Introduction to cyber security 2.ppt.pdf

Cyber security

1. Module 4
System and Application Security

Chapter 2 - System Security

2. System Security
•We discuss
–Desktop Security
–email security: PGP and SMIME 3
–Database Security
– Web Security: web authentication, SSL and SET 4

31. Email Security
(Pretty Good Privacy (PGP),S/MIME)

•Email is one of the most heavily used
network-based application.
•There are two widely used schemes for
providing authentication and confidentiality
for email security, PGP and S/MIME.

32. SMTP

•Internet email is originally based on
SMPT-protocol (Simple Mail Transfer Protocol)
•SMPT transfers a message consisting of header
lines and a body (all ASCII) using a packet relay
network.
•SMPT does not have any security services. The
messages can easily be read or modified. Also
the senders address of routing information is
easy to change.

33. MIME

•”Multipurpose Internet Mail Extensions” is an
extension to solve many limitations of using
text-based messages and SMPT.
•MIME does not have security sercvices either.

47. Database Security

•Definition - What does Database
Security mean?
–Database security refers to the collective
measures used to protect and secure a database
or database management software from
illegitimate use and malicious threats and attacks.
–It is a broad term that includes a multitude of
processes, tools and methodologies that ensure
security within a database environment.

48. Techopedia explains Database
Security

•Database security covers and enforces security on all aspects
and components of databases. This includes:
•Data stored in database ,Database server
•Database management system (DBMS)
•Other database workflow applications
•Database security is generally planned, implemented and
maintained by a database administrator and or other
information security professional.

49. •Some of the ways database security is analyzed and
implemented include:

1. Restricting unauthorized access and use by implementing
strong and multifactor access and data management controls

2. Load/stress testing and capacity testing of a database to
ensure it does not crash in a distributed denial of service
(DDoS) attack or user overload

3. Physical security of the database server and backup
equipment from theft and natural disasters

4. Reviewing existing system for any known or unknown
vulnerabilities and defining and implementing a road
map/plan to mitigate them

50. Web Security
•Web application security, is a branch
of Information Security that deals specifically
with security of websites, web
applications and web services.

51. Security Threats
•With the emergence of Web 2.0, increased
information sharing through social
networking and increasing business adoption
of the Web as a means of doing business and
delivering service, websites are often attacked
directly.
•Hackers either seek to compromise the
corporate network or the end-users accessing
the website by subjecting them to drive-by
downloading.

52. •as a result, industry is paying increased attention to the
security of the web applications themselves in addition
to the security of the underlying computer
network and operating systems.
•The majority of web application attacks occur
through cross-site scripting (XSS) and SQL
injection attacks which typically result from flawed
coding, and failure to sanitize input to and output from
the web application.
•Phishing is another common threat to the Web
application and global losses from this type of attack in
2012 were estimated at $1.5 billion.

Security Threats

53. Web Security

Secure Electronic Transaction(SET)
•Developed by Visa and MasterCard
•Designed to protect credit card transactions
•Confidentiality: all messages encrypted
•Trust: all parties must have digital certificates
•Privacy: information made available only when and where necessary
•Confidentiality of payment and order information
–Encryption
•Integrity of all data (digital signatures)
•Authentication of cardholder & account (certificates)
•Authentication of merchant (certificates)
•No reliance on secure transport protocols (uses TCP/IP)
•Interoperability between SET software and network
–Standardized message formats
•SET is a payment protocol
–Messages relate to various steps in a credit card transaction

54. SSL (Secure Sockets Layer)
•NOT a payment protocol -can be used for any secure
communications, like credit card numbers
•SSL is a secure data exchange protocol providing
–Privacy between two Internet applications
–Authentication of server (authentication of browser optional)
•Uses enveloping: RSA used to exchange DES keys
•SSL Handshake Protocol
–Negotiates symmetric encryption protocol, authenticates
•SSL Record Protocol
–Packs/unpacks records, performs encryption/decryption
•Does not provide non-repudiation
•Layered on top of TCP/IP but below the application layer.
(Requires reliable transport to operate.)
•SSL is increasing in importance for Internet security

55. Thank You