93 \normalsize |
93 \normalsize |
94 \begin{center} |
94 \begin{center} |
95 \begin{tabular}{ll} |
95 \begin{tabular}{ll} |
96 Email: & christian.urban at kcl.ac.uk\\ |
96 Email: & christian.urban at kcl.ac.uk\\ |
97 Of$\!$fice: & S1.27 (1st floor Strand Building)\\ |
97 Of$\!$fice: & S1.27 (1st floor Strand Building)\\ |
98 Slides: & KEATS (also home work is there)\\ |
98 Slides: & KEATS (also home work is there) |
99 & \alert{\bf (I have put a temporary link in there.)}\\ |
|
100 \end{tabular} |
99 \end{tabular} |
101 \end{center} |
100 \end{center} |
102 |
101 |
103 |
102 |
104 \end{frame}} |
103 \end{frame}} |
105 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
104 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
106 |
105 |
107 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
106 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
108 \mode<presentation>{ |
107 \mode<presentation>{ |
109 \begin{frame}[c] |
108 \begin{frame}[c] |
|
109 \frametitle{\begin{tabular}{c}Homework\end{tabular}} |
|
110 |
|
111 |
|
112 \ldots{} I have a question about the homework.\\[3mm] |
|
113 Is it required to submit the homework before\\ |
|
114 the next lecture?\\[5mm] |
|
115 |
|
116 Thank you!\\ |
|
117 Anonymous |
|
118 |
|
119 \end{frame}} |
|
120 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
121 |
|
122 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
123 \mode<presentation>{ |
|
124 \begin{frame}[c] |
110 |
125 |
111 \begin{center} |
126 \begin{center} |
112 \includegraphics[scale=0.45]{pics/trainwreck.jpg}\\ |
127 \begin{tabular}[t]{c} |
113 one general defence mechanism is\\\alert{\bf defence in depth} |
128 \includegraphics[scale=1.2]{pics/barrier.jpg}\\ |
|
129 future lectures |
|
130 \end{tabular}\;\;\; |
|
131 \onslide<2>{ |
|
132 \begin{tabular}[t]{c} |
|
133 \includegraphics[scale=0.32]{pics/trainwreck.jpg}\\ |
|
134 today |
|
135 \end{tabular} |
|
136 } |
114 \end{center} |
137 \end{center} |
115 |
138 |
116 |
139 |
117 \end{frame}} |
140 \end{frame}} |
118 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
141 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
119 |
142 |
120 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
143 |
121 \mode<presentation>{ |
144 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
122 \begin{frame}<1-2>[c] |
145 \mode<presentation>{ |
123 \frametitle{Defence in Depth} |
146 \begin{frame}[c] |
124 |
147 \frametitle{\begin{tabular}{@ {}c@ {}}SmartWater\end{tabular}} |
125 \begin{itemize} |
148 |
126 \item \alt<1>{overlapping}{{\LARGE\bf overlapping}} systems designed to provide\\ security even if one of them fails. |
149 \begin{textblock}{1}(1,3) |
127 \end{itemize} |
150 \begin{tabular}{c} |
128 |
151 \includegraphics[scale=0.15]{pics/SmartWater} |
129 \only<2->{ |
152 \end{tabular} |
130 \begin{textblock}{11}(2,12) |
153 \end{textblock} |
131 \small otherwise your ``added security'' can become the point of failure |
154 |
132 \end{textblock}} |
155 |
133 |
156 \begin{textblock}{8.5}(7,3) |
134 \end{frame}} |
157 \begin{itemize} |
135 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
158 \item seems helpful for preventing cable theft\medskip |
136 |
159 \item wouldn't be helpful to make your property safe, because of possible abuse\medskip |
137 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
160 |
138 \mode<presentation>{ |
161 \item security is always a tradeoff |
139 \begin{frame}[c] |
162 \end{itemize} |
140 \frametitle{PALs} |
163 \end{textblock} |
141 |
164 |
142 \begin{itemize} |
165 \end{frame}} |
143 \item \alert{Permissive Action Links} prevent unauthorised use of nuclear weapons (so the theory) |
166 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
144 \end{itemize} |
167 |
145 |
168 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
146 \begin{center} |
169 \mode<presentation>{ |
147 \includegraphics[scale=0.25]{pics/nuclear1.jpg}\hspace{3mm} |
170 \begin{frame}[c] |
148 \includegraphics[scale=0.25]{pics/nuclear2.jpg} |
171 \frametitle{\begin{tabular}{@ {}c@ {}}Plain-text Passwords at IEEE\end{tabular}} |
149 \end{center} |
172 |
150 |
173 \small\textcolor{gray}{On 25 September 2012, a report on a data breach at IEEE:} |
151 |
174 |
152 \onslide<3->{ |
175 |
153 modern PALs also include a 2-person rule |
176 \begin{itemize} |
154 } |
177 \item IEEE is a standards organisation (not-for-profit) |
155 |
178 \item many standards in CS are by IEEE\medskip |
156 \only<2->{ |
179 \item 100k plain-text passwords were recorded in logs |
|
180 \item the logs were openly accessible on their FTP server |
|
181 \end{itemize}\bigskip |
|
182 |
|
183 \begin{flushright}\small |
|
184 \textcolor{gray}{\url{http://ieeelog.com}} |
|
185 \end{flushright} |
|
186 |
|
187 \only<2>{ |
157 \begin{textblock}{11}(3,2) |
188 \begin{textblock}{11}(3,2) |
158 \begin{tikzpicture} |
189 \begin{tikzpicture} |
159 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
190 \draw (0,0) node[inner sep=2mm,fill=white, ultra thick, draw=red, rounded corners=2mm] |
160 {\begin{minipage}{8cm} |
191 {\normalsize\color{darkgray} |
161 US Air Force's Strategic Air Command worried that in times of need the |
192 \begin{minipage}{7.5cm}\raggedright\small |
162 codes would not be available, so until 1977 quietly decided to set them |
193 \includegraphics[scale=0.6]{pics/IEEElog.jpg} |
163 to 00000000\ldots |
|
164 \end{minipage}}; |
194 \end{minipage}}; |
165 \end{tikzpicture} |
195 \end{tikzpicture} |
166 \end{textblock}} |
196 \end{textblock}} |
167 |
197 |
168 |
198 \end{frame}} |
169 \end{frame}} |
199 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
170 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
200 |
171 |
201 |
172 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
202 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
173 \mode<presentation>{ |
203 \mode<presentation>{ |
174 \begin{frame}[c] |
204 \begin{frame}[c] |
175 |
205 \frametitle{\begin{tabular}{@ {}c@ {}}Virgin Mobile (USA)\end{tabular}} |
176 \begin{itemize} |
206 |
177 \item until 1998, Britain had nuclear weapons that could be launched from airplanes\bigskip\pause |
207 \begin{flushright}\small |
178 |
208 \textcolor{gray}{\url{http://arstechnica.com/security/2012/09/virgin-mobile-password-crack-risk/}} |
179 \item these weapons were armed with a bicycle key |
209 \end{flushright} |
180 |
210 |
|
211 \begin{itemize} |
|
212 \item for online accounts passwords must be 6 digits |
|
213 \item you must cycle through 1M combinations (online)\pause\bigskip |
|
214 |
|
215 \item he limited the attack on his own account to 1 guess per second, \alert{\bf and} |
|
216 \item wrote a script that cleared the cookie set after each guess\pause |
|
217 \item has been fixed now |
|
218 \end{itemize} |
|
219 |
|
220 |
|
221 |
|
222 \end{frame}} |
|
223 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
224 |
|
225 |
|
226 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
227 \mode<presentation>{ |
|
228 \begin{frame}[c] |
|
229 \frametitle{\begin{tabular}{@ {}c@ {}}Smash the Stack for Fun \ldots\end{tabular}} |
|
230 |
|
231 \begin{itemize} |
|
232 \item ``smashing the stack attacks'' or ``buffer overflow attacks'' |
|
233 \item one of the most popular attacks;\\ attack of the (last) decade\\ ($>$ 50\% of security incidents reported at CERT are related to buffer overflows) |
|
234 \begin{flushright}\small |
|
235 \textcolor{gray}{\url{http://www.kb.cert.org/vuls}} |
|
236 \end{flushright} |
|
237 \medskip |
|
238 \item made popular in an article by Elias Levy\\ (also known as Aleph One):\\ |
181 \begin{center} |
239 \begin{center} |
182 \begin{tabular}[b]{c} |
240 {\bf ``Smashing The Stack For Fun and Profit''} |
183 \includegraphics[scale=1.05]{pics/britkeys1.jpg}\\ |
241 \end{center}\medskip |
184 \small nuclear weapon keys |
242 |
185 \end{tabular} |
243 \begin{flushright} |
186 \hspace{3mm} |
244 \small\textcolor{gray}{\url{http://www.phrack.org}, Issue 49, Article 14} |
187 \begin{tabular}[b]{c} |
245 \end{flushright} |
188 \includegraphics[scale=0.35]{pics/britkeys2.jpg}\\ |
|
189 \small bicycle lock |
|
190 \end{tabular} |
|
191 \end{center}\bigskip\pause |
|
192 |
|
193 \item the current Trident nuclear weapons can be launched from a submarine without any code being transmitted |
|
194 \end{itemize} |
|
195 |
|
196 \end{frame}} |
|
197 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
198 |
|
199 |
|
200 |
|
201 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
202 \mode<presentation>{ |
|
203 \begin{frame}[c] |
|
204 \frametitle{Access Control in Unix} |
|
205 |
|
206 \begin{itemize} |
|
207 \item access control provided by the OS |
|
208 \item authenticate principals (login) |
|
209 \item mediate access to files, ports, processes according to \alert{roles} (user ids)\\ |
|
210 \item roles get attached with privileges\bigskip\\% |
|
211 \hspace{8mm} |
|
212 \begin{tikzpicture} |
|
213 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
|
214 {\begin{minipage}{8cm} |
|
215 \alert{principle of least privilege:}\\ |
|
216 programs should only have as much privilege as they need |
|
217 \end{minipage}}; |
|
218 \end{tikzpicture} |
|
219 \end{itemize} |
|
220 |
|
221 \end{frame}} |
|
222 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
223 |
|
224 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
225 \mode<presentation>{ |
|
226 \begin{frame}[c] |
|
227 \frametitle{Access Control in Unix (2)} |
|
228 |
|
229 \begin{itemize} |
|
230 \item the idea is to restrict access to files and therefore lower the consequences of an attack\\[1cm]\mbox{} |
|
231 \end{itemize} |
|
232 |
|
233 \begin{textblock}{1}(2.5,9.5) |
|
234 \begin{tikzpicture}[scale=1] |
|
235 |
|
236 \draw[line width=1mm] (-.3, 0) rectangle (1.5,2); |
|
237 \draw (4.7,1) node {Internet}; |
|
238 \draw (0.6,1.7) node {\footnotesize Interface}; |
|
239 \draw (0.6,-0.4) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] process\end{tabular}}; |
|
240 \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}}; |
|
241 |
|
242 \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2); |
|
243 |
|
244 \draw[white] (1.7,1) node (X) {}; |
|
245 \draw[white] (3.7,1) node (Y) {}; |
|
246 \draw[red, <->, line width = 2mm] (X) -- (Y); |
|
247 |
246 |
248 \draw[red, <->, line width = 1mm] (-0.6,1) -- (-1.6,1); |
247 \end{itemize} |
249 \end{tikzpicture} |
248 |
250 \end{textblock} |
249 |
251 |
250 \end{frame}} |
252 \end{frame}} |
251 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
253 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
252 |
254 |
253 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
255 |
254 \mode<presentation>{ |
256 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
255 \begin{frame}[c] |
257 \mode<presentation>{ |
256 \frametitle{\begin{tabular}{c}The Problem\end{tabular}} |
258 \begin{frame}[t] |
257 |
259 \frametitle{Process Ownership} |
258 \begin{itemize} |
260 |
259 \item The basic problem is that library routines in C look as follows: |
261 \begin{itemize} |
|
262 \item access control in Unix is very coarse |
|
263 \end{itemize}\bigskip\bigskip\bigskip |
|
264 |
|
265 \begin{center} |
260 \begin{center} |
266 \begin{tabular}{c} |
261 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
267 root\\ |
262 \texttt{\lstinputlisting{../progs/app5.c}}} |
268 \hline |
263 \end{center} |
269 |
264 \item the resulting problems are often remotely exploitable |
270 user$_1$ user$_2$ \ldots www, mail, lp |
265 \item can be used to circumvents all access control |
271 \end{tabular} |
266 (botnets for further attacks) |
272 \end{center}\bigskip\bigskip\bigskip |
267 \end{itemize} |
273 |
268 |
274 |
269 \end{frame}} |
275 \textcolor{gray}{\small root has UID $=$ 0}\\\pause |
270 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
276 \textcolor{gray}{\small you also have groups that can share access to a file}\\ |
271 |
277 \textcolor{gray}{\small but it is difficult to exclude access selectively}\\ |
272 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
278 \end{frame}} |
273 \mode<presentation>{ |
279 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
274 \begin{frame}[c] |
280 |
275 \frametitle{\begin{tabular}{c}Variants\end{tabular}} |
281 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
276 |
282 \mode<presentation>{ |
277 There are many variants: |
283 \begin{frame}[c] |
278 |
284 \frametitle{Access Control in Unix (2)} |
279 \begin{itemize} |
285 |
280 \item return-to-lib-C attacks |
286 |
281 \item heap-smashing attacks\\ |
287 \begin{itemize} |
282 \textcolor{gray}{\small(Slammer Worm in 2003 infected 90\% of vulnerable systems within 10 minutes)}\bigskip |
288 \item privileges are specified by file access permissions (``everything is a file'') |
283 |
289 \item there are 9 (plus 2) bits that specify the permissions of a file |
284 \item ``zero-days-attacks'' (new unknown vulnerability) |
|
285 \end{itemize} |
|
286 |
|
287 \end{frame}} |
|
288 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
289 |
|
290 |
|
291 |
|
292 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
293 \mode<presentation>{ |
|
294 \begin{frame}[c] |
|
295 |
|
296 \small |
|
297 \texttt{my\_float} is printed twice:\bigskip |
|
298 |
|
299 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
|
300 \texttt{\lstinputlisting{../progs/C1.c}}} |
|
301 |
|
302 |
|
303 \end{frame}} |
|
304 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
305 |
|
306 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
307 \mode<presentation>{ |
|
308 \begin{frame}[c] |
290 |
309 |
291 \begin{center} |
310 \begin{center} |
292 \begin{tabular}{l} |
311 \only<1>{\includegraphics[scale=0.9]{pics/stack1}\;\;} |
293 \texttt{\$ ls - la}\\ |
312 \only<2>{\includegraphics[scale=0.9]{pics/stack2}\;\;} |
294 \texttt{-rwxrw-r-{}- \hspace{3mm} foo\_file.txt} |
313 \only<3>{\includegraphics[scale=0.9]{pics/stack3}\;\;} |
295 \end{tabular} |
|
296 \end{center} |
314 \end{center} |
297 \end{itemize} |
315 |
298 |
316 |
299 \end{frame}} |
317 \end{frame}} |
300 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
318 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
301 |
319 |
302 |
320 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
303 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
321 \mode<presentation>{ |
304 \mode<presentation>{ |
322 \begin{frame}[c] |
305 \begin{frame}[c] |
323 |
306 \frametitle{Login Process} |
324 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
307 |
325 \texttt{\lstinputlisting{../progs/C2.c}}} |
308 |
326 |
309 \begin{itemize} |
327 |
310 \item login processes run under UID $=$ 0\medskip |
328 \end{frame}} |
|
329 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
330 |
|
331 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
332 \mode<presentation>{ |
|
333 \begin{frame}[c] |
|
334 |
|
335 \small |
|
336 A programmer might be careful, but still introduce vulnerabilities:\bigskip |
|
337 |
|
338 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
|
339 \texttt{\lstinputlisting{../progs/C2a.c}}} |
|
340 |
|
341 |
|
342 \end{frame}} |
|
343 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
344 |
|
345 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
346 \mode<presentation>{ |
|
347 \begin{frame}[c] |
|
348 \frametitle{\begin{tabular}{c}Payloads\end{tabular}} |
|
349 |
|
350 \begin{itemize} |
|
351 \item the idea is you store some code as part to the buffer |
|
352 \item you then override the return address to execute this payload\medskip |
|
353 \item normally you start a root-shell\pause |
|
354 \item difficulty is to guess the right place where to ``jump'' |
|
355 \end{itemize} |
|
356 |
|
357 \end{frame}} |
|
358 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
359 |
|
360 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
361 \mode<presentation>{ |
|
362 \begin{frame}[c] |
|
363 \frametitle{\begin{tabular}{c}Payloads (2)\end{tabular}} |
|
364 |
|
365 \begin{itemize} |
|
366 \item another difficulty is that the code is not allowed to contain \texttt{$\backslash$x00}: |
|
367 |
311 \begin{center} |
368 \begin{center} |
312 \texttt{ps -axl | grep login} |
369 \texttt{xorl \%eax, \%eax} |
313 \end{center}\medskip |
|
314 |
|
315 \item after login, shells run under UID $=$ user (e.g.~501)\medskip |
|
316 \begin{center} |
|
317 \texttt{id cu} |
|
318 \end{center}\medskip\pause |
|
319 |
|
320 \item non-root users are not allowed to change the UID --- would break |
|
321 access control |
|
322 \item but needed for example for \texttt{passwd} |
|
323 \end{itemize} |
|
324 |
|
325 \end{frame}} |
|
326 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
327 |
|
328 |
|
329 |
|
330 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
331 \mode<presentation>{ |
|
332 \begin{frame}[c] |
|
333 \frametitle{Setuid and Setgid} |
|
334 |
|
335 The solution is that unix file permissions are 9 + \underline{2 Bits}: |
|
336 \alert{Setuid} and \alert{Setgid} Bits |
|
337 |
|
338 \begin{itemize} |
|
339 \item When a file with setuid is executed, the resulting process will assume the UID given to the owner of the file. |
|
340 \item This enables users to create processes as root (or another user).\bigskip |
|
341 |
|
342 \item Essential for changing passwords, for example. |
|
343 \end{itemize} |
|
344 |
|
345 \begin{center} |
|
346 \texttt{chmod 4755 fobar\_file} |
|
347 \end{center} |
370 \end{center} |
348 |
371 \end{itemize}\bigskip\bigskip |
349 \end{frame}} |
372 |
350 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
373 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
351 |
374 \texttt{\lstinputlisting{../progs/app5.c}}} |
352 |
375 |
353 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
376 \end{frame}} |
354 \mode<presentation>{ |
377 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
355 \begin{frame}[c] |
378 |
356 \frametitle{\begin{tabular}{c}Privilege Separation in\\ OpenSSH\end{tabular}} |
379 |
357 |
380 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
358 \begin{center} |
381 \mode<presentation>{ |
359 \begin{tikzpicture}[scale=1] |
382 \begin{frame}[c] |
360 |
383 \frametitle{\begin{tabular}{c}Format String Vulnerability\end{tabular}} |
361 \draw[line width=1mm] (0, 1.1) rectangle (1.2,2); |
384 |
362 \draw (4.7,1) node {Internet}; |
385 \small |
363 \draw (0.6,1.7) node {\footnotesize Slave}; |
386 \texttt{string} is nowhere used:\bigskip |
364 \draw[line width=1mm] (0, 0) rectangle (1.2,0.9); |
387 |
365 \draw (0.6,1.7) node {\footnotesize Slave}; |
388 {\lstset{language=Java}\fontsize{8}{10}\selectfont% |
366 \draw (0.6,0.6) node {\footnotesize Slave}; |
389 \texttt{\lstinputlisting{../progs/C4.c}}}\bigskip |
367 \draw (0.6,-0.5) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] processes\end{tabular}}; |
390 |
368 \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}}; |
391 this vulnerability can be used to read out the stack |
369 |
392 |
370 \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2); |
393 \end{frame}} |
371 \draw (-2.9,1.7) node {\footnotesize Monitor}; |
394 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
372 |
395 |
373 \draw[white] (1.7,1) node (X) {}; |
396 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
374 \draw[white] (3.7,1) node (Y) {}; |
397 \mode<presentation>{ |
375 \draw[red, <->, line width = 2mm] (X) -- (Y); |
398 \begin{frame}[c] |
376 |
399 \frametitle{\begin{tabular}{c}Protections against BO Attacks\end{tabular}} |
377 \draw[red, <->, line width = 1mm] (-0.4,1.4) -- (-1.4,1.1); |
400 |
378 \draw[red, <->, line width = 1mm] (-0.4,0.6) -- (-1.4,0.9); |
401 \begin{itemize} |
379 |
402 \item use safe library functions |
380 \end{tikzpicture} |
403 \item ensure stack data is not executable (can be defeated) |
381 \end{center} |
404 \item address space randomisation (makes one-size-fits-all more difficult) |
382 |
405 \item choice of programming language (one of the selling points of Java) |
383 \begin{itemize} |
406 |
384 \item pre-authorisation slave |
407 \end{itemize} |
385 \item post-authorisation\bigskip |
408 |
386 \item 25\% codebase is privileged, 75\% is unprivileged |
409 \end{frame}} |
387 \end{itemize} |
410 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
388 \end{frame}} |
411 |
389 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
412 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
390 |
413 \mode<presentation>{ |
391 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
414 \begin{frame}[c] |
392 \mode<presentation>{ |
415 \frametitle{\begin{tabular}{c}Security Goals\end{tabular}} |
393 \begin{frame}[c] |
416 |
394 \frametitle{Network Applications} |
417 \begin{itemize} |
395 |
418 \item Prevent common vulnerabilities from occurring (e.g. buffer overflows)\pause |
396 ideally network application in Unix should be designed as follows: |
419 \item Recover from attacks (traceability and auditing of security-relevant actions)\pause |
397 |
420 \item Monitoring (detect attacks)\pause |
398 \begin{itemize} |
421 \item Privacy, confidentiality, anonymity (to protect secrets)\pause |
399 \item need two distinct processes |
422 \item Authenticity (needed for access control)\pause |
400 \begin{itemize} |
423 \item Integrity (prevent unwanted modification or tampering)\pause |
401 \item one that listens to the network; has no privilege |
424 \item Availability and reliability (reduce the risk of DoS attacks) |
402 \item one that is privileged and listens to the latter only (but does not trust it) |
425 \end{itemize} |
403 |
426 |
404 \end{itemize} |
427 \end{frame}} |
405 |
428 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
406 \item to implement this you need a parent process, which forks a child process |
429 |
407 \item this child process drops privileges and listens to hostile data\medskip |
430 |
408 |
431 |
409 \item after authentication the parent forks again and the new child becomes the user |
432 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
410 \end{itemize} |
433 \mode<presentation>{ |
411 |
434 \begin{frame}[c] |
412 |
435 \frametitle{\begin{tabular}{c}Homework\end{tabular}} |
413 \end{frame}} |
436 |
414 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
437 \begin{itemize} |
415 |
438 \item Assume format string attacks allow you to read out the stack. What can you do |
416 |
439 with this information?\bigskip |
417 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
440 |
418 \mode<presentation>{ |
441 \item Assume you can crash a program remotely. Why is this a problem? |
419 \begin{frame}[c] |
442 \end{itemize} |
420 \frametitle{\begin{tabular}{@ {}c@ {}}Famous Security Flaws in Unix\end{tabular}} |
443 |
421 |
|
422 |
|
423 \begin{itemize} |
|
424 \item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause\pause |
|
425 \item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause |
|
426 \item \texttt{mkdir foo} is owned by root\medskip |
|
427 \begin{center} |
|
428 \texttt{-rwxr-xr-x 1 root wheel /bin/mkdir} |
|
429 \end{center}\medskip |
|
430 it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (automated with a shell script)} |
|
431 \end{itemize} |
|
432 |
|
433 \only<1>{ |
|
434 \begin{textblock}{1}(3,3) |
|
435 \begin{tikzpicture} |
|
436 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
|
437 {\begin{minipage}{8cm} |
|
438 Only failure makes us experts. |
|
439 -- Theo de Raadt (OpenBSD, OpenSSH) |
|
440 \end{minipage}}; |
|
441 \end{tikzpicture} |
|
442 \end{textblock}} |
|
443 |
|
444 |
|
445 |
|
446 \end{frame}} |
|
447 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
448 |
|
449 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
450 \mode<presentation>{ |
|
451 \begin{frame}[c] |
|
452 \frametitle{\begin{tabular}{@ {}c@ {}}Other Problems\end{tabular}} |
|
453 |
|
454 There are thing's you just cannot solve on the programming side:\bigskip |
|
455 |
|
456 \begin{itemize} |
|
457 \item for system maintenance you often have \texttt{cron}-jobs cleaning \texttt{/tmp}\medskip |
|
458 \begin{itemize} |
|
459 \item attacker:\\ |
|
460 \texttt{mkdir /tmp/a; cat > /tmp/a/passwd} |
|
461 \item root:\\\texttt{rm /tmp/*/*}: |
|
462 \item attacker:\\ |
|
463 \texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a} |
|
464 \end{itemize} |
|
465 \end{itemize} |
|
466 |
|
467 \end{frame}} |
|
468 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
469 |
|
470 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
471 \mode<presentation>{ |
|
472 \begin{frame}[c] |
|
473 \frametitle{\begin{tabular}{@ {}c@ {}}Security Levels\end{tabular}} |
|
474 |
|
475 Unix essentially can only distinguish between two security levels (root and non-root). |
|
476 |
|
477 \begin{itemize} |
|
478 \item In military applications you often have many security levels (top-secret, secret, confidential, unclassified)\bigskip\pause |
|
479 |
|
480 \item Information flow: Bell --- La Padula model |
|
481 |
|
482 \begin{itemize} |
|
483 \item read: your own level and below |
|
484 \item write: your own level and above |
|
485 \end{itemize} |
|
486 \end{itemize} |
|
487 |
|
488 \end{frame}} |
|
489 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
490 |
|
491 |
|
492 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
493 \mode<presentation>{ |
|
494 \begin{frame}[c] |
|
495 \frametitle{\begin{tabular}{@ {}c@ {}}Security Levels (2)\end{tabular}} |
|
496 |
|
497 \begin{itemize} |
|
498 \item Bell --- La Padula preserves data secrecy, but not data integrity\bigskip\pause |
|
499 |
|
500 \item Biba model is for data integrity |
|
501 |
|
502 \begin{itemize} |
|
503 \item read: your own level and above |
|
504 \item write: your own level and below |
|
505 \end{itemize} |
|
506 \end{itemize} |
|
507 |
|
508 \end{frame}} |
|
509 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
510 |
|
511 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
512 \mode<presentation>{ |
|
513 \begin{frame}[c] |
|
514 \frametitle{\begin{tabular}{@ {}c@ {}}Access Control in 2000\end{tabular}} |
|
515 |
|
516 According to Ross Anderson (1st edition of his book), some senior Microsoft people held the |
|
517 following view: |
|
518 |
|
519 \begin{center} |
|
520 \begin{tikzpicture} |
|
521 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
|
522 {\begin{minipage}{10.5cm} |
|
523 \small Access control does not matter. Computers are becoming single-purpose |
|
524 or single-user devices. Single-purpose devices, such as Web servers that deliver a single service, don't |
|
525 need much in the way of access control as there's nothing for operating system access controls |
|
526 to do; the job of separating users from each other is best left to application code. As for the PC |
|
527 on your desk, if all the software on it comes from a single source, then again there's no need |
|
528 for the operating system to provide separation. \hfill{}\textcolor{gray}{(in 2000)} |
|
529 \end{minipage}}; |
|
530 \end{tikzpicture} |
|
531 \end{center} |
|
532 |
|
533 \end{frame}} |
|
534 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
535 |
|
536 |
|
537 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
538 \mode<presentation>{ |
|
539 \begin{frame}[t] |
|
540 \frametitle{\begin{tabular}{@ {}c@ {}}Research Problems\end{tabular}} |
|
541 |
|
542 \begin{itemize} |
|
543 \item with access control we are back to 1970s\bigskip |
|
544 |
|
545 \only<1>{ |
|
546 \begin{tikzpicture} |
|
547 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
|
548 {\begin{minipage}{10cm} |
|
549 \small Going all the way back to early time-sharing systems we systems people regarded the users, and any code they wrote, as the mortal enemies of us and each other. We were like the police force in a violent slum.\\ |
|
550 \mbox{}\hfill--- Roger Needham |
|
551 \end{minipage}}; |
|
552 \end{tikzpicture}}\pause |
|
553 |
|
554 \item the largest research area in access control in 2000-07 has been ``Trusted Computing'', but thankfully it |
|
555 is dead now\bigskip |
|
556 \item a useful research area is to not just have robust access control, but also usable access control --- by programmers and users\\ |
|
557 (one possible answer is operating system virtualisation, e.g.~Xen, VMWare)\medskip\pause |
|
558 |
|
559 \item electronic voting |
|
560 \end{itemize} |
|
561 \end{frame}} |
|
562 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
563 |
|
564 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
565 \mode<presentation>{ |
|
566 \begin{frame}[t] |
|
567 \frametitle{\begin{tabular}{@ {}c@ {}}Mobile OS\end{tabular}} |
|
568 |
|
569 \begin{itemize} |
|
570 \item iOS and Android solve the defence-in-depth problem by \alert{sandboxing} applications\bigskip |
|
571 |
|
572 \item you as developer have to specify the resources an application needs |
|
573 \item the OS provides a sandbox where access is restricted to only these resources |
|
574 \end{itemize} |
|
575 \end{frame}} |
|
576 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
577 |
|
578 |
|
579 |
|
580 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
581 \mode<presentation>{ |
|
582 \begin{frame}[c] |
|
583 \frametitle{\begin{tabular}{@ {}c@ {}}Security Theatre\end{tabular}} |
|
584 |
|
585 |
|
586 Security theatre is the practice of investing in countermeasures intended to provide the |
|
587 \underline{feeling} of improved security while doing little or nothing to actually achieve it.\hfill{}\textcolor{gray}{Bruce Schneier} |
|
588 |
|
589 \end{frame}} |
|
590 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
591 |
|
592 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
593 \mode<presentation>{ |
|
594 \begin{frame}[c] |
|
595 \frametitle{\begin{tabular}{@ {}c@ {}}Security Theatre\end{tabular}} |
|
596 |
|
597 \begin{itemize} |
|
598 \item for example, usual locks and strap seals are security theatre |
|
599 \end{itemize} |
|
600 |
|
601 \begin{center} |
|
602 \includegraphics[scale=0.45]{pics/seal.jpg} |
|
603 \end{center} |
|
604 |
|
605 |
|
606 \end{frame}} |
|
607 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
608 |
|
609 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
610 \mode<presentation>{ |
|
611 \begin{frame}[c] |
|
612 |
|
613 \begin{minipage}{11cm} |
|
614 From: Ross Anderson <Ross.Anderson@cl.cam.ac.uk>\\ |
|
615 To: cl-security-research@lists.cam.ac.uk\\ |
|
616 Subject: Tip off\\ |
|
617 Date: Tue, 02 Oct 2012 13:12:50 +0100\\ |
|
618 |
|
619 I received the following tip off, and have removed the sender's |
|
620 coordinates. I suspect it is one of many security vendors who |
|
621 don't even get the basics right; if you ever go to the RSA |
|
622 conference, there are a thousand such firms in the hall, each |
|
623 with several eager but ignorant salesmen. A trying experience.\\ |
|
624 |
|
625 Ross |
|
626 \end{minipage} |
|
627 |
|
628 \end{frame}} |
|
629 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
630 |
|
631 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
632 \mode<presentation>{ |
|
633 \begin{frame}[c] |
|
634 |
|
635 \begin{minipage}{11cm} |
|
636 I'd like to anonymously tip you off about this\\ |
|
637 product:\\ |
|
638 |
|
639 {\small http://www.strongauth.com/products/key-appliance.html}\\ |
|
640 |
|
641 It sounds really clever, doesn't it?\\ |
|
642 \ldots\\ |
|
643 |
|
644 Anyway, it occurred to me that you and your colleagues might have a |
|
645 field day discovering weaknesses in the appliance and their |
|
646 implementation of security. However, whilst I'd be willing to help |
|
647 and/or comment privately, it'd have to be off the record ;-) |
|
648 \end{minipage} |
|
649 |
|
650 \end{frame}} |
|
651 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
652 |
|
653 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
654 \mode<presentation>{ |
|
655 \begin{frame}[c] |
|
656 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 1\end{tabular}} |
|
657 |
|
658 {\bf What assets are you trying to protect?}\bigskip |
|
659 |
|
660 This question might seem basic, but a surprising number of people never ask it. The question involves understanding the scope of the problem. For example, securing an airplane, an airport, commercial aviation, the transportation system, and a nation against terrorism are all different security problems, and require different solutions. |
|
661 |
|
662 \only<2>{ |
|
663 \begin{tikzpicture} |
|
664 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] |
|
665 {\begin{minipage}{10cm} |
|
666 \small You like to prevent: ``It would be terrible if this sort of attack ever happens; we need to do everything in our power to prevent it.'' |
|
667 \end{minipage}}; |
|
668 \end{tikzpicture}} |
|
669 \end{frame}} |
|
670 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
671 |
|
672 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
673 \mode<presentation>{ |
|
674 \begin{frame}[c] |
|
675 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 2\end{tabular}} |
|
676 |
|
677 {\bf What are the risks to these assets?}\bigskip |
|
678 |
|
679 Here we consider the need for security. Answering it involves understanding what is being defended, what the consequences are if it is successfully attacked, who wants to attack it, how they might attack it, and why. |
|
680 |
|
681 \end{frame}} |
|
682 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
683 |
|
684 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
685 \mode<presentation>{ |
|
686 \begin{frame}[c] |
|
687 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 3\end{tabular}} |
|
688 |
|
689 {\bf How well does the security solution mitigate those risks?}\bigskip |
|
690 |
|
691 Another seemingly obvious question, but one that is frequently ignored. If the security solution doesnŐt solve the problem, it's no good. This is not as simple as looking at the security solution and seeing how well it works. It involves looking at how the security solution interacts with everything around it, evaluating both its operation and its failures. |
|
692 |
|
693 \end{frame}} |
|
694 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
695 |
|
696 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
697 \mode<presentation>{ |
|
698 \begin{frame}[c] |
|
699 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 4\end{tabular}} |
|
700 |
|
701 {\bf What other risks does the security solution cause?}\bigskip |
|
702 |
|
703 This question addresses what might be called the problem of unintended consequences. Security solutions have ripple effects, and most cause new security problems. The trick is to understand the new problems and make sure they are smaller than the old ones. |
|
704 |
|
705 \end{frame}} |
|
706 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
707 |
|
708 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
|
709 \mode<presentation>{ |
|
710 \begin{frame}[c] |
|
711 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 5\end{tabular}} |
|
712 |
|
713 {\bf What costs and trade-offs does the security solution impose?}\bigskip |
|
714 |
|
715 Every security system has costs and requires trade-offs. Most security costs money, sometimes substantial amounts; but other trade-offs may be more important, ranging from matters of convenience and comfort to issues involving basic freedoms like privacy. Understanding these trade-offs is essential. |
|
716 |
|
717 \end{frame}} |
444 \end{frame}} |
718 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
445 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% |
719 |
446 |
720 |
447 |
721 \end{document} |
448 \end{document} |