Chapter 5 information assurance and security

Information security

1. Chapter 5
Program Security, Cybersecurity Threats
and Malicious programs

2. Protecting programs is at the heart of computer security
because programs constitute so much of a computing
system(the operating system, device drivers, the network
infrastructure, database management systems and other
applications, even executable commands on web pages).
For now, we call all these pieces of code "programs."
A Program Security Flaw is an undesired program behavior
caused by a program vulnerability.
So we need to ask two important questions:
How do we keep programs freefrom flaws?
How do we protect computing resources against programs
that contain flaws
Secure Programs

3. Cybersecurity threats & Malicious Code
Maliciouscode(rogueprogram)isthegeneralnamefor
unanticipatedorundesiredeffectsinprogramsorprogram
parts,causedbyanagentintentondamage.
Theagentisthewriteroftheprogramorthepersonwho
causesitsdistribution.
Malicioussoftware(malware)isasoftwaredesignedto
disruptcomputeroperations,orgainaccesstocomputer
systems,withouttheuser'sknowledgeorpermission
Thetermmalwareincludescomputerviruses,worms,
Trojanhorses,ransomware,spyware,adware,scareware,
andothermaliciousprograms

4. Viruses
Avirusismaliciousexecutablecodeattachedtoanother
executablefile,suchasalegitimateprogram.
Itcanactivateataspecifictimeordate.
Computervirusesusuallyspreadinoneofthreeways:
fromremovablemedia
fromdownloadsoftheInternet
fromemailattachments
Example
TheMelissaViruswasanexampleofavirusspreadvia
email.Melissaaffectedtensofthousandsofusersandcaused
anestimated$1.2billionindamage.

5. Aviruscanbeeithertransientorresident.
Atransientvirushasalifethatdependsonthelifeofitshost;
thevirusrunswhenitsattachedprogramexecutesand
terminateswhenitsattachedprogramends.
(Duringitsexecution,thetransientvirusmayspreadits
infectiontootherprograms.)
Aresidentviruslocatesitselfinmemory;thenitcanremain
activeorbeactivatedasastand-aloneprogram,evenafterits
attachedprogramends.

6. Worms
Wormsaremaliciouscodethatreplicatesbyindependently
exploitingvulnerabilitiesinnetworks.Wormsusuallyslow
downnetworks.Afterawormaffectsahost,itisableto
spreadveryquicklyoverthenetwork.
Example
Forexample,in2001,theCodeRedworminfected658
servers.Within19hours,theworminfectedover300,000
servers.

7. Trojanhorse
ATrojanhorseismalwarethatcarriesoutmalicious
operationsundertheguiseofadesiredoperationsuchas
playinganonlinegame.Thismaliciouscodeexploitsthe
privilegesoftheuserthatrunsit.ATrojanhorsediffersfrom
avirusbecausetheTrojanbindsitselftonon-executable
files,suchasimagefiles,audiofiles,orgames.

8. LogicBombs
Alogicbombisamaliciousprogramthatusesatriggerto
awakenthemaliciouscode.
Forexample,triggerscanbedates,times,otherprograms
running,orthedeletionofauseraccountAlogicbombcan
sabotagedatabaserecords,erasefiles,andattackoperating
systemsorapplications
Ransomware
Ransomwareholdsacomputersystem,orthedataitcontains,
captiveuntilthetargetmakesapayment.Ransomwareusually
worksbyencryptingdatainthecomputerwithakeyunknown
totheuser.
Theusermustpayaransomtothecriminalstoremovethe
restriction

9. Spam
Spam,alsoknownasjunkmail,isunsolicitedemail.
Itisamethodofadvertising.
Itcansendharmfullinks,malware,ordeceptivecontent.
Morecommonindicatorsofspam:
Anemailhasnosubjectline.
Anemailisrequestinganupdatetoanaccount.
Anemaillookslikecorrespondencefromalegitimate
business.
Theemailrequeststhattheuseropenanattachment.

11. Spyware,Adware,andScareware
Spywareissoftwarethatenablesacriminaltoobtain
informationaboutauser’scomputeractivities.Spyware
oftenincludesactivitytrackers,keystrokecollection,and
datacapture.
Adwaretypicallydisplaysannoyingpop-upstogenerate
revenueforitsauthors.Themalwaremayanalyzeuser
interestsbytrackingthewebsitesvisited.Itcanthensend
pop-upadvertisingpertinenttothosesites
Scarewarepersuadestheusertotakeaspecificactionbased
onfear.

12. Phishing
Phishingisaformoffraud.
Cybercriminalsuseemail,instantmessaging,orothersocial
mediatotrytogatherinformationsuchaslogincredentials
oraccountinformationbymasqueradingasareputable
entityorperson.
Phishingoccurswhenamaliciouspartysendsafraudulent
emaildisguisedasbeingfromalegitimate,trustedsource.
Anexampleofphishingisanemailforgedtolooklikeitcamefromaretail
storeaskingtheusertoclickalinktoclaimaprize.Thelinkmaygotoa
fakesiteaskingforpersonalinformation,oritmayinstallavirus.

13. Vishing,Smishing,Pharming,andWhaling
Vishingisphishingusingvoicecommunicationtechnology.
Criminalscanspoofcallsfromlegitimatesourcesusingvoice
overIP(VoIP)technology.
Smishing(ShortMessageServicephishing)isphishing
usingtextmessagingonmobilephones.
Pharmingistheimpersonationofalegitimatewebsiteinan
efforttodeceiveusersintoenteringtheircredentials.It
misdirectsuserstoafakewebsitethatappearstobeofficial.
Victimsthenentertheirpersonalinformationthinkingthat
theyconnectedtoalegitimatesite.
Whalingisaphishingattackthattargetshighprofiletargets
withinanorganizationsuchasseniorexecutives.Additional
targetsincludepoliticiansorcelebrities.

14. DefendingAgainstEmailandBrowserAttacks
Methodsfordealingwithspamincludefilteringemail,
educatingtheuseraboutbeingcautioustowardsunknown
email(s),andusinghost/serverfilters.
Keepingallsoftwareupdatedensuresthatthesystemhasall
ofthelatestsecuritypatchesappliedtotakeawayknown
vulnerabilities.
DefendingAgainstMalware
UsingAntivirusProgram
UsingUp-to-DateSoftware

15. Controls Against Program Threats
DevelopmentalControls
TheNatureofSoftwareDevelopment
Softwaredevelopmentisoftenconsideredasolitaryeffort;a
programmersitswithaspecificationordesignandgrindsout
lineafterlineofcode.
Butinfact,softwaredevelopmentisacollaborativeeffort,
involvingpeoplewithdifferentskillsetswhocombinetheir
expertisetoproduceaworkingproduct.
Developmentrequirespeoplewhocan
Specifythesystem,bycapturingtherequirementsandbuilding
amodelofhowthesystemshouldworkfromtheusers'pointof
view
Designthesystem,byproposingasolutiontotheproblem
describedbytherequirementsandbuildingamodelofthe
solution
Implementthesystem,byusingthedesignasablueprintfor
buildingaworkingsolution

16. Testthesystem,toensurethatitmeetstherequirements
andimplementsthesolutionascalledforinthedesign
Reviewthesystematvariousstages,tomakesurethatthe
endproductsareconsistentwiththespecificationand
designmodels
Documentthesystem,sothatuserscanbetrainedand
supported
Managethesystem,toestimatewhatresourceswillbe
neededfordevelopmentandtotrackwhenthesystemwill
bedone
Maintainthesystem,trackingproblemsfound,changes
needed,andchangesmade,andevaluatingtheireffectson
overallqualityandfunctionality

17. Modularity, Encapsulation, and
Information Hiding
Letusbeginwiththeproduct,togetasenseofhowwe
recognizehigh-qualitysecuresoftware.
Codeusuallyhasalongshelf-lifeandisenhancedover
timeasneedschangeandfaultsarefoundandfixed.
akeyprincipleofsoftwareengineeringistocreatea
designorcodeinsmall,self-containedunits,called
componentsormodules;whenasystemiswrittenthis
way,wesaythatitismodular.
Modularityoffersadvantagesforprogramdevelopmentin
generalandsecurityinparticular

18. Ifacomponentisisolatedfromtheeffectsofother
components,thenitiseasiertotraceaproblemtothefault
thatcauseditandtolimitthedamagethefaultcauses.
Itisalsoeasiertomaintainthesystem,sincechangestoan
isolatedcomponentdonotaffectothercomponents.
Anditiseasiertoseewherevulnerabilitiesmaylieifthe
componentisisolated.Wecallthisisolationencapsulation.
Informationhidingisanothercharacteristicofmodular
software.Wheninformationishidden,eachcomponent
hidesitspreciseimplementationorsomeotherdesign
decisionfromtheothers.

19. Thus,whenachangeisneeded,theoveralldesigncan
remainintactwhileonlythenecessarychangesaremadeto
particularcomponents.
Letuslookatthesecharacteristicsinmoredetail.
Modularity
Modularizationistheprocessofdividingataskinto
subtasks.Thisdivisionisdoneonalogicalorfunctional
basis.
Eachcomponentperformsaseparate,independentpartof
thetask.

20. Thereareseveraladvantagestohavingsmall,independent
components.
Maintenance.Ifacomponentimplementsasingle
function,itcanbereplacedeasilywitharevisedoneif
necessary.
Understandability.Asystemcomposedofmanysmall
componentsisusuallyeasiertocomprehendthanone
large,unstructuredblockofcode.
Reuse.Componentsdevelopedforonepurposecanoften
bereusedinothersystems.
Correctness.Afailurecanbequicklytracedtoitscauseif
thecomponentsperformonlyonetaskeach.
Testing.Asinglecomponentwithwell-definedinputs,
outputs,andfunctioncanbetestedexhaustivelybyitself,
withoutconcernforitseffectsonothermodules.

21. GoodDesign
Severaldesign-relatedprocessactivitiesareparticularly
helpfulinbuildingsecuresoftware:
usingaphilosophyoffaulttolerance
havingaconsistentpolicyforhandlingfailures
usingdesignpatterns

22. Thank You!
Any Query