## Threat - Malicious Code

- The old days:  Trojans, worms, backdoors and viruses
- The hard part is getting somebody to run your program in the first place
- Spreading of code primarily by infected floppies or downloaded (FTP) files
- Mobile Code
- Java, Active X (JavaScript is limited in its impact)
- Integrated HTML and automatic opening of attachments have made e-mail an easy vector for malicious code
- Cell Phone Virus
- Targets Symbian Operating System (June 2000)
- For incident response, use a basic phone
- Disable exotic features
- Spyware – Attacks on privacy and security
- Tracker cookies
- Key Loggers

**Notes:**
Theme: Destructive code stays current with all the new IT products and features.

## SANS Top 20 Tech Threats October 2004

**Top Vulnerabilities to Windows Systems**
- W1 Web Servers & Services
- W2 Workstation Service
- W3 Windows Remote Access Services
- W4 Microsoft SQL Server (MSSQL)
- W5 Windows Authentication
- W6 Web Browsers
- W7 File-Sharing Applications
- W8 LSAS Exposures
- W9 Mail Client
- W10 Instant Messaging

**Top Vulnerabilities to UNIX Systems**
- U1 BIND Domain Name System
- U2 Web Server
- U3 Authentication
- U4 Version Control Systems
- U5 Mail Transport Service
- U6 Simple Network Management Protocol (SNMP)
- U7 Open Secure Sockets Layer (SSL)
- U8 Misconfiguration of Enterprise Services NIS/NFS
- U9 Databases
- U10 Kernel

- SysAdmin, Network, Audit, Security (SANS)
- Institute publishes a Top 20. A good start.
- _[www.sans.org/top20/](http://www.sans.org/top20/)_

## Contact Information

- Robert Williamson
- AVP, SAIC Common Criteria Testing Laboratory
- (410)953-6819 (703)450-4198
- _[robert.l.williamson.jr@saic.com](mailto:robert.l.williamson.jr@saic.com)_
- Julie Taylor
- SAIC CCTL Director
- 410-953-6877
- julie.y.taylor@saic.com