sen-material: comparison slides04.tex

equal deleted inserted replaced

-:e1a5d057db96
+:1d37142ea1ea
 \mode<presentation>{
 \begin{frame}[c]
 \frametitle{Unix-Style Access Control}
 \begin{itemize}
-\item Q: ``I am using Windows. Why should I care?'' \\ A: In Windows you have similar groups:
+\item Q: ``I am using Windows. Why should I care?'' \\ A: In Windows you have similar AC:
 \begin{center}
 \begin{tabular}{l}
 administrators group\\
 \hspace{5mm}(has complete control over the machine)\\
 \end{center}\medskip
 \item Modern versions of Windows have more fine-grained AC than Unix; they do not have a setuid bit, but
 have \texttt{runas} (asks for a password).\pause
-\item OS provided access control can \alert{add} to your
+\item OS-provided access control can \alert{\bf add} to your
 security.
 \end{itemize}
 \end{frame}}
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 \mode<presentation>{
 \begin{frame}[c]
-\frametitle{\begin{tabular}{@ {}c@ {}}Example: Firewall\end{tabular}}
+\frametitle{\begin{tabular}{@ {}c@ {}}Example: Firewalls\end{tabular}}
 \begin{center}
 \includegraphics[scale=0.5]{pics/firewall.png}
 \end{center}
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 \mode<presentation>{
 \begin{frame}[t]
-\frametitle{\begin{tabular}{@ {}c@ {}}Example: Firewall\end{tabular}}
+\frametitle{\begin{tabular}{@ {}c@ {}}Example: Firewalls\end{tabular}}
 \begin{itemize}
 \item<1->What assets are you trying to protect?\\
 \only<1>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}Whatever is behind the firewall
 (credit cards, passwords, blueprints, \ldots)\end{tabular}}
 \only<3>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright
 It prevents problems when passwords are stolen. Man-in-the-middle attacks
 still possible.\end{tabular}}
 \item<4->What other risks does the security solution cause?
 \only<4>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright Your mobile phone or credit card/pin might
-be stolen. SIM card become valuable.\end{tabular}}
+be stolen. SIM card becomes more valuable.\end{tabular}}
 \item<5->What costs and trade-offs does the security solution impose?
 \only<5>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright
 Banks need to establish an infrastructure. For you it might be inconvenient.\end{tabular}}
 \item<7>[]{\bf\large Yes!}
 \end{itemize}
 \item<4->What other risks does the security solution cause?
 \only<4>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright You might not notice tampering.\end{tabular}}
 \item<5->What costs and trade-offs does the security solution impose?
 \only<5>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright
 The ``hardware'' is cheap, but indirect costs can be quite high.\end{tabular}}
-\item<7>[]{\bf\large No!} {\textcolor{gray}{Though in some areas they work: airport, swimming pool}}
+\item<7>[]{\bf\large No!} {\textcolor{gray}{Though in some areas they work: airports, swimming pools, \ldots}}
 \end{itemize}
 \end{frame}}
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 \mode<presentation>{
 \begin{frame}[t]
-\frametitle{\begin{tabular}{@ {}c@ {}}Ex: Security by Obscurity\end{tabular}}
+\frametitle{\begin{tabular}{@ {}c@ {}}Ex: Security-by-Obscurity\end{tabular}}
 You might think it is a good idea to keep a security relevant algorithm or
 software secret.
 \begin{itemize}
 \item<1->What assets are you trying to protect?\\
-\only<1>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}source code, an algorithm\end{tabular}}
+\only<1>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}Source code, an algorithm and things that depend on it\end{tabular}}
 \item<2->What are the risks to these assets?\\
 \only<2>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright
 Can be pretty high (Oystercards).\end{tabular}}
 \item<3->How well does the security solution mitigate those risks?\\
 \only<3>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright
-Not really. The source code can be reverse engineered, stolen\ldots{}\end{tabular}}
+Not really. The source code can be reverse engineered, stolen, coerced \ldots{}\end{tabular}}
 \item<4->What other risks does the security solution cause?
 \only<4>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright You prevent
-scrutiny and independent advice. You also more likely than not
+scrutiny and independent advice. You also more likely than not to
 get it wrong.\end{tabular}}
 \item<5>[]{\bf\large No!}
 \end{itemize}
 {\small
 \begin{minipage}{5cm}\raggedright
 \begin{center}
 \begin{minipage}{4.5cm}
 \begin{itemize}
-\item The outcome matches with the voter intend.
+\item The outcome matches with the voters' intend.
-\item There might be gigantic sums at stake.
+\item There might be gigantic sums at stake and need to be defended against.
 \end{itemize}
 \end{minipage}
 \end{center}
 \end{minipage}};
 \end{tikzpicture}
 {\small
 \begin{minipage}{5cm}\raggedright
 \begin{center}
 \begin{minipage}{4.5cm}
 \begin{itemize}
-\item Only authorised voters should be able to vote up to the permitted number of votes.
+\item Authorised voters should have the opportunity to vote.
 \end{itemize}
 \end{minipage}
 \end{center}
 \end{minipage}};
 \end{tikzpicture}
 \end{center}
 \end{minipage}};
 \end{tikzpicture}
 \end{textblock}}
-\only<6>{
-\begin{textblock}{5.5}(8,5)
-\begin{tikzpicture}
-\draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm, text centered]
-{\small
-\begin{minipage}{5cm}\raggedright
-\begin{center}
-\begin{minipage}{4.5cm}
-\begin{itemize}
-\item Only authorised voters should be able to vote up to the permitted number of votes.
-\end{itemize}
-\end{minipage}
-\end{center}
-\end{minipage}};
-\end{tikzpicture}
-\end{textblock}}
 \end{frame}}
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 \mode<presentation>{
 \frametitle{\begin{tabular}{@ {}c@ {}}E-Voting\end{tabular}}
 \begin{itemize}
 \item The Netherlands between 1997 - 2006 had electronic voting machines\\
-\textcolor{gray}{(hacktivists had found that they could be hacked and emitted radio signals revealing how you voted)}
+\textcolor{gray}{(hacktivists had found: they can be hacked and also emitted radio signals revealing how you voted)}
 \item Germany had used them in pilot studies\\
 \textcolor{gray}{(in 2007 a law suit has reached the highest court and it rejected electronic voting
 on the grounds of not being understandable by the general public)}
 \begin{frame}[t]
 \frametitle{\begin{tabular}{@ {}c@ {}}E-Voting\end{tabular}}
 \mbox{}\\[-12mm]
 \begin{itemize}
-\item US used mechanical machines since the 50s, later punch cards, now DREs and
+\item US used mechanical machines since the 30s, later punch cards, now DREs and
 optical scan voting machines \textcolor{gray}{(fantastic ``ecosystem'' for study)}
-\item Estonia used in 2007 the world's first Internet vote in national elections (there are earlier pilot studies)
+\item Estonia used in 2007 the Internet for national elections
+\textcolor{gray}{(there were earlier pilot studies in other countries)}
 \item India uses e-voting devices  since at least 2003\\
 \textcolor{gray}{(``keep-it-simple'' machines produced by a government owned company)}
 \item South Africa used software for its tallying in the 1993 elections (when Nelson Mandela was elected)
 \textcolor{gray}{problems with vote buying / no ballot privacy}\bigskip
 \item French Revolution and the US Constitution got things ``started'' with
-paper ballots (you first had to bring your own, or later were pre-printed by the parties)
+paper ballots (you first had to bring your own; later they were pre-printed by parties)
 \end{itemize}
 \end{frame}}
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 \frametitle{\begin{tabular}{@ {}c@ {}}Ballot Boxes\end{tabular}}
 Security policies involved with paper ballots:
 \begin{enumerate}
-\item you need to check that the ballot box is empty at the start of the poll / no false bottom (ballot stuffing)
+\item you need to check that the ballot box is empty at the start of the poll / no false bottom (to prevent ballot stuffing)
-\item you need guard the ballot box during the poll
+\item you need to guard the ballot box during the poll until counting
-\item tallied by a team at the end of the poll (you can have observers)
+\item tallied by a team at the end of the poll (independent observers)
 \end{enumerate}
 \begin{center}
 \includegraphics[scale=1.5]{pics/ballotbox.jpg}
 \end{center}
 \mode<presentation>{
 \begin{frame}[c]
 \frametitle{\begin{tabular}{@ {}c@ {}}Lessons to be Learned\end{tabular}}
 \begin{itemize}
-\item keep a paper trail and try to keep this secure
+\item keep a paper trail and design your system to keep this secure\medskip
-\item make the software open source
+\item make the software open source (avoid security-by-obscurity))\medskip
 \item have a simple design in order to minimise the attack surface
 \end{itemize}
 \end{frame}}
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

changeset 49	1d37142ea1ea
parent 48	e1a5d057db96