sa_tatics_for_security

#Tactics for Security

Detect Attacks

Detect Intrusion

• Comparing network traffic or service request patterns within a system to a set of signatures or known patterns of malicious behavior stored in a database
  • The signatures can be based on protocol, TCP flags, payload sizes, applications, source or destination address, or port number
  • Typically done with the help of an intrusion detection system (IDS)

Detect Service Denial

• Comparing the pattern or signature of network traffic coming into a system to historic profiles of known denial-of-service (DOS) attacks
• Typical forms of DOS attack
  • Local DOS against hosts
    • fork() bomb; intentionally generate errors to fill logs, consuming disk space, crashing
  • Network-based DOS
    • Flood attack, ping of death (PoD), smurf attack, DDOS

Verify Message Integrity

• Using techniques such as checksums or hash values to verify the integrity of messages, resource files, deployment files, and configuration files

Detect Message Delay

• Detecting message interception by checking the time it takes to deliver a message
  • When there are more variation in delivery time, such as in case of network congestion, more false alerts will result

Resist Attacks

Identify Actors

• Identifying the source of any external input to the system
  • User IDs, access codes, IP addresses, protocols, ports etc.

Authenticate & Authorize Actors

• Authenticate actors– assuring that an actor is actually who or what it says it is
  • Passwords
  • One-time passwords
  • Digital certificates
  • Biometric identification
  • ……
• Authorize actors– ensuring that an authenticated actor has the right to access/modify data or services
  • Access control by privileges or by roles

Limit Access

• Memory protection, blocking a host, closing a port, or rejecting a protocol etc.
• Firewalls (source, destination port)
  • But it is not always possible to limit access to known sources, e.g. a public Web site.
• DMZ – demilitarized zone: access to Web but not to the rest of the LAN

Limit Exposure

• Attacks typically exploit a single weakness on a host to get access to all of its data
• Limit exposure is typically realized by having the least possible number of access points
  • The architect can minimize risk by allocation of services/data to hosts and limit exposure on each host

Encrypt Data

• Data should be protected from unauthorized access by applying some form of encryption to data and to communication
• Encryption of data
  • Symmetric key: DESAES
  • Public-key encryption: RSA
• Encryption of communication links
  • SSL (Secure Sockets Layer)
  • VPN – virtual private networks

Separate Entities

• Physical separation on different servers that are attached to different networks
• Virtual machines
• "Air gap"
• Separate sensitive data from non-sensitive data

Change Default Settings

• Forcing the user to change default settings will prevent attackers from gaining access to the system through settings that are publicly available

React to Attacks

Revoke Access

• Revoke a system's or a user's access to sensitive resources when an attack is detected or expected. E.g.
  • When a computer is infected with virus, access to certain resources may be limited
  • Revoke the access of a user account when attack using this accout is detected

Lock Computer

• Limit access from a particular computer if there are repeated failed attempts to access an account from that computer
  • E.g. Lock a computer when encountered with repeated failed login attempts
  • Usually only lock for a certain time period

Inform Actors

• Ongoing attacks may require action by operators, other personnel, or cooperating systems
  • Notify these actors when a system attack is detected

Recover from Attacks

Restoring data and service

• Systems attacked need to recover:
  • Restoring data and service
    • Tactics from availability: backups, passive redundancy, checkpoints etc.
  • Attacker identi
    • ficationAudi
      • t trails forTrace the action
      • of the attackerHelp identify intruder and support non-repudiation
      • Should be protected/hidden

Attacker identification

• We check the architectural design and analysis process for security from the following 7 aspects:
  1. Allocation of responsibilities
  2. Coordination model
  3. Data model
  4. Management of resources
  5. Mapping among archit ectural elements
  6. Binding time decisions
  7. Choice of technology