#10 CYBERLAW

CYBERLAW

Malaysia has set a vision to move towards a knowledge-based society and economy
 National Vision - where ICT as driver for restructuring of economy and employment.
 Prerequisites include access to infrastructure and development of Information, knowledge and applications.
Licenses for Certification Authorities (CA)
 Controller and the governing body which issued:
Malaysian Communications and Multimedia

 Company that already licensed certification authorities (CA) in Malaysia
Digicert
MSC Trustgate

 Digital Signature Act


What the Act is about:

 Provides for the regulation of the public key infrastructure
 The Act makes a digital signature as legally valid and enforceable as a traditional signature
 Copyright serves to protect the expression of thoughts and ideas from unauthorized copying and/or alteration
 With convergence of Information and Communication Technology (ICT), creative expression is now being captured and communicated in new forms (example: multimedia products, broadcast of movies over the Internet and cable TV). These new forms need protection.


 Copyright (Amendment) Act

What the Amended Act is about:

The Copyright (Amendment) Act amends the Copyright Act 1987 to extend copyright law to the new and converged multimedia environment
 There is now clear protection accorded to multimedia works.
 The transmission of copyright works over the Internet now clearly amounts to infringement
 Technological methods of ensuring works (and authorship info) are not altered or removed is also protected.

 Telemedicine Act
Why the Act exists:

 Healthcare systems and providers around the world are becoming interconnected. People and local healthcare providers can thus source quality healthcare advice and consultation from specialists from around the world, independent of geographical location. Conversely, interconnectivity also allows for non-quality healthcare advice and consultation from around the world. The Act serves to regulate the practice of teleconsultations in the medical profession.


 Computer Crimes Act
Why the Act exists:

 As computing becomes more central to people’s life and work, computers become both targets and tools of crime. This Act serves to ensure that misuse of computers is an offense.

What the Act is about:
The Act makes it an offense to:
 Enter or attempt to enter into computers and computer systems without authorization;
 Damage or alter data/information in computers or computer systems by planting viruses or other means;
 Aid others in committing the above two offences;
 Give passwords to people who are not authorized to receive it.
 Communications and Multimedia Act
Why the Act exists:
 Convergence of technologies is driving convergence of telecommunications, broadcasting, computing and content.
 Previously, each of these industries was regulated by several different pieces of legislation
 The old regulatory framework cannot cope with convergence and inhibits the growth of the new converged industry.
 Communications and Multimedia Act
What the Act is about:
 The CMA provides for a restructuring of the converged ICT industry.
 Creates a new system of licenses and defines the roles and responsibilities of those providing communication and multimedia services
 Provides for the existence of the Communication and Multimedia Commission, the new regulatory authority
 Policy Objectives of CMA


To establish Malaysia as a major global hub for C&M information and content services;
To promote a civil society where information based services would enhance the quality of life.

To grow and nurture local information resources and cultural representation that facilitate national identity and global diversity.

To regulate for the long-term benefit of the end user

Future Cyberlaws must recognise the people development component and crucial for a K-Economy.The existing Cyberlaws created the necessary impact but constant review is necessary.

#9 Legal and ethical issues in Computing

Legal and Ethical Issues in Computer Security

Why Laws
The laws of computer security affect programmers, designers, users, and maintainers of computing systems and computerised data banks.
These laws provide protection, but they also regulate the behaviour of people who use computers.

Before recommending change, however, professionals must understand the current state of computers and the law.

Objectives of Understanding Legal Section

Therefore, there are three motivations for studying the legal section
– to know what protection the law provides for computers and data;
– to appreciate laws that protect the rights of others with respect to computers, programs, and data; and
– to understand existing laws as a basis for recommending new laws to protect computers, data, and people.
Protecting Programs and Data

• Copyrights
Copyrights are designed to protect the expression of ideas. Thus, a copyright applies to a creative work, such as a story, photograph, song, or pencil sketch. The right to copy an expression of an idea is protected by a copyright.

Copyright gives the author/programmer exclusive right to make copies of the expression and sell them to the public. That is, only the author can sell copies of the author’s book (except, of course, for booksellers or others working as the agents of the author).

Copyrights for Computer Works

Can a computer program be copyrighted?
YES. The algorithm is the idea, and the statements of the programming language are the expression of the idea.
Therefore, protection is allowed for the program statements themselves, but not for the design: copying the code intact is prohibited, but reimplementing the algorithm is permitted.


Patents
Patents are unlike copyrights in that they protect inventions, not works of the mind.

The distinction between patents and copyrights is that patents were intended to apply to the results of science, technology, and engineering, whereas copyrights were meant to cover works in the arts, literature, and written scholarship.
Patents - Computer Objects
The patent has not encouraged patents of computer software.
For a long time, computer programs were seen as the representation of an algorithm was a fact of nature, which is not subject to patent.
There was a case on a request to patent a process for converting decimal numbers into binary. The Supreme Court rejected the claim, saying it seemed to attempt to patent an abstract idea, in short, an algorithm. But the underlying algorithm is precisely what most software developers would like to protect.

Trade Secret

A trade secret is information that gives one company a competitive edge over others. For example, the formula for a soft drink is a trade secret, as is a mailing list of customers, or information about a product due to be announced in a few months.
The distinguishing characteristic of a trade secret is that it must always be kept secret. The owner must take precautions to protect the secret, such as storing it in a safe, encrypting it in a computer file, or making employees sign a statement that they will not disclose the secret.

Comparisons

Employers hire employees to generate ideas and make products. Thus, the protection offered by copyrights, patents, and trade secrets applies to the idea and products.
However, considering the issue of who owns the ideas and products is much more complex.


Why Computer Crime is Hard to Define?


Understanding
Neither courts, lawyers, police agents, nor jurors necessarily understand computers.
Fingerprints
Polices and courts for years depended on tangible evidence, such as fingerprints. But with many c omputer crimes there simply are no fingerprints, no physical clues.
Form of Assets
We know what cash is, or diamonds, or even negotiable securities. But are 20 invisible magnetic spots really equivalent to a million dollars?
Juveniles
Many computer crimes involve juveniles. Society understands immaturity and can treat even very serious crimes by juveniles as being done with less understanding than when the same crime is committed by an adult.


Type of Crimes Committed

Telecommunications Fraud

It is defined as avoiding paying telephone charges by misrepresentation as a legitimate user.
Embezzlement
It involves using the computer to steal or divert funds illegally.
Hacking
It denotes a compulsive programmer or user who explores, tests, and pushes computers and communications system to their limits - often illegal activities.
Automatic Teller Machine Fraud
It involves using an ATM machine for a fraudulent activity - faking deposits, erasing withdrawals, diverting funds from another person’s account through stolen PIN numbers.
Records Tampering
It involves the alteration, loss, or destruction of computerised records.
Acts of Disgruntled Employees
They often use a computer for revenge against their employer.
Child Pornography and Abuse
They are illegal or inappropriate arts of a sexual nature committed with a minor or child, such as photographing or videotaping.

What are Ethics?
Society relies on ethics or morals to prescribe generally accepted standards of proper behaviour.

An ethic is an objectively defined standard of right and wrong within a group of individuals.
These ethics may influence by religious believe. Therefore, through choices, each person defines a personal set of ethical practices.

A set of ethical principles is called and ethical system.


Differences of The Law and Ethics


Firstly, laws apply to every one, even you do not agree with the laws. However, you are forced to respect and obey the laws.
Secondly, there is a regular process through the courts for determining which law supersedes which if two laws conflict.
Thirdly, the laws and the courts identify certain actions as right and others as wrong. From a legal standpoint, anything that is not illegal is right.
Finally, laws can be enforced, and there are ways to rectify wrongs done by unlawful behaviour.

#8 WIRELESS SECURITY

WIRELESS SECURITY

WLANs allow greater flexibility and portabulity than do tranditional wired local are network (LAN). Unlike a tranditioanl LAN, which requires a wire to connect a user computer to the network, a WLAN connect computer and other components to the network using an access point device.

An access point communicates with devices eqquipped with wireless network adaptrs. it connect to a wired Ethernet LAN via an RJ-45 port. Access point devices typically have coverage areas of up to 300 feet (approximately 100 meter). This coverage area is called a cell or range. Users move freely within the cell with their laptop or other network device. Access point cells can be linked together to allow users to even 'roam' within a building or between buildings.

- IEEE ratified 802.11 in 1997.
~Also known as Wi-Fi.
- Wireless LAN at 1 Mbps & 2 Mbps.
- WECA (Wireless Ethernet Compatibility Alliance) promoted Interoperability.
~Now Wi-Fi Alliance
- 802.11 focuses on Layer 1 & Layer 2 of OSI model.
~Physical layer
~Data link layer

802.11 Components
- Two pieces of equipment defined:
~Wireless station
-A desktop or laptop PC or PDA with a wireless NIC.
~ Access point
- A bridge between wireless and wired networks
- Composed of
- Radio
- Wired network interface (usually 802.3)
- Bridging software
- Aggregates access for multiple wireless stations to wired network

802.11 modes
- Infrastructure mode
- Basic Service Set (BSS)
- One access point
- Extended Service Set
-Two or more BSSs forming a single subnet.
- Most corporate LANs in this mode.
-Ad-hoc mode
-Also called peer-to-peer.
- Independent Basic Service Set
- Set of 802.11 wireless stations that communicate directly without an access point.
- Useful for quick & easy wireless networks.

Infrastructure mode


Ad-hoc mode

802.11 Physical Layer
1. Originally three alternative physical layers
~ Two incompatible spread-spectrum radio in 2.4Ghz ISM band
-Frequency Hopping Spread Spectrum (FHSS)
- 75 channels
- Direct Sequence Spread Spectrum (DSSS)
- 14 channels (11 channels in US)
~ One diffuse infrared layer
~ 802.11 speed
- 1 Mbps or 2 Mbps.

802.11 Data Link Layer
~Layer 2 split into:
~Logical Link Control (LLC).
~Media Access Control (MAC).
~LLC - same 48-bit addresses as 802.3.
~MAC - CSMA/CD not possible.
~Can’t listen for collision while transmitting.
~CSMA/CA – Collision Avoidance.
-Sender waits for clear air, waits random time, then sends data.
-Receiver sends explicit ACK when data arrives intact.
-Also handles interference.
-But adds overhead.
~802.11 always slower than equivalent 802.3

RTS / CTS
1. To handle hidden nodes
2. Sending station sends
- “Request to Send”
3. Access point responds with
- “Clear to Send”
-All other stations hear this and delay any transmissions.
4. Only used for larger pieces of data.
- When retransmission may waste significant time.

802.11b
1. 802.11b ratified in 1999 adding 5.5 Mbps and 11 Mbps.
2. DSSS as physical layer.
- 11 channels (3 non-overlapping)
3. Dynamic rate shifting.
- Transparent to higher layers
- Ideally 11 Mbps.
- Shifts down through 5.5 Mbps, 2 Mbps to 1 Mbps.
- Higher ranges.
- Interference.
- Shifts back up when possible.
4. Maximum specified range 100 meters
5. Average throughput of 4Mbps


Joining a BSS
~ When 802.11 client enters range of one or more APs
- APs send beacons.
- AP beacon can include SSID.
- AP chosen on signal strength and observed error rates.
- After AP accepts client.
-Client tunes to AP channel.
~Periodically, all channels surveyed.
-To check for stronger or more reliable APs.
-If found, re-associates with new AP.


Roaming and Channels
~Re-association with APs
-Moving out of range.
-High error rates.
-High network traffic.
-Allows load balancing.
~Each AP has a channel.
-14 partially overlapping channels.
-Only three channels that have no overlap.
-Best for multi cell coverage.


802.11a
~802.11a ratified in 2001
~Supports up to 54Mbps in 5 Ghz range.
-Higher frequency limits the range
-Regulated frequency reduces interference from other devices
~12 non-overlapping channels
~Usable range of 30 metres
~Average throughput of 30 Mbps
~Not backwards compatible

802.11g
• 802.11g ratified in 2002
• Supports up to 54Mbps in 2.4Ghz range.
- Backwards compatible with 802.11b
• 3 non-overlapping channels
• Range similar to 802.11b
• Average throughput of 30 Mbps
• 802.11n due for November 2006
- Aiming for maximum 200Mbps with average 100Mbps



Open System Authentication
• Service Set Identifier (SSID)
• Station must specify SSID to Access Point when requesting association.
• Multiple APs with same SSID form Extended Service Set.
• APs can broadcast their SSID.
• Some clients allow * as SSID.
- Associates with strongest AP regardless of SSID.


MAC ACLs and SSID hiding
• Access points have Access Control Lists (ACL).
• ACL is list of allowed MAC addresses.
- E.g. Allow access to:
~ 00:01:42:0E:12:1F
~ 00:01:42:F1:72:AE
~ 00:01:42:4F:E2:01
• But MAC addresses are sniffable and spoofable.
• AP Beacons without SSID
- Essid_jack
~ sends deauthenticate frames to client
~ SSID then displayed when client sends reauthenticate frames
Interception
• Wireless LAN uses radio signal.
• Not limited to physical building.
• Signal is weakened by:
-Walls
-Floors
-Interference
• Directional antenna allows interception over longer distances.
• Directional antenna provides focused reception.
802.11 Wireless LAN
- Three basic security services defined by IEEE for the WLAN environment
~ Authentication
-provide a security service to verify the identity of communicating client stations
~ntegrity
- to ensure that messages are not modified in transit between the wireless clients and the access point in an active attack
~ Confidentiality
- to provide “privacy achieved by a wired network”


802.11 Authentication
The IEEE 802.11 specification defines two means to validate wireless users attemping to gain access to a wired network, open system authentication and shares key authentication. One means, shared key authentication, is based on cryptography, and the other is not. The open-system authentication technique is not truly authentication, the access point accepts the mobile station without verifying the identity of the station. It should be notes also that the authentication is only one-way; only the mobile station is authentication. The mobile station must trust that it is communicating to a real AP. Taxonom of the tavhniques for 802.11 is depicted in above figure:-


802.11b Security Services
• Two security services provided:
- Authentication
- Shared Key Authentication
- Encryption
- Wired Equivalence Privacy


Wired Equivalence Privacy
• Shared key between
-Stations.
-An Access Point.
• Extended Service Set
-All Access Points will have same shared key.
• No key management
-Shared key entered manually into
-Stations
-Access points
-Key management nightmare in large wireless LANs


RC4
• Ron’s Code number 4
-Symmetric key encryption
-RSA Security Inc.
-Designed in 1987.
-Trade secret until leak in 1994.
• RC4 can use key sizes from 1 bit to 2048 bits.
• RC4 generates a stream of pseudo random bits
-XORed with plaintext to create ciphertext.


WEP – Sending
• Compute Integrity Check Vector (ICV).
-Provides integrity
-32 bit Cyclic Redundancy Check.
-Appended to message to create plaintext.
• Plaintext encrypted via RC4
-Provides confidentiality.
-Plaintext XORed with long key stream of pseudo random bits.
-Key stream is function of
-40-bit secret key
-24 bit initialisation vector
• Ciphertext is transmitted.

WEP – Receiving
• Ciphertext is received.
• Ciphertext decrypted via RC4
-Ciphertext XORed with long key stream of pseudo random bits.
-Key stream is function of
-40-bit secret key
-24 bit initialisation vector (IV)


• Check ICV
-Separate ICV from message.
-Compute ICV for message
-Compare with received ICV


Shared Key Authentication
• When station requests association with Access Point
-AP sends random number to station
-Station encrypts random number
-Uses RC4, 40 bit shared secret key & 24 bit IV
-Encrypted random number sent to AP
-AP decrypts received message
-Uses RC4, 40 bit shared secret key & 24 bit IV
-AP compares decrypted random number to transmitted random number
• If numbers match, station has shared secret key.


Web Safeguards
- Shares secret key required for associating with an access point, sending data and receving data.
- Message are encrypted for confidentiality.
- Message have checksum for integrity.
- Management static still broadcast in clear containing SSID.


Initialization Vector
• IV must be different for every message transmitted.
• 802.11 standard doesn’t specify how IV is calculated.
• Wireless cards use several methods
- Some use a simple ascending counter for each message.
- Some switch between alternate ascending and descending counters.
- Some use a pseudo random IV generator.

802.11 safeguards
• Security Policy & Architecture Design
• Treat as untrusted LAN
• Discover unauthorised use
• Access point audits
• Station protection
• Access point location
• Antenna design


Security Policy & Architecture
• Define use of wireless network
- What is allowed
- What is not allowed
• Holistic architecture and implementation
-Consider all threats.
-Design entire architecture
~To minimize risk.


Wireless as untrusted LAN
• Treat wireless as untrusted.
- Similar to Internet.
• Firewall between WLAN and Backbone.
• Extra authentication required.
• Intrusion Detection
- at WLAN / Backbone junction.
• Vulnerability assessments


Discover unauthorized use
• Search for unauthorised access points, ad-hoc networks or clients.
• Port scanning
- For unknown SNMP agents.
- For unknown web or telnet interfaces.
• Warwalking!
- Sniff 802.11 packets
- Identify IP addresses
- Detect signal strength
- But may sniff your neighbours…
• Wireless Intrusion Detection
- AirMagnet, AirDefense, Trapeze, Aruba.


Access point audits
• Review security of access points.
• Are passwords and community strings secure?
• Use Firewalls & router ACLs
- Limit use of access point administration interfaces.
• Standard access point config:
-SSID
-WEP keys
-Community string & password policy

#7 Security in Application

Electronic Mail (E-mail) Security

Electronic mail is one of the most heavily used network-based applications. With the explosively growing reliance on e-mail,there grows a demand for security e-mail systems. In an e-mail system, there are a sender and a receiver. However, usually the receiver is not on-line. So in an e-mail system, usually there is no massage interchange when the sender sends an e-mail. On the order hand, some e-mail system (a.g SMTP) only can deliver ASCll codes.

Security provided in E-mail


• Confidentiality
• Data origin authentication
• Message integrity
• Non-repudiation of origin.
• Key management


MIME


MIME = Mutlipurpose Internet Mail Extension.
• Extends the capabilities of RFC 822 to allow e-mail to carry non-textual content, non-ASCII character sets, long message.
• Uses extra header fields in RFC 822 e-mail to specify form and content of extensions.
• Supports a variety of content types, but e-mail still ASCII-coded for compatibility.
• Specified in RFCs 2045-2049.
How e-mail transported?
MUA = Mail user agent (mail client)
MTA = Mail transport agent (mail server)


E-mail Security Threats

Two main group:
• Threats to the security of e-mail itself.
• Threats to an organisation that are enable by the use of e-mail.
Loss of confidentially
• Email are sent it clear over open network.
• Email stored on potentially insecure clients and mail servers.
• Ensuring confidentiality may be important for email sent withi an organisation.

Loss of integrity
• No integrity protection on email, body can be altered in transit or on maul server.

Lack of data origin authentication
• Email could also be altered in transit.
• Sharing of email password common.

Lack of non-repudiation
• Can i rely and act on the content?(integrity)
• If so, can the sender later deny having sent it?Who is liable if i have acted?

• Example of stock-trading via email.


Threats enables by email
• Its easier to distribute information by email than it is by paper and snail mail.
• Disclosure may be deliberate (and malicious) or unintentional.
• Disclosure may be internal or external (email crosses LANs as well as the internet)
• Disclosure may be of personal, inappropriate, commercially sensitive or proprietary information.
• Can lead to loss of reputation and ultimately dismissal of staff.

S/MIME

SEcure/Multipurpose Internet Mail Extension (S/MIME) is another enchaced email system. Similar to PGP which uses sidnature scheme, session key and secret key encryption. S/MIME version 3 message specification is given in RFC2633.

It appears likely that S/MIME will emerge as the industry standard for commercial and organization use, while PGP will remain the choice for personal use.


PGP

Pretty good privary or PGP was developed by Phil Zimmermman. PGP uses public key encryption, signature scheme,hash function, secret key enryption, compression fuction and email compatibility. Functionality similar to S/MIME is an encryption for confidentiality and signature for non-repudiation/ authenticity.
One level of processing only, so less flexible than S/MIME. Sign before encrypt, so signature on unencrypted data. PGP processed data is base64 encoded and carried inside RFC822 message body.

Web Security

Web security included 3 parts:
1. Security of server.
2. Security of client
3. Network traffic security between a browser and a server.


Security pf server and security of client are problems of computer security. Network security can considered at different level , for examples network level: use IPSec, Transport level:Use SSL (Secure socket layer) or TLS (Transport layer security) and Application level: Use PGP,S/MIME,SET(Secure Electronic Transaction).

Secure Socket Layer (SSL)

SSL is develop by Netscape. The main part of SSL contains several protocol:SSL Handshake protocol, SSL change cipher spec protocl,SSL alert protocol, and SSL record protocol.

Secure Shell (SSH)

1. Initially designed to replace insecure SSH, telnel utilities.
2. Secure remote administration (mostly of Unix system).
3. Extended to support secure file transfer and email.
4. Latterly, provide a general secure channel for network application.
5. SSH-1 flawed, SSH-2 better secure security (and different architecture).

Secure Electronic Transaction (SET)
SET is an open encryption and security specification designed to protect credit card transaction on the internet . SSL secures communications between a client and a server.



Set secure issues

Two pairs of PKs parentity
1. One pair for signing.
2. One pair for exchanging keys.

How the web Works-HTTP - Hypertext transfer protocol (HTTP)
- Clients request 'document' through URL
- Server Respons with 'document'
- Document are not interpreted by http
- Stateless protocol, request are indepent.

How the Web works: other elements

-Hyper-text markup language (html).
-Other application specific document.
-E.G., MIME, graphics, video/audio, postscript, Java applets, etc.
-Browsers.
-Display html documents and embedded graphics.
-Run Java program.
-Start helper applications.

How to secure the web
~Athentication
1. Basic (username,password)
- Can be used along with cookie.
2. Digest
~ Access control via address
~Multi layered:
1- S-http(secure http), just for http
- Proposed by CommerceNet,pretty much dead.
2. SSL(TLS),generic for TCP
- https;http over SSl
3. IPsec

HTTP Authentication - Client doesnt know which method
- Client attempts access (GET,PUT) normally
- Server returns
~401 unauthorized
~Realm protection space
- Client tries again with


From Basic Authentication to Forms and Cookies
• Not all sites use basic authentication
• Many instead ask the user to type username/password into a HTML form
• Server looks up the user and sends back a cookie
• The browser (client) resends the cookie on subsequent requests


HTTP Access Control - Digest
1. Server sends www-authenticate parameters:
~ Realm
~ Domain
~ Nonce, new for each 401 response
- E.G. H(client-IP:timestamp:server-secret)
~ Algorithm
- E.G., MD5
2. Client sends authorization response:
~ Same nonce
~ H(A1), where a1=user:realm:password, and other information
~ Steal H(A1)
- Only good for realm

HTTPS

• HTTPS = Secure Hypertext Transfer Protocol
• HTTPS is a communications protocol designed to transfer encrypted information between computers over the World Wide Web (WWW)
• Essentially an implementation of HTTP
• Commonly used Internet protocol using an SSL
• Used to enable online purchasing or the exchange of private information and resources over insecure networks


Why HTTPS combines with SSL and How?
• HTTPS combines with SSL to enable secure communication between a client and a server
• Steps:
- Client requests a secure transaction and informs the encryption algorithms and key sizes that it support (by assessing a URL with HTTPS)
- Server sends the requested server certificate (encrypted server’s public key, list of supported ciphers and key sizes in order of priority)
- Client then generates a new secret symmetric session key basedon the priority list sent by the server. Client compares the certificate issued by CA and confirmed that certificate is belongs to the server intended for communication
• Steps:
- If valid and certificate confirmed, client encrypts a copy of the new session key it generated with the server public key obtained from the certificate. Then, client sends the new encrypted key to server
- Server decrypts the new session key with its own private key.
- Upon completed, both client and server have the same secret session key and use to secure communication and data transport.


Secure File Transfer Protocol (S/FTP)
• S/FTP is an interactive file transfer program
• Similar to ftp
• Performs all operations over an encrypted ssh transport
• Use many features of ssh such as public key authentication and compression
• S/FTP connects and logs into the specified host, then enters an interactive command mode

#6 NETWORK in SECURITY

Computer Network

A computer network is a system in which computers are connected to share information and resources. The connection can be done as peer-to-peer or client/server. This web site reviews the techniques you can use to set up and possibly manage a network for home or a small business.



What is a network can provide?

Logical interface function:
• sending messages
• receiving messages
• executing program
• obtaining status information
• obtaining status information on other network users and their status
• Node
Single computing system in a network.
• Host
A single computing system's processor.
• Link
A connection between two hosts.
• Topology


The pattern of links in a network.

Network Topology

Bus Topology

Bus networks (not to be confused with the system bus of a computer) use a common backbone to connect all devices. A single cable, the backbone functions as a shared communication medium that devices attach or tap into with an interface connector. A device wanting to communicate with another device on the network sends a broadcast message onto the wire that all other devices see, but only the intended recipient actually accepts and processes the message.
Ethernet bus topologies are relatively easy to install and don't require much cabling compared to the alternatives. 10Base-2 ("ThinNet") and 10Base-5 ("ThickNet") both were popular Ethernet cabling options many years ago for bus topologies. However, bus networks work best with a limited number of devices. If more than a few dozen computers are added to a network bus, performance problems will likely result. In addition, if the backbone cable fails, the entire network effectively becomes unusable.

Ring Topology

In a ring network, every device has exactly two neighbors for communication purposes. All messages travel through a ring in the same direction (either "clockwise" or "counterclockwise"). A failure in any cable or device breaks the loop and can take down the entire network.
To implement a ring network, one typically uses FDDI, SONET, or Token Ring technology. Ring topologies are found in some office buildings or school campuses.


Star Topology
Many home networks use the star topology. A star network features a central connection point called a "hub" that may be a hub, switch or router. Devices typically connect to the hub with Unshielded Twisted Pair (UTP) Ethernet.
Compared to the bus topology, a star network generally requires more cable, but a failure in any star network cable will only take down one computer's network access and not the entire LAN. (If the hub fails, however, the entire network also fails.)


Mesh Topology
Mesh topologies involve the concept of routes. Unlike each of the previous topologies, messages sent on a mesh network can take any of several possible paths from source to destination. (Recall that even in a ring, although two cable paths exist, messages can only travel in one direction.) Some WANs, most notably the Internet, employ mesh routing.

A mesh network in which every device connects to every other is called a full mesh. As shown in the illustration below, partial mesh networks also exist in which some devices connect only indirectly to others.

Open Systems Interconnection (OSI)
• Describes computer network communications.
• Developed by the International Standards Organization (ISO).
• Consists of Seven Layers.
• Model describes peer-to-peer correspondence, relationship between corresponding layers of sender and receiver.
• Each layer represents a different activity performed in the actual transmission of a message.
• Each layer serves a separate function.
• Equivalent layers perform similar functions for sender and receiver.


Who can cause security problem?
1. Hacker
2. Spy
3. Student
4. Businessman
5. Ex-employee
6. Stockbroker
7. Terrorist


Network security problem area:
1. Authentication - hacker want to be an autheriza user, so they am this first.
2. Secrecy - In the midle between sender and receiver.
3. Non- repudiation - deal with digital signature.
4. Integrity - Ensure that only authorize user allow to change the data.

Disadvantages of computing network
1. Sharing.
2. Complexity.
3. Unknown paramenter - alot of point on the network that possible to exploite to capture packet.
4. Ananomity - For a big network,we dont even know who at the other point. eg: some one may hack the DNS server before take over the website.
5. Sequrity exposure - Privacy, data integrity, authenticity, convert channel, impersonaty and evesdropping.

Threaten Network
1. Denial Of Service - DOS, DDOS
2. Packet replay - Capture packet that being sent to the AP that using WEP, but it use a lot of time so we use packet replay to dacoy the AP while sniffing the packet without change that packet's content.
3. Packet notification - capture and change the packet's content.

Firewall

A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications. It is a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all (in and out) computer traffic between different security domains based upon a set of rules and other criteria.


Firewalls can be implemented in either hardware or software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.


There are several types of firewall techniques:

1. Packet filter: Packet filtering inspects each packet passing through the network and accepts or rejects it based on user-defined rules. Although difficult to configure, it is fairly effective and mostly transparent to its users. In addition, it is susceptible to IP spoofing.

2. Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose a performance degradation.

3. Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.

4. Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.

Function

A firewall is a dedicated appliance, or software running on a computer, which inspects network traffic passing through it, and denies or permits passage based on a set of rules.

It is a software or hardware that is normally placed between a protected network and an unprotected network and acts like a gate to protect assets to ensure that nothing private goes out and nothing malicious comes in.

A firewall's basic task is to regulate some of the flow of traffic between computer networks of different trust levels. Typical examples are the Internet which is a zone with no trust and an internal network which is a zone of higher trust. A zone with an intermediate trust level, situated between the Internet and a trusted internal network, is often referred to as a "perimeter network" or Demilitarized zone (DMZ).
A firewall's function within a network is similar to physical firewalls with fire doors in building construction. In the former case, it is used to prevent network intrusion to the private network.
In the latter case, it is intended to contain and delay structural fire from spreading to adjacent structures.

Without proper configuration, a firewall can often become worthless. Standard security practices dictate a "default-deny" firewall ruleset, in which the only network connections which are allowed are the ones that have been explicitly allowed.

KERBEROS

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. It is also a suite of free software published by Massachusetts Institute of Technology (MIT) that implements this protocol.

Its designers aimed primarily at a client-server model, and it provides mutual authentication both the user and the server verify each other's identity. Kerberos protocol messages are protected against eavesdropping and replay attacks.
Kerberos builds on symmetric key cryptography and requires a trusted third party. Extensions to Kerberos can provide for the use of public-key cryptography during certain phases of authentication.


DRAWBACK


Single point of failure: It requires continuous availability of a central server. When the Kerberos server is down, no one can log in. This can be mitigated by using multiple Kerberos servers and fallback authentication mechanisms.


Kerberos requires the clocks of the involved hosts to be synchronized. The tickets have a time availability period and if the host clock is not synchronized with the Kerberos server clock, the authentication will fail. The default configuration requires that clock times are no more than 10 minutes apart.

In practice Network Time Protocol daemons are usually used to keep the host clocks synchronized.
The administration protocol is not standardized and differs between server implementations. Password changes are described.

Since all authentications is controlled by a centralized KDC, compromise of this authentication infrastructure will allow an attacker to impersonate any user.

Web Application secure~~

WebGoat


WebGoat is a deliberately insecure J2EE web application designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application. For example, in one of the lessons the user must use SQL injection to steal fake credit card numbers. The application is a realistic teaching environment, providing users with hints and code to further explain the lesson.
The primary goal of the WebGoat project is simple which is created a de-facto interactive teaching environment for web application security. In the future, the project team hopes to extend WebGoat into becoming a security benchmarking platform and a Java-based Web site Honey pot.


To learn more about WebGoat, you can visit this link anytime: http://code.google.com/p/webgoat/source/browse/trunk/webgoat/main/project/WebContent/lesson_plans/HowToWork.html
Injection Flaws
Injection flaw like SQL injection will cause web application to run an SQL code that was not intended by the application. Usually user supplied data from an application is sent to an interpreter as a query command. With the knowledge of SQL query syntax the attacker exploit this feature by crafting a special crafted data to execute exploit command to the interpreter. By doing this attacker can create, read, update or delete any data available in the database through the web application.

The simplest way to protect against injection is to avoid accessing external interpreters wherever possible. For many shell commands and some system calls, there are language specific libraries that perform the same functions. Using such libraries does not involve the operating system shell interpreter, and therefore avoids a large number of problems with shell commands.
For those calls that you must still employ, such as calls to backend databases, you must carefully validate the data provided to ensure that it does not contain any malicious content. You can also structure many requests in a manner that ensures that all supplied parameters are treated as data, rather than potentially executable content.

The use of stored procedures or prepared statements will provide significant protection, ensuring that supplied input is treated as data. These measures will reduce, but not completely eliminate the risk involved in these external calls. You still must always validate such input to make sure it meets the expectations of the application in question. For more details on how to specifically defend against SQL Injection, please refer to OWASP's SQL Injection Prevention Cheat Sheet.


Malicious File Execution

Malicious File execution is another web application vulnerabilities caused by failing to control application input. In this attack, attacker will exploit the weaknesses by performing remote code execution and remote root kit installation and complete system compromise. On Windows, internal system compromise may be possible through the use of PHP’s SMB file wrappers
In other word this kind of attack will manipulate your web application to become the attacker remote terminal to execute command line instructions such as directory list, dir or displaying
network configuration, ipconfig. It will become more dangerous if the attacker manipulate this vulnerability by executing command that can create a backdoor to your server.

5# Database Security

DATABASE SECURITY

Why Database?
We use database because it is shared access, it will minimal the redundancy data. Moreover it contains Data consistency, Data integrity and Controlled access.


What is Database Secure?

It is the protection that is located in databases from unauthorized access. It is important because information is a critical resource in enterprise and securing data has become a billion dollar industry and people want to secure their confidential information not only from hackers but also from legal, professional direct marketing corporations.

A good database is based on Data independence, Shared access, Minimal redundancy, Data consistency, Data integrity Privacy which signifies that an unauthorized user cannot disclose data and integrity which ensures that an unauthorized user cannot modify data and Availability which ensures that data be made available to the authorized user unfailingly.


There are four levels of enforcing database security that is Physical security which such as storage medium safekeeping and fire protection, Operating system security which such as the use of an access control matrix, capability list and accessory list and DBMS security such as protection mechanisms and query modification and also Data encryption such as RSA scheme and data encryption standard.


There are five basic security requirements for database such as database integrity, element integrity, access control, user authentication and availability.

Database Integrity

Users must be able to trust the accuracy of the data values in database. Updates in database must be performed only to authorized individuals and most important is data must be protected from corruption either by an outside illegal program action and an outside force. One way for database to secure is to make a backup.

Element Integrity

DBMS maintains element integrity in three ways such as Field checks which tests the appropriate values in a position such as null value control, default value. Next is access control is controls the access rights to users such as the authorization to update certain element and at last Change log which maintaining change log for the database (a change log is a list of every change made to the database.

Why we need audit record?

This helps to maintain the integrity of a database or discover who had affected what values and when. It also enables users to build up access to protected data incrementally.


Access Control

In access control we focus on Recall, access control for Operating Systems which deals with unrelated data and with entire files and lastly with access control for Databases which deals with records and fields and also concerned with inference of one field from another.


Availability

We focus on Availability on Arbitration of two users' request for the same record and withholding some non protected data to avoid revealing protected data.

Good Internal Consistency.

To get a good consistency, error detection and code correction is needed. One of the way is Hamming Codes. Hamming code is a linear error-correcting code named after its inventor, Richard Hamming. Hamming codes can detect up to two simultaneous bit errors, and correct single-bit errors thus, reliable communication is possible when the Hamming distance between the transmitted and received bit patterns is less than or equal to one.

The goal of Hamming codes is to create a set of parity bits that overlap such that a single-bit error (the bit is logically flipped in value) in a data bit or a parity bit can be detected and corrected. While multiple overlaps can be created, the general method is presented in Hamming codes.

Other than that, good internal consistencies also depend on shadow fields, recovery such as back up, concurrency and monitor.

Secrecy Vs Precision
Secrecy

It is focus only data that is not sensitive and reject any query which mentions a sensitive field.

Precision

Protect all sensitive data while revealing as much no sensitive data as possible.
Do you know Inference?
It derived sensitive data from non- sensitive data. Three basic paths to controlling the inference problem that is suppressing obviously sensitive information, track what the user knows, and disguise the data.



Multilevel Security in Database.
1) Encryption

If sensitive data is encrypted, a user who accidentally receives sensitive data cannot interpret the data. It is not foolproof since the user can mount a plaintext attack and substitute the encrypted form of his or her data. Thus the solution is to use different encryption for each record and a different key for each field or just cryptographically link fields of a record by using a block chaining method such as Cipher Block Chaining (CBC), Cipher Feedback (CFB).


2) Integrity lock

It is a way to provide both integrity and limited access for a database. Method nicknamed 'spray paint' since each element is painted with a color which denotes its sensitivity. The color is maintained with the element and not in an external table. It can be classify on three way that is unforgeable which malicious subject cannot create a new sensitivity label for an element. Next is unique which malicious subject cannot copy a sensitive level from another element and lastly concealed which a malicious subject cannot even determine the sensitivity level of an arbitrary object.


3) Sensitivity lock

A sensitivity lock is a combination of a unique identifier and the security level. It must not be able to identify two elements having identical security levels just by looking at the security portion of the integrity lock. As a result of the encryption, the lock's contents, especially the security level, are concealed.


4) Trusted Front-End

A trusted front end also known as a guard functions much like the monitor we discussed while we were studying operating system security methods. Many DBMS built and put into use without consideration for multilevel security.

5) Commutative filters

This is an interface with both the user and database manager. The filter reformats query such that DBMS does as much of the work as possible, screening out many unacceptable records and provides second screening to select only data to which user has access.
Thank you for spending time to read this page. =)