e-Security

RNING OBJECTIVES
r reading tl11s chapter, you should be able to:
Understand the goals of information sec.unty.
Explain the me!hods us:d for defense againsl attack on c:ompuu•r s ._#.
Describe 1he different kinds of attacks on computer system,
Understand the firewalls and why do we need them
Understand the enterprise-wide security system.
Describe the encryption techniques used 111 secure transaction
Understand digital signatures and how they are used.

. n Bahree, 24, from New Dehli sold a CD containing the confidenta d-"ta• ct
sh bank accounts to an undercover reporter from the UK ba,ed ne-,,,N,p,er ' He
an employee of the calI centre called Infinity eSearch. ..\cc.ord rig lo Tb? 5.r.
at1on, which 111cludes addresses, passwords, phone number dJld dn, I\\', se .nf
ort details, Was purchased for £3 per customer F1nant1al 1ns11tut1on, ,uch ...
5 TSB, 1he Nationwide and HSBC were artPded A. i:all c.en1re 1, a rentra azi!'ll
1

for lhi, purpo e of rPct>1ving and 1ransmitting a largt' \Olurne of re,.:iue,•,b

Y call <.entrPs havP bf'en built 111 (lpvel()p1ng rountr1e lil-.t> lnwa t,e.c-au., ct chNP
r. This medn that th<• 1 ornpanie gf't dwc1p 1.111d ,md l.1b,.1ur and can bes.et:!
1 11
grant\ to Pnc our.;gP 1lwn1 tel improve• l•n,ployn1t•nt 111 .i S \ t' att',l

T LAW New,. 27/01/200<>

199
 200

Information System Security

An) husmc,. . "hether il1:-. :i tradilional hrick-and-mortarhusrncss.11bnd, -an,I the'
or 3 pure-pla) e-bul.ine:-
. . . needs to be concerned aboutnetwork \ecunty. fh 'e-bq
.
rn,t
1· ,hcnetwork
h cons1 su ng ousan s pn vate computer nctworl... c.:onne c lnttrn -
o l
d f ·' .
o
r· · c.:t·
· '- lugct....
means thata pnvate computer " fr ,
network sys
top .t, e._ m isthrexposed otcntral thrcal om .inyv.
. .
.
(ln the pubhc network. Protecuon agrunsc uiese eats requireshusrne scs In h 5

unty mea:.ures in place. ln the physical world, crimes often leave evidence- : 2 lnilacnr
footprinb.. v.'imcsses. video on security cameras and so on. Online. a c'J-bcr-c.:nm.-\feler,a,,
physical. electronic evidence, but unless good securiry measures arc taken. 11 m.iy he difii
co trace the source of a cyber-crime. Utub
As seen i-n Figure 5.1, lhe goals of security are:
1. lntegntiy of the data sent and received.
2. Confidentiality of the dat.1 so lhat h is not accessible to others.
3. The data ought to be available ro the people for whom it i meant.

Availabillty

Figure S.1 Secun1y goal,.

WillloAuta ·anF. igun: 5.2, the <law ,,;111 lrnm the sour,·,· ought I\I r,•,11.'11 Ill .J,•,un,r""'
mown
may 3
ng Wi shown inhgure 'i.2(.i). Out thl.' nt>11vc .:ntc11atiown 111 H.i:us<' '.:
be1n111 by the follow111g.
1. lntcrrupl the dll .
II
2. In•--· oL- la
andcut oil lh . huwn in Figure,.2tb}.
UK d1ua Wilh the j11Lem ofpyrng on i1 ns shown in hgun: 5..:?IL']
 Ct(llfll\

Jnt•·rruPI 1hc data anti mood,· 101

•
3 F1gur.: c.,,' . • II ,ind <• n,I •• d1llerc,II t1.11,1 It II
cJ
( ). 1
ot,,1rucl l Il<' taJm and lahri •c rccc,vcru hown ,n
4 i,iguIe c.,,.(e). <ale IIC\\ cJ
• l ri.:I') p111HI ai,, ,,mt c111I 1
r 1,, lhc rc,c,vcra lhown in

• s,,fl\,.111! c,,mrob tan:e,s rilllllallun111

u_.·r lront 111her u, ...") ' "cJ,Alu h., c' 111 C>[>CJlJIUI • I
• 11:lrdware ( \muoh. 1,martl.'artl) m proteaeach
Y
• Pnhc1e, (ln!QUCl\l ch,lll<"- <' 1 pa,sw,111I
0 ,1
• Ph,,ie.11 C11ntn1h

0 ·O
Information lnformatoon
source destrnatoon
(a) Normal
How

0 r0
(b) Interruption

(c)Interceptoon

0 -o
(d) Mod1ficat1on
(e) Fabncauon

Figure 5.2 Methods of d,•lt•n<

,.

11e1Awd.ditional! Y, e-hu s i n• c:-.,cs mu\t pro1,·d araIn,t thl' unl.nnY.n NcY. method\ of
atu,l f f r A j "u e 'a uc a ndcwbSI'ie s andnewnetwork i.ccuril) hole, uri: h,·1ng d1se<ncrcd
,,1th d1\turhn Pllllect l l f8y c cfullyplanning 11s nc1w111k .111J \H'h,11r ,ctunt, s"tcm
:rnc bu ine,t
be tdagainst many known and a, yet unl,;nnwn 1hr,·.1h \n c bu\1nl'" mu,t uh,01\
 4• for n ct ork andwchs11e u11,11:I,;,, 111 1 "I,; th•· h"s ,,t ·•"••ts.
Pllltcct the ' v tmponantrcil on to prt>lt'd .m e hu 111<ss':. nct\\llr and Y.eb uc• I
'-t • ':'•ness· rclatmn lnp:. "ilh ah u1,111111.:1s l\li1t1) Internet u,c pcrceJ\e th.al
lllllaik p1a nsk totheirpiivacy and ,.•cu111y \\h,·_11,hey bu\ proJuct: ;in Cr\l 'or
luaal mfonnatmntlllhn•·· Although ihe pt·ri:rpuon ol risk 111:i) be greater than the
 Security on the Internet
Looking at Table 5.1, one can see the amount of money being spent on secunt)' f
0 COfillll.•
systems. r,,:;

TABLE 5.1 Global Spending on lnt-:rnet Security Software 1998-20031

Year Revenll<!s (in bi'llio11 $)

' [!;198 3.2
l
1999 4.4
2003 8.3 t
2009 14.8 p
2010 16.S(E)

Network admJniiltrators have increasing concerns about the security ot !heir n I\\Ofi.>
W. dley expose their organization•s private data and networking mfrasm.1cture !Cl lnttm::
rmclrtr,To provide the required level of protection, an organization ncc<b a sc,;uri! f\ ·
'4 C41unaurhorized users from accessing resources on the private network and 1•• ·
apinet the unauthorized export of private information. Even il an organizartou i;,noi -o
;·
'P $c it may still want t{J establish an internal sel:urity policy to manage u,er-"
re port.ions of the network and protect sensitive or secret infurm,JUDII (>

· ;rt.fnndamental problem n1ay be that l:he Internet wa.<: not designed to t, ;,;)(
31
f,IICeU for the purposes of research was the prune ccrnsidcruuon r
 . er wo,
s unpJcnicntcd.
• "f'
ll<>wcvcr, Ihc
11cno1ncn111s
1i, .
---
--- 203
101,•rtl ,J ction of d,1crcnr t)'l)C, ol ti,crs rnt:I I llCL1, , ul the Int
11 111 1
,he ,n1" ''.,.cicncies to the extent 1hm wi,ic '1?" 1l'thknl user h ,·rnct, coinb,ncd wnh
..t<un1· d,1fll:l.[!CS.
c,, ,, open I11!<',n
01hc1 ,actm, 111,·lnd th,· f II
· n " fr.1va1ed
,., s11,·, 11,1 inc hi: cx, 110g
.,ull n• ' o nw111 vn,, ' hrcJlt-1ns and
J tifrtrra/111' f('l'/IP ,<fn•ires. I\ IIIIIHhn I I .
,. \,., .. I ",,,. l(l'/11•
•nn be com11n111tM.:u ,,y • 1111wkdr,·ahh· - 1
·rv1<c, ,,re 11,11 ccurc 4ml
, 1 111r1111,., , ,•
nctw<11k111g cnVtr\111111\'III trn 1mprovmue. 11\'IWokr m1' '' 1·,I 111 11,,, 1, .area
1 1 1 1 llolc 'nt,it·nC, I
,nc.
J ... ._,
" c•r11:n1lly 1111I
, ll'n.tC of spying t111d S/1<,0jing. A tnaJ·11i1ty ' ncr.,hlc
•· ,,,..
.1sswords. ,,nd Ille
. can ', 1 1ntrrnt·t tnfl 1
rcap111ricI lrnn rcrs ll1: 11101111 orc11 ,111(1
. 11ncn ry111c<1 c-m 1
ai •
'
soflwarc Intruders can Lhcn reuse password .., using rc.,11,Jy-,a1 1,Me
l't
1II .. rcak int,, y 1c1ns.
\ without
• rdr
h
or t' e potential for abuse tit<ma y nr \Vltl c " " ' ' I
Many sites arc configured unint .01 . 11
regai of policy. fmin
uick • . - - n ntcmct =
• 1c 1n1i:rnc1· m
TCP/IP
1 services than they require for theiro=ruu _ _ .: d any Silcs P,.'Tlnll mote
• & . .- ons. anu u n<,t ,n mpt I0 I
access to m,·ormat1on about their compuLers thlll pro,.c \ ,. 11u«· hlc 10 intnJ1l,«m:«il
coul·u'
4. Complexity of conf!gu_ration. Host security_ acc-ess contml 111 oft n compk, 10
configure: and morulor. controls that are acc1dc111ally misconhgurcd c1tcn roult 111
unauthonzed access.
Sites that ignore these problems face some significant n i.. thal thi:y v,1!1 hi! atuckcd
)" rntn1ders and that they may provide intruders wnh a staging ground for 1tt:icks on
other networks. Even sites that do observe good ,ecurit> prm:1..1ccs. face prohlern, w11h llC'"
\Ulnerabilities in networking software and the pers15tcnce of some mtrudo:r;.
Some of the problems with Internet ecurity arc 1hc re ult of inherent vulncr3bthllc.s
1n the services (and the protocols that the services implement!. while mhcr an: :i rc,ul\ of
ho;t configuration and access controls that are poorly implemem.id orov,:rly cnmrkt 10
udmtru-ta This is further aggravated by the tremendoll5 growth of Lhe Lntemcl .intl th
".i 11 ,, used Bu5inesses and agencies now depend on the Internet for commu111ca1ion,
Jlld rc-,:nrch and thus have much more to lose if their sites are atl.l:lcked The following
,t:.:11on, d ,.nbe the
problems on the Internet and the factors thai contribute Lu lh.:s.: problem,·
411
I. Howsecure is the server software? Secunty hould Ix in pl.1-c to prt\Ct '
1
unauthonzed remote Jogon 10 the y,1em. IL should Ix e,trcmcl) J1ffi,ult ' m;i-c
change to the server software. The servers themwhi:, ,h,1ul.t be ph,,i,':11' l..x
10 a secure environment.
2 ff . . . . . , u. Jit .: ird · 111\ormJUOn ,1. d. , lhe
1 I L ·1" ., mu,t t>i- r1111c,; ic u
· ow tecure are com11111111tatw11 s?t usllllll<
.. . t
liCn,11,ve data that is being 1ransmlltt·li ,t<•ros, 11 11' '
J Ho i . . I 1· I , , t/11•'./,111111, ".. " it '"'"
• 1 11 s the data protetted 1111ce 11 I \, r 11•1•re, ,•
.... .
'-..ncrypted , .I
1 ,, 111111 ,h!f3!:t'
text files 111 the wch,tll'' b 11 1m ,' 11 11 ••
,. I' l , ,I l •..,.. 1
1.
4 Ho 111 I11 1, 1·1 11er,/ /11
11111/ '"'' " • ' • 11
• tran
4'e . credit card 1ra11.HtefilJ11., ,11,1 ' • ,11"' ,1, hi i... 11 111or,(-' ;:- r l<i'i
. ', 1

sacuon mu t be authcn11ca1eJ ,11\ll uui,111111' ' 11\.1,

·
lhe users.
 t-<:ommerc-e,A
. • ll I
204 J , b . lld'•o ,,,1,,.,
. ecure tec es. an e us oess should.
hno og1 - 1 rij,.,
Besides impJernenll:g one working iii an e-business should Und <levclop I<:
rocec1ures. v e . - Als o 1 f . e r $titn(lh· t
,-po l.i •e5 and P . t he bus iness s ecure. , a P an o acL 1on sh
1
11
c1 . for keeping . ould b is ,,, h
responsibiJiues teotialsecurity problem. . . . e rca,1;:,
deal with any po ·a1 -ecurity problem 1n an e-busmess 1s of huma ,,
n,e b• e akest link in any secunty system is e people using it ·r'
er tha,,
.
• st potenll
gin The we •
5 •
. • lh
r S . . n, rath
hee IA
efeCtr-OnlC on · understand the secunty po icy. omehmes, the St<: . lll l y
of an c-busine · ss may th nol 1
mployees are not able to follo,v 1t, . or refuse to follo ur ity
. "t
Pol,c y1

d:
bu(d me that e e w 11b, ,
so _ens_o cult for them to get their work done.Forexampl_e,employees may c/caul<: q
makes.it make frequent changes to logoo.passwords. At times, they may nofunanno)CiJ
at havmg f ecuricy measures. Educallng employees about rbe need for d r,,lilJill
the i.J11portance o s . . security
eir
. .tn the security processes . is essenttal. Table 5.2summarizes the general , il'(l
01
th
. ro 1 e
that businesses must c er. cu
issues e
- ons1d J
TABLE 5.2 General Security Issues
Comme
iiiil.i; ;' . Jsne m

Comiection to the Internet Private computer ne1works are at risk from potential tl1rcaLi fr
anywhere on the public Internet network.
Unknown risks New security boles and methods of attacking networks are
bcini '
'
discovered with alarming frequency.
Customer privacy and security Nol only must steps be taken to pro1ect the privacy of
of customer information cusJomei information. but also customers must be made aware of
thoseMeps and ha.ve confidence in them.
ty consciousness Management and employees must understand the importanc
Security risks associated with a network and a website can be addressed in some way1
• follows:

Network and Website Security Risks

r of planning a startup e-busioess' security, management should become familiat wllll:
o. i:k a.nd web server security n·s tecrr·unology. O n.g 1. nally, backer wa a sed 1.0 .
k termu
"d'. so are programmers. Today, hacker is a slang term used to refer to someo
c....
. l'lllely gains una uthon ·zed a
. . , ccess to 1· nct1· v·1dual con,puters or ec•""'oil:1·
computern .
:ae
........t tbeuskills ofind weak_nesses in computer systems and make 1hc!ll
kooii'll-l .
to
- informaaorti personal Mali ci • ous ackers, also called crackers g:1i11 accc,,
h ste.1
gain· .
 o n s u c h a s cred it c d b '
• Sin c e t h c r . . ar , num ers. atten,pt 10 disrupt s e rvice. or
c a• ust an) :
w•-
Wide
e IS a b · 1ch e ,,
!Mira" mu1......,_1,_r'' press coverage of computer system security r ' . 1J ·
· com are DOW g enera Y used interchangeably for those '1nVO h •
putcr system access.

-
.
 5ecunlY
205
"A II e-busi11css
·• must
ffk o protect
• I ,d itself against unauthort,cd
. 3 •
J.of-
11 crv1ce 11'8 vcr oa . nnd the in1r11 . cct to II compu1er networlc.
delll SlOll of deMruc1ivc v· .
1r11 cs.
• of-Service Attacks
oeoi-a1
oeninl-of-Servicc or DoS attack 1 un aunck 1111
A rk hy flooding 1t wilh usclc s 1ruflic or .anetwork lhal i dcMgncd tu dbuble Lhe
net"'O I. I uc1iv1ty. /\ d1Mnhutc Id I 1·
!)()S. 3uack use:. mu lip c computers to launch 3Dos att· ... . ·c en1a ·o -service, or
Dd,> n, technical damage,
· it, can do sub tantial Ini an.·. da_ck. Whtie a Dos attack dt,e not
b3r v second an us mcss s network or a eta1 ,unage l<J an c hus he
c- websne CJu e
ev. e 18
d . m -
The auackcr lirst breaks into hundreds (Jr ;hous.an;lwnr '.' mdayresult In lo,t revenue,,
d · , II· ·k · s O ran om. IMCCurc computer, on
the Internet an anstas an auac program. Then he coordinate them all toattack the till et
,imultaneously. Thereafter. the target is attacked from many place atonce· the tr.id·u g_t
defences just do not work, and the system crashes. · 1
ona
These attacks areincredibly difficult, if not impossible, to defend against Ina lr d l .l
· k h · · , a 1 1on<1
dcnial-of-serv1ce attac, te v1ctun s computer might be able to figure out where the attack
., com111g from and shut down those connections. Bul in a distributed attack, lhere 1s no
,ingle source. The computer should shut down all connections except the ones it know to
be trustworthy. but that docs not work for a public Internet site.
So far, these attacks are strictly denial-of-service. They do not affect the diita on the
websites. These attacks cannot steal credit card numbers or proprietary information. Th<..-y
cannot transfer money out of your bank account to trade stocks in your name. Aetacker;.
ca1mot gain financially from thc e allacks. Still. they arc very serious. For most big
corporations, the biggest risk of a security breach is loss of income or loss of reputation.
either of which is achieved by a conspicuous denial-of-service attack. The real problem 1,
that there are hundreds of thousands, possibly millions. of innocent, naive computer u.,er
who are vulnerable to attack. They are using DSL or cable modems. they' re always on th(
Internet with static IP addresses. and they can be taken over and used as launching pads
for these attacks.

Viruses
Viruses are the most common seeu.rity risk faced by e-busme ses lod:iy. A vlT\ls b a ,mJ.ll
program that insens itself into other program files that then become ..mfcrted'". Just a, n
virus in nature embeds Ltseif in normal human cells. The virus 1s spre-ad when an in1e.:t<'J
ogrctm is e,:ecuted, and this furtherinfects other programs. Exmnple of viru, effec s
m.:luJc lllability to boot. deletion of tiles or entire hard drives, inabilit) tu cre.1tc or ,a,e
nk, nnd thou and of other possibilities.A logic bomb is a v1111s IIho,e atrnd. 1 u·ig.i•·rtJ
h) ,,inc 1
event \Uch as the date ona c()mputcrs' sy tem .:lock A logic tximl'> lll.t) ,unpl) ret.:J,<' •
V tru5 0 • II • d , •J into a eomputer - ,t,·m
. r i t may be a virus hselr. Viruses a.re g,•nera Y 1111Tel u" . .••
via e-rna · i
1 Qr by unauthorized network access.
• .
V1nis ,ex.imp1•, 1c11 ·lud.
' s1nn,'tl \h, hdJn,_□P.
and AutoStan 9805.
·
lroJan b . . 11 •.' lli111J ,u1d i, ,1 ,p.-,,.,1 ,, 1x· .,t
•rus thoa rse. nus take!, IL\ name ft mn u shlfY Ill <Hilt! I II 1111 tll t'lll rl.llll(llt
·t emu1ates a ben•ign 11pphca1ton It 11ppcu1.s. t1I J,1 wmt'l un•i: '' '
-:-:----
2 06 =--=
: : : : : :· : : : :
as de st ro ying fl l es or c reat
. e ll s uch
111
' ' '"
nrli•n ,, , "tu,,

. else as w , T . h •ng a "L

s
t)JllllY doe 50 .met111ng ..
der acce s the system. .A ro.1an orse may be an e''Itel,,d
but ac. give an intru d d program. Tro.ian horseexamples iocJ d ·niai11 t
ePtrY p01nt 10 ment or a downloae u c Sa,ck(J;¾•
f()[III of • acl! d BackDoor-G, ,11-t.
\/ Slfreehnk, an . . virus that does noL.d1recLly alter program 11
.., B . . -nr.cial type o1 . 'tb. ,. 1 C\ 1
""'-· fhtS 1s
or an applicallon w1 ,.cs owncoueand then · n,
I'-
a document
-
. ti . I u ses
..,c:,nn replaces a ften not noticed u11t JI 1 eir uncontro led replica ti
th · 1
• ttr, ,
8 " If Worms a re O o n c on
t o p05ition•1tse • d or stops the system. ·Worn1examples• include VB S /L o iullit
vctem resources and slows own 99 ' veltt1ci
s , .- , i · ua worm and Happy .
a V BS f V "" Z I. · • w ritten in an application such asMicro oft Word
'""'n1 ,
short p r o b , _ . . ·f o rh
macro 1 sa . f kh o . y s t rokes A macro v irus 1 s a 1n ects Microso f \ti
A virust a !
.
to accomplish a seMrieso vi;ses can be introduced into a computer system as part of t Wwllnl
or E:tcel macros. aetreceived as an e-ma1.1. attacbment. or a. fe on. disk. ll r i
,.
sa a
il Ope nin
or an E:tceI . g l,ie
documen
e-mail attachment or file triggers the macr6 vlfllS. . .
Some viruses are, however, just hoaxes. Se eralatJvllllS software vendors maintain
to-date infoonation such as the Virus Information Ltbrary atMcAfee.com, the AmiViral
: Virus Encyclopedia on viruses, worms, Trojan horses. and hoaxes.E-bu inesses
aha face other security issues related to doing business on theWeb,such as website
defacemenL
information theft, and data spills.

Spyware
Spyware is Internet jargon for Advertising Supported software (Adware). Tr isa W&} [01
shareware authors to make money from a product, other than by selling it to the users.
Tom are several large media companies that offer d1em to place banner ads in their
productms czcbange fora portion of the revenue fron1 banner sales. This way. you
do not ha e to pa) for the software and the developers are still getting paid. If you find the
banners annoying. lbae is usually an option to remove them, by paying the regular
licensing fee. This usually involves the tracking and sending of data and statistics via a
server installed on the user'< PC and the use of your Internet connection in the
background. Spyware examples indudt CoolWebSearch,Intemet Optimizer (also known as
DyFuCaZan£o (formerly 180Solution;t lfnntBar (also know as WinTools).

:care. th31

--=•
--wn prog.aru 1 running.
Adware . i s any_The
software
authors
application
of these applications
in which advertising
include banners
additional
arecode
JisplJveJ
• .,. ca c bc: viewed.through pop-up windows or through ;1 hur that ;ipr
'dlw llap ,,!;COit and hel :ustificauon for adware is lbat lt helps recover prognuiinun,
.,iAtt taliMbeen cri =:old dow the cost for the user. . , 1
usually I
SM,JW includes lie.iii
code g,1 puse,
that tracl-s : .
,1pam
use1s cause,,,naIt
per.J,•e.
H -. to thtrd .. on 1
y ,tAll!lpl,ii& ind\ldc Bearshare e , without the user's authorization ork nt'"":
8
• onzi Buddy, Comet Cursor and DivX
 207

0 Adwre
■ Back.ooor
■ Warms
(] Vin.ts

70% 0 TrojanHorses
0 Spyware

D Others

figure 5.3 Percentage of malware.3

Howare Sites Hacked?

Distributed systems based on the client/server model have become co=on. In re-eent monlhs.
w, can see an increase in the development and the use of distributed sniffers. scanners.
!lld denial-of-serv ce tools. Attacks using these tools can invol-ve a large uumber of she1.
wnu)taneous,y and focus to at.tack one or more victim hosts or networks.
Ian typical distributed attack system, the 'inLruder' controls a small number o·fmasLers".
which in turn control a large number of 'daemons'. These daemons can be used to
launch packet Hooding or other attacks against the 'victims· targeted by the intruder.
In the incidents that have occun-ed so far, daemons were installed on sevetal hundred
iiles, typically through the exploitation of well-1-c'llOWn vulnerabil\Lies thaL lead to root privilege,
1111 lhe comprqmisedmachines. Though some implementations of the daemon program dl.'l

ll!llrequirrcoot privileges tolaunch attacks, in practice most of the daemon are

conceal:ed
b)-lile. installation of 'root kits'designed to hide evidence of intrusion. There are U1dtcauo 1To
d i e p ro cesses for discovering vulnerable sites, compromising Lhem. 5la\hngda:m0';
....- . . ...th 1· :_ · h t beml! informed 111 but1;h
-.mg eintrusion are large\y automated, w1theac s ep - . f
'Pinstman-y machines in one session. Daemons have been discovered ona vanet) ll
stems with varyinglevels of security and systemmanagement. .1(u,t1alh three
1118talled d ils pre-sencc Lo se,cra · •
it an operated, the daemon announces · , ·pr progrnm rtcmd,
'- fined masters and waits [or further coaunaocts..
' . I \IS i \\' lles ..111 retnc:ve<l
The h t b
IL, •
1s ready loreceive commands ln :Ul 1 11te ina • .
1,. do,, l!r.1cetull)
\ 0 1 n
,
Or "'8sters can causedaemons in I.he list Lo launch :1t1u1:kss, ' ..1 .:r\.l)tol!r..1phic
u'(S h\lVC U C•
I ·

themselves to a new master server. niru " cl laemons

the information recordell by them!ISlCr on t

,or8fwilcl/File:Malwar _sLalics_20 l
2 0 8 ------ -:= -
= :d
the 1nn rcr l'/111 1-. 111: ,11111( k 11.,111, ,,,,,,, ,,

11 1trt• e r,
1 ,I, I•\
-.,,and (com un . . ,uiion uho11r rli,· 1l·q1ir ..rnl 1111111 ,,
the couu- 11,. ti
(lnlllln Ill1O01 •. , lh I ,II II ,, ''"
Al requests c ,.11.rn,crcr::.. I 1,· 111.a.,11•1 p, "I" 11111\ 1 " 11
h
·st These . and (lt er,1 • I . , , '''" 1 i,•I,1
in its l1
f the :. the durauon. • ttisetl ho t:i, whc1l' I ll'11,11•1,v,1y .,.111 1 111 ,,
v,ctntl, rnson compror. '·hlly I, I'•,,,
o rcfina.tY usc:t progra, ' 111,1,1,
uo
.
'dents on the Internet
security /nc, ·,e prot,lems hove occmn:d w11h111 .,1110111,
• rhe
above. t h,c ·1 '11,,.J •I
j
As an evidence . otent b'l't"es in the UNIX sc11tl111:11 flH>/,\l'Jtl11 w1•11 cf,N ' ltr
vutnera i t 1 • i,v, r,,J
In rhe first. persis ed h . sendmnil programs. wen: hnced H> s1rn111hlr 11
which had nO t correct t e1r
bilities were auacketl. llow1:vi:r.t I1w lO Iii,· t ,,1111'111 ''''"' 1
programs fore their vuInera • iyi 'f
1
·1 be
ro..,.am d kl'ng soflware ,in gencrnl. three su 1s1·(1111·111 v,,,\11111 ' ' 111
sen mlll P ,,.
an networ ..,, .' ,I 1 ,,,,,1r
. s1•gruficant vulnen1bililies,.• hesL•nu111J11
d found to still contam • f
r1111 1,1111 I\ 0 1. 1
• ' · 1,1,
were
and . .,_ all lo ]unit access to sendmad tire lorc.:cc t11,c:wl 11111<kJy wJ
sites wnhout .._...w s 11 ,,,,
bl ms are found and vulnerabilities revealed. .
pro ;n the second,a version of a popular and a lree FTP sc ·:crwas Jrn1111I ,,, 11,111,11111

T r not o necessarily
'an horse that
thepermitted privileged
contaminated access
version. were,oagarn crvcr. Stolies
the, fon:_cd 11\111/! 1111,
·1acl f ,1 ,,J•
bu /
aciv Ci11d11IIJ
V('yI
quickly to this situation. Many sites rely on the wealth of,reco. ltw:11(,•1va1fol,lt
u,, lnteroet, especially security-related software that adds capability forJogg1111,:,,1n1 •
''"''' and integrity checking- that vendors often do nor provide as part or llw opl ralmy y
re111 While the software is often of high quality, sites 1nay have little rccou,M., 01hct ih,m
riire on the authors of the software if it is found to have vulnerabilities and olher
prohlcm
The third problem bas the strongest implications: intruders had broki.:11 111tr1 pqrcorulJ
thousands of systems throughout the Internet, including gateways b..:1wccn JTlilJIII 11.-rw,11
and installed sniffer programs to monitor network traffic for uscrm:11r1es ancLl ,tic p,1\ v.or.
typed in by users to connect to networked systems. The int.ruder, had w;ed v:m1111 J,nc,.•
rechniques for breaking into systems, as well as using passwords 1ha1 hull IJCcn "1n1llei'
One of_ the implications of this
incident is that static or reusable passworch urc oh olc•eI protecting access to user
accounts. In fact, a user connecting to a remote sy 1cm a,rn
Interner may be unintentionally placing that system at the risk of allacl.. hy 1111nrtld 11
could be monitoring the network traffic to the remote system.
Weak Authentication
IN•1klt>handli.n. g teams estt' mate1hat many .mc1. dents stem from the u e or we.ii,,,.11. a1hc
d" •ma 11
"ncrac•kon u.., I
th nternet can be e number of different way,. 1J11w , , ,, f' J w'
=•••
0,a m oc b oa nd s are by cracking the encrypted form of rhc password ;11111 h,> Jll""11,,n
, ...... ofnelsfor pa sword packets. The UNIX operating y 1 ·rn u,u.,II)P
,.,..)_.J siJm)apSlswords 1n a. file e read by normal u en,. .rht" p,t\(""'dI J.
that canb
die tho.ftlo 1.Y : ng
PIIIIWord
11
If it. . canercanalso berun
obtained hy a 11vmhe1
reacllly-availahlc o,l,rhcr rnr
1111"""' a, ;
111 on •uwd, an 1ntrud d ((ll
lie Clacked .:du!:: :ss"':'ords are weak, c.g le:,:, than I< ,1i.,,.,c1c,1
gam access inLo the system
 f Ospying
209
,,1 e note u,:u when a user connects toher , , o1 na
,,. nt to
.1111pt,rta r's password travels across ,1ccoun
remote hi) t U \ni g..,
1 1"
the Inu:rnct
All,I hC u . mto . 10 moniti,r·unencrypted
18 . tir in pl;,j1t1.:,n ,T"
se .. ,1 for breaking
systems
. c net
. 1 them
1"
.I" ,h ' in
etJwu I
d a passwore,anu ,I h en using,
l u,c .
Cunncct1()fl:, t(l 'P
r • packets he• . IIU\,
n'
011
, l l" '
,r
111c on ., · · , · system fort • nil
,,U- .,.-
. r1d 1a
()rd is10 an aum1111s1.rn1or s 11cco1m1 tl)enth(!. ,. 1or111a1 login tr ,,.
pas $ W · I ' JO,, 01 oh1·1i1 • ' ,11e
, p111rc1110e neasier. As notedprevious y, hundreds and possihtytho, .u. ng privileg,edac<.:c,,
111Jd b 3 ve l)ecn penetrated as a rc ult of rnonilonng . . sands <1Y( Sltms aero .,
P
ic 1
tnlt
roet
II as the contents a- c net and flTt>c:,,sii)ns or
f 1 , 1 -uscmame.
b .,ollu_. p:is wiud!,
. I us we . d. b , •· , .an einrm11uretl d
.
J'-!113•1 t'on about a site an,ts usrness transactions.Most d .1n use,\ 1c,
0
Ji,,1111inforro:s me that e-mail is secure and thus safe fortransm ;: r:. n l encrypt c-m 1l,
;in,t iJieYa n gc n 111v..:inf1>rm 111,n
of Spoofing
(ase . d t b 'd
.,,,, IP address ofa osthl1s pre umeIP o e vah _and is theretore lrusted by TCP .tnl\ lllJP
,,. . A
<(('itC problem 1s at, using
CS· B. fl source
lP routing,
. an attacker's hosl' can m a sq uerade ""
· , hi.1st or a client. ne Y, source rout ing is an option t h at can be u • A , f
, IIUStea , . · a,;u o.u ''\)(!Cly
difeCI route toa desunat1on and relt\rn path back lo the origin. The route can mi·ohe
:ht use of other routers or hosts that normally would not be used to forward packei to
medestination. An example of how this can be used such th;it an attacker's sy tem could
Jll'A(!uerade as tht: trusted cliem of a. particuJar server is as follows:
I. Toe attacker wouId change her host's IP address to matcl:1 that o( the trtN.ed client.
2. The attacker would then construct a source route to the server, that specifies the
dlrec, palh the IP packets should take to the server and should take from lhe server
back to the attacker's host, using the trusted client as the ht.SLhop in the route to
lhe ,er.er
3. The attacker sends a client request to the server using the source route.
4. The server accepts the client's request as if it came directly from 1he uustc.d dt<!lll.
and returns a reply to the trusted client.
S, The trusted client, using lhe source route. forwards I.he packet on lo the atlilcker·, lu><L
Many UNIX hosts accept source routed packets and will pass them on a lhe ourct'
IOllle indicates. Many routers will accept source routed packets as well, wh.erea., ,nme ,1.1ut r
tan be con6gurec1 to block source routed packets.
. . R-lllail on the Internet is particularly easy to spoof and. without nhancement, ,u.:h 3'
::'-1 si&natures, generally cannot be trusted. As a brief examrk constder the e,,han\
•I·?Q,-; Col)lacc
, ei l,llt.sting
whenofInternet hosts exchange
ASCU-chnracter comma .nds.
n1ail. TheAn
excbung.e .ou rta•"e
muud cales u<rnga
I{I •,i,11 t h , ,,
"ml':
·\111,·r \ \ T f ' i
•0n
Pia..· atceiv Telnet
• h to connect directly to a$y1;tem·s
t ng ost trusts lbis sending
. Sim1}le
I
1,1
\.ul Tran,fcrrr,:iio, ·ol l)' ,ofed
origin l•I th<· rn.,11 ' ,i'
host. aud l iu '' • . \ e,ull 11n
-...:·g a sender address Lhat is different lr nn 1he true .itltlr , ' ·
Pri\tilcges, can falsify orpoor e mail • 1ml w11h m0r
h 1
;,,A . )
. . . . ,. ., sue as Domain "o"' N
 S) '7'111 Ut' "'lll\'1Cl '
Name $ervi1:t· (I • •
1J 1eJ "b.:n
h

F --... hese services still reprcscnl .1 LJrt:,it

 '
210
- , ,,.,.,,.,r,,, ,,.

The Jnternef' Sif,•t((

,
H ow Va/nerabfe are
. ,.c"'ul imcl n vital r1r1wotl<. 1 1,1 lho ,
·1
....,.,.cr111erner. hw 1,e111g. a u '
• ,,, d t o rhc Jnternct face i.1p-n,r1ca111r, t "• I •·
hi e • • ,
11 1
are conm:c... I ,,,,.. ,,;i
auacb· Sites t ould j111lucnce the JcvcJ o rr,k i, 1,
The
11.1 foJloWlll.8 factor. w
tems c'>nnccred to 1lw Rhc
• Number o f sy:S •
. utilized by the site
• Services . 'tu of the si'te lO 1hc In1ernct
• Interconnecuv1 r •
. . file or bow well,knowo 1hc site J
S rte s pro ,
• . , d' ness handle computer sccof·rly ·1111,·;r(Ient .
10
• Sites rell 1
The more the number of systems that are co.nneclt:O. ohvio11 /J 1h bard,,.,,
. - cm,aJfy if 3 sjte is connected to the Internet at c:evcral rhrnl
1
th eir seoun Y· L.A.f.. 10 atl.acks
more vulnerable • tha11 a site with
• a single.gatc":ay.
• · At 11,,; .. rite tir11e •
b e
well prepareda sire is, and the degree l<> which the site rche t,n 1he lnteir,-:t,,,.•• ,
decrease the ris.l<. (\ site's high profile could attract more pote.n11aJ mlrr11lcr ,:t.i,i,..
sonle harm to the site's image. It should be 111entioned though, th:11 ·9u1et• f.•.•.., -,
used sites are also attractive to intruders since tJ1ey can more cas,ly h1dc 11'.!..,r Cl
Sites that use recommended procedures and controls for incrc;, iri;., v,mpi;:a _
have significantly lower risks of attack. Firewalls, combined withrinc-timc ft<' '"'"'"' •,
immune from monitoring or guessing, can tnctease greatly a ,<;itc'-r ,,verall J ,;eJ ,,r
and make using the Internet quite safe.

Website Defacement
Website vandalism or deface.ment can be the result of a !Jacker breaking mto ;: f.ffl:lt.
accessing the website files, and modifying the HTML to physically change Web pa
only do websjte defacements embarrass an e-business, but some website detacemeo .21
have serious financial repercussjons. Aastrom Biosciences. Inc., a Michigan bai.:J
products company, experienced a serious defacement created to manipulate 1b 11oc pr;a •
FebIUary 2000, a bogus news release announcing a merger with a California
biopharmlll.'.-'-""
company, Geron Corporation, was posted on Aastrom's website. Stock pnces tor·
companies rose: Aastrom shares rose from $4 1to $4.41 and Geron shares ruse from $!"
to $S1. After discovering the defacement, Aastrom notified Geron, and ri:prc.,enwui
bolb companies advised officials with the NASDAQ index, where both Mock, an: traded tJ
dlrm was no merger.

q, e,lruuJc Industrial Espionage

l
RllmaJmiaajiomtricrl1ililttraian1d a bi dO11 nil...
g ar to d1 u{'( I\!
• .
i ssue that most companies are reluctant 0
"
ifoJen arc espionage. Often, e-busiJ{esses that have been hacked and haJ bu-:._'C
too embarrass to admit the break-in. However, in Ja1e n,wbl:r;lUll
:,Y, Microsoft, found itself .4>cramblins to deal wich 11r
1
rurwn u•'
0
a serious hacking, incident with industriasl p1011.ige
 _:::
:=:::..:
-=.-:::::: --,===- ------
r-,;Ill"!_ pl. cuipnt wa,a fro1an hOl'l' """ n,1ttl<.'cl" .--------------------------------11
a The Q·'•-Z .1.r,1·1,m ."n" rnll·c:t vA.r 1111,11t1h.11w 1
I
a
""''
,,·_, l•'t
II ctn . . I
.:onta111111g 1 1c vu us I lwn th•·" 11
l<llllflllk1
,y ten, wh., III I l'c1m0 1hc.1 ,n
l · "
-11J1l&'P1 _ • 11• r,·pt enu use
1 1 1 ,• ,,, ,. . wn c<>dc. ,cmLhc, f111 u1hc,h 'll l'll 11 •t<:ci. rcn, Jn
· " YM.,
the " ' . . ii • · ' ,,nl dn
1 <m• N,,1c .,
- ,
c d i'' ,,,., ·i·ecied ,omputct, 111 .1110111,11I,·, m 1 1 1 1_ s "' 1111cc, 11 1 sc111Jp., . , tut
,f 111 I I , 1 1 ll"
t 11 I f I'
-. ' cntc:r ,, ,)-,tcm. ,can·' 1 Jrn p.1 ...,.,10 1 n, "' [rc tc1, a"'- ,·
,:r.·... ust' • ,1111 tn ,l,111 n:i.;ld lOr"
11111
1l 1
d •'" if pu1c1 Allhoi1gh hy Au1,•u,i ')l)(J4•' ,rll M,r1wa,, 1 lllln lo al0
al
V' com,nff\l I
the 1
, 1 111,
loltv.
• _ ,.t. : <
er · 1 - i, ocf c v10the1n'Q,\ln Jr1'1r
_ i n.11.1111. nlu• 1 m, a11011 111 tlwu •rem le.e"r'
<low 11 11 .1,1 ,hi,· v tr u

• ,,u,".,, u cll 111 crc:Jtc J bad, dnrn III M ltrO\(lrI

Updat • iOmtho
Vi Ille
"f'(OJ•"\
" rd fraud and Theft of Cu,tomer Data
(rt.d..i all s- "C purchase transucuon rnvohc ;,;rcd11 card'· An hII tnc'liS th I
c
\1J11' pavJ11cnt for good:. and crv1ce , muM secure lhc crcdil d • acc.:pl crcd1
(tldS ill·'-•ilt:, and it must i.ecure ,tored credit card infonnalmn caArl mfOTm:lti\11 1 1nu t
!IS V1cv- rd · th · · · \o systeirum be
" f or:red•t ca . t r tahn s : i c u do "n aud enucau. on (verif) mg that placing \he ord
the f)Cr'°'1
Ii die holder ot e ere 11 car used 111 the 1ran,acL1on\, and crcd,t card alllhor.z.aa
d,al the charge can be made to the card number\.
,. baCker can bre k into a database server and s1cal thou and, ot credu card umbc:is
od (llbel' infonnat1on m a maner of moments. and an e-bu,ine" m1gh1 not c,cn n::Clll te
1h' die flaCkcr wasthere. F?r example. one ot the large,, rcportl."dcases of stolen ,.,_,..
ad uuonnation 1001'. place n Januar 1999 (hut wa, not rcponcd un11Imuch later v.bcn
iarocmalion on 485,000 crcdtt card . mcludmg card numhcrs. cxr1rnt11lll d,llcs, namc:. llild
. was stolen from an e-busines, v.cb 11e and ,ton:J ,,ta l,S zn,ernmenta ,
.ells« where theagency's website adminiMramr d1,co\ercd the J.ua T, .. rev. reported
evidc oe "' fraudulent use. and some of the account, wen! not aclr": th, e mi;=i.i=
But eol
!lit nsk toa vulnerable e-busine s of the theft of cn,ui,c: infom1a11on

s«wity and E-mail

Mail Standard
21l
· f f 'lllit11,
1
-·
'A• /\r fr,J

.. Uh I 1 ,,nrl 1 , 111,1111111111,11 . l'l•M lllllurl,h . •

_,_,1,1
"' WI"" ,·1111,.nl n •
w , u•I' 111 h111h pu I II ll., ' ry ;11111 1,, 'ru.:r:,111
1 11 1
I\.•-···- mrnl, 11111 II II I I ll'1 C) lr""1•,r
• 1
...1,;tV I , I r.,11 ,phl, 111011'1 111 1, 1 I 111,111 rn,;iih,rjr•• l ,,"4-t,
..11, Jltrr'II1 "'"'"'r' , I Vl1111
...,.1 111•11•JC'
111 1-11lhlll hn h 1111"''°" u111I,11 e111 :e, rr•I It: • , . -, .c,f
_,,.,.. 1 I aljllllllll"" 11
1111 ' ' •ll<:<:111
., ......1111", d 11 1 1 111 1111 t 11kw n ypllll'' uph11 ull'ell11h111•, c,ih,•rr, 11 tcl
' I "' I
l 'IKI ypllllll 111111 llu-, . A a 1••111111111 le1t toll
' :I be
1

P-I·\M-·-,..,.t.".-.•Uh 1I I t1 !IUI}... '

"' 1 1h" 11
..,.1\1,S a(Jl1'1il Ill
_. '" " • , M uls o 11111vhlcN11pprn1 w 11111r1cp111h.111,in •1.1t , -
ltfY ,_....,- 1
- - --n1 c111. 1, wni'\ll'd · 11,e su i· Ill Vl'nly the 11kn111y ,,1•he• lll,1 1, .,
1
-v l't\'tr1rn1,, II 1'1I I I J h lltf."11. IJ!
,-· wunkrl 1111,t IO vcnly w 1c.11c1 any o I t <1rig1nal lt I !l •

Jlltl lhc llll' •llP,I' 1

L.
111 1
1, 'ltt:i

Pffl1Y Good Privat y (PGP)

(,_ Pnvi1cv ll'OI') IN lhc implcmcntallon of public Icy cryptrw,1,n1-
l'f "" · Pl ·11 " · " '" ., y. .
R S 11 1 1 free si) l'lwarc package dcvclup by 11 1p z , mcnnan, !.ha t cri u - yP!
f ltv d
A
.
being published in US IIN trecwured ind J 1_une 199I •. P(,Pf has ipread rapvl.
1 be,:ome
5lft\."t' the de focto worldwide Stan ar or encryption o e-m.i.11.II I\ f.ech
for DOS. Macm1o h, UNIX. Amiga. VMS. Atari, and OS/2 -,ystem . pc,p pr
< cnayptton ul' documcnlh and data Illes thal even advancedupcrcomputcrs are
baid to "crick", The proc.:cs ii;o Mmple that anyone with a PC can do it with r:;_
almost
For authenticatum, POP employs the RSA public-key encryption scheme and the MD•q
D11e1t venlon 5) developed by Rive t. a one-way hash function to form a digital
dlll uswa the receiver lha1 an incoming me sage 1 aulhenllC<lha1 it comes from Ille t;.;.-i=
uncl::r and lhat it has not been altered). ·

Network and Website Security

1be best way to recognize when a hacker allemptmg unau1honzed networ'I; ac=
IO monitor network performance. Selling up, logging, and monuonng e<.1abh-,,icd
■ ere. points, called
benchmarks, can alert an e-business 10 ecurity protl!t'tm A
IJSlelD administrator and other well-trained techniciaru., who u e 1he,e t>cnch:r-<b
--• and manage the network and servers, are cri1ical. Oilier 100b -.u.:h a, pl>S•
li'ewaDa. intrusion detectionystems. and virus scanning sof1ware hould t-c u<ed 1
• e 11 'nrz,• network and website
ttt A .-.word ii a code, or mor·eoften a common word used to oa.in a,cc,i,101 t'
k. Puawords are only effective when used properl'y Oft.:n a ,·o npulcr u,er •
C ' :b,:

c
1 pllln,onl, IUCb as a short. common word--a name or birthda,· ,ll that Illec,e ·
........ • • ofl'.\.
11
.. .,..:.; -,!" v.ordeully. One way hacker1,penetrnle nc1work secunl) ,, , u,ini:' :,c-
d>
7
'\ ur •
plUword by trying millions of common words until VI\<' 01 ih,'"
ll ijbl.l'lullkirda lhat requile • minimum length ofix char,1c1i:rl>in u mi, olIr. .
k I Ille number of potential puawordh in10 bilhom, ,ind m,11..: 11 rn.>l'C' t
It P II them. A computer user should also change p:h,,H,r<I' rt"gu\Jrc'
• I bilia IYIIODls, it is a good idea10 have d1lktt'nl PJ"''orci• on
 .,,.,ir•rY -
r ---
wall ,s u software or a hardware u d ----- 213
A ":Crrorn 1.hc public net"' ork. A firewa lo•slilatc and pn,t .
a pet_.cr ys1crns behind it Firewall, c:in contrc,i'1 vrde, an ca,Y-toe;;,t• pnva1c ,y,1cm '"
f.-0111 the public network
flluJurles Lo Lhc private net e, type nt rnlorn,at, naglc entry P<nn1 tu
"';, I_ ,e m I 1c ou1s1de. Firew•11wor,- a, weI 1a,, wh·,n, .t ta.t •• IIowe:,! t"
acccssih r, I
o I
•· all lhv k . a ' can al,o 1 ' service, lll ·.,
irt'v e the networ 1s penetrated. og a1:tiv11y 11 ''"C 1h,,
lfll'I ,oJo.,a,
,uion detecuon. ts• t hc ab1l11y
. • to unulyze •. ' ' Pmvrdc an •uu11 .
• zedk access a,
h appens · rca1•lime d· dcte,t 1
., nctwor II Bu,inc
Juth<>n · , r · , e,can ala ug, •nd itop
· 10
un niror the networ" ,or real-time intrusi on.\a install intruMon <lctecw
·
d
••31 mo
•· dece.:ted ways. A n 1n1rus1on
. . d etectioo system can n drespond
f d
lo int11J\lon, rn a >n sys1cm\
variety
J,cr· • c en a web, 1· 1 "1
10 0 111ore servers 10 mcreasc 1he traffic lhcweb,• c ag..rn,1 Dos :itt 1
bl add 10 " manage tr,
affi1c,1and b y• h aving a backui> plasite n to
can reroute
handleJegni
b Y,ust11r. hltc :, .cand
.,
nack .• Cisco's Secure ntrus1 on Detccti<)o SyMem ad N
• K
w1e,
anJ ,lunr,
f ·• . etwork mate Ira.fl c
• n JCF.", !Cr
. ·re are 1wo exarnpIes o mtrus,on detection system\ . - pac Sccur11y e
Ill f . I d"
Viru< scao nmg so tware, m e u mg e-mail vini1, scan · h
.
.

(I (
. . f
rwork computers. Anllvtrus so tware should be kept updated C nmg, s ould be m,tall.:d
.
''°" II

• e used d . . ommuruc-,1uon poru should

allow ata
. to. enter and ex11 the network. The system · adnumstrator
.. should close
10
"
aU unused commum auonport_su. p-to-cla_1e security patches for operatingsy tertl!, should
ht ,nstalled as soon as the patches are available, to prevent hackerb from cxplomng butlt-,n
), ,tern weaknesses.

Transaction Security and Data Protection

Transaction security. especially for credit card transactions, and the prote,tion of
customer daia are as important as website and network security. Tools to protect trao
action data and customer data include:
• Using a predefined key to encrypt and decrypt the data during 1.ram,1111ss1on
• Using the Secure Sockets Layer (SSL) protocol to protect data tr ansmmed 01er the
Internet. SSL provides encryption of data between the: brow,er on the customer',
computer and the software on the Web server allowing daw such credit .:art!
infoanatioo to be transmitted securely SSL uses digital ccrt111ca1,o that a \\eb
browser can authenticate the server it is connected to. maktn,gure that , di:
data is going to the appropriate server; . _
• Movingsen itive customer information such al> credit card nu mb.:r, ofthne orencrypt::
the infonnation if it. is to be stored online; .
.i 0- 1,,...
wr--'
e n d dn,c, n
. ..emoving all files and data from storage c, ·ice,. ·m,·lud111•2 J,·,
. . .
• be f o r e g etting rid of the •n,1111t.•
n b.:tore1ra,lull.\?
sdevices;
i. -and
_ , .. .. 1
"• g all bard-copy document:; containing mll1rn1a ll>
:;c
them. •1
0, . trnnll a, II' \H • k,•,1 I
.,._ COUrse, an e-business• security solut1ons ,Ill' uul) •1' ' J.·ulrnr ,1artrnt? st chi:
- . ., .lta - 1 c ·unt1 011cnt,· '
. , _drr. - -,,oyees. Ao e-bul>iness must ma1ntt11n ,I ' • , ,,ul<Ialso
on,,
- r. I I " " " . . 11
. . .. . .; - - . employees tt1 take security l•nou, 1)· ,\ 11 c-t>u,111,·"
'-
. ...-,or
lta lecurity systems tested or audi1cd.
 !2!14 -------.t ra:t:io=n T:e:st:in:g
. and pene
\ "
security Audits . anoverall assessment of ane-husiness' syste
can provide b"lities those systems and providing rec l'n nd
b •udits r in h as
, D ei·cndNct Solutio
I
vulnera · llm111, 1

Jose vulnerabihues.
O
. checking • . . Sccurily consulrnntssue
• "
cnda, . 1,;·",,
ecurilY 0
Sissues Sysicms Integration offer security audil• Inc, 11, 1
11 1
ftltilll.,y Systems. andPinkert nErnest &, Young, also offer security auditi ge"'i '1.i
1
secun . fi . such ns . 1ng c . ·
ACl-ounun mis.. al . counting firms use the Amencan lnslilule of Crv,ce\. \,
of the Big Five intemat: bT :st seal and audit criteria. The \VehTrusica nH, 1-i,;:
AC(OUn1ants (AICPA) . .. verified as being safe a.nd secure by the AICPA '"d1c,1t,'"
cusiome thsl. the webs1 e1 is
be'I business .
praclices. site .
security, and customer inform•The A
1111 0 If 1
audil critenaovcr s se their own audit seal instead of, or in addition " h Pll1, r
Some accounung 5rrnsu 10 ' t e Al(
WebTrost seal. h ·11 . . , . th ·
. security consultants w o w1
I p e u o rm e penetrat ion lest

are When eva uaung . . cl " U . ing. lhtr,

severalfactors to consider. They can be hste as ,o ows. .
I. Get evidence that the security consultants have insurance to protect against acCJdcm.:
system damage or down time., . . . . .
2. Have everyone on the consultant s penetration team sign a non-disclosureagree r
3. Consider requiring a Lhird-party background check on each member of the tonsu\tmu·
penetration ream.
4. Decide whether it makes sense to use a security consultant who employs forir.e
hackers.
S. Determine if theconsultant's team is going to use packaged security scanningsoft-.m
that could be employed by the in-house staff. or if they are using custom tooll
6. Develop a clear scope for the penetration test and a workable time frame.
7. Determine whether to have a DoS attack done, and if so, when to schedule ii tol -0.q
disrupt customer access.
8. Make sure the final report from the consultant includes an accounting of all auackl
aaempted and whether or not they were successful. a return of all the papl!r or
electronic infonnation gathered by the consultant. and recommendations l,n ho ir
fix up any problems discovered during the tests.

b lwWuaPlC Security Risks

Ofte- mscqpra·an an e-bus·mess use stand-alone personal compuler during th<! s111rt ur PbJ"

-
rr,_. available to build and operate a network or until the e-bus1n.:s l'an .iu,,i,ull1
A d d. i aJl
uon Y, some e-businesses offer their employee lhe l'Pl"' 1tU'11
I) I

hoClpll'ationg
I <alt!· allowing an empl ,
1n I tJlu1, •
h1t owned ,enonal co ?Yee to use his or her home compulCt. 1 11 ,,i ,' •
rr 1
mputer m the employee's home Cer1ainly hu"ne,, nir <-
,..
- lbll indi¥idual
-•nc11 files atPC
home · ue to these factors, it ·is im11\H'1tmt
O
· l111
. ,111'•.i,11,111,'
1
are also at risk from hackers.
t' isk Management Issues
Llsiriess . . .
-b . si ulds h omanage 11s e-busmessdnsks as a bu ine. . iss ue not 1· 1
'd '
c,blJS 'ne i n ess roust cons1 er tI1e i rect financial impact
11
i _J•i \L11, a 1e1.hn,,I,,,
A1,. Aft e- $payments, and future revenue loss from c•busi11esnk1ed1 lc 1():,,\ ,,r rcvcn!t
i-lu 1153torY . , • • ri ,\uch ,. ·
,,n•P' . oess •,nterrupuons caused by websne defacem"nl en ,, It f • .

ord
1 su_ ·on and settlement costs over employees' inapp
51
. '· '-i. rVtt.c •llact
1.,ingau , ropriatc ll\c <Jf c-m· 1 •
Z· t·
tnterr,e • .I . . , '" and the
roctucl or service.c aunsagainst items advertised andsold viaa
.
3, b-related copyright, trademark, and patcnl infriogernenLla w_th,11c;
4• eural or weather-related disasters. w uits, and
5. Nat
siness should put in place. ao effective risk h
M e· bu rogram L 1ndudei
rnanagerocn •p at
'
11:e following: . . .
, Networ and website secunty and intruder detection programs
, Antivirus protection
, firewalls
, sound security policies and procedures
, Employee education.
Another important component of a risk management program is tbe transfer of risk
via insurance. Table 5.3 illustrates some of the different k.inds of insurance coveraie an
e-business sbQuld consider when developing an effective risk mar\'agemem 1>rogram. Lt 1,; a
l'1()d idea for an e-business's management LO consult with a commercial insurance
brn'ker tia.1 offers e-risk management services, to help develop a risk management plan
mcludlnt insurance coverage.

TABLE 5.3 E-risk Insurance

Coverage
Compu1er Virus Protects against losses that occur when 111ploy11es open mie.:tcJ
T l'allsnilssion e-mail attachine.nls or download virus-laden sotrware
01111&annd Responds to Internet eJttortioa demand and/or pays re..,.,mJ- lu help
Reward capture saboteurs.
. tJ • d tv acces 10 dutn :trid
Ullalltk...., •
Covers failure 10 pcote<:l aga tnst 11 r ·pa, r
cess/ transactions.
Network Security network sccunt)
· . 0ntl resul1111g l..,--t,
Re.spends 10 breach
or
·
Protects againsl inlcllecwal proper!) · frhi•c111e111 lo,.,_,,
10 Jttnt
. . h ·n t,.111lt11¥ ,,u1 I'
Covers defensive ancl oFfcnsivc co , c
infringen\lml issues.
 - ,s, > 11hen
ll for cm,rs .111<1 ' 11. 11
Protects .:abusincss s a1ln111,1 I10 b II)' . .• . .1,1111
1,,
-

their prol'cssional adv,c cttuh ' ;1

• di1.:·nt \i
, t1n,uh _
__ -
1
 t-
::I
!. : . : .
< o rn rn er r
..:.:
e:,10
216 P, ...

The c• ewall Concept

,-1r
• m or group of systems that enforces a c .
An lnremer firewall is a ksystec
W.h
and the Internet. 1e ew·
Tl l:ir <l
etern1ine
. <:urn,
P!Jlin h.,
. ·• networ aIl 'd • ·, ·"l
1n,1dt ,
h
an organizauon• th outside which oursI ers are pennitted acce
JJUIY be accessed fromh_ he outside 'services may be accessed by ni,ic.le S.\ to lht Pt.It:,,,
. . and w 1c r,. Fr, 1
inside services, afti and from the lnrernet must pass through the lir- 1
ij l11c\.
. • all
be tJecnve.
c 10 musl permit only authonzed
Thetr firewall • .
1ralfic to pas . andewa11
t h e wh' er
be ins t&lune " ro penetration, Unfortunately. a firewall system cannot otter hre1,.a11
must be immk h got through or around the firewall. <111} Pr, ,.
once an attac er as . all . .. .""{
. . rtant 10 note that an Internet brew 1s oot Just a router.a b
It 1s 1mpo. . . f as11,,n
a an o of devices that provides .secun ty or a netw. ork. The firewall .• Pillt1' 'Ir
.h,
combm n
overail rity nnlicy that creates a penmeter defence designed lo. protect the f <> I11
urcessecuof the I'organization. This . secunty
. pohcy
• must LUC. 1ude published \ecuntv In orm .. .,·
•resionform users of their respons·ib·il·it:·tes; corporate po·Iic1· e ti o·mg network ac·ccgu,11clloti
esd
d. 1 . d d' 1 di ) ,st!\1:1
a, Occess. local and remote user authen. t:tcau• on,ia. - m an ra -out, sk and data en c
and virus protection measures and emp1oyee t.rar. nmg. All potenu·aI po·ints of nel\ orkl•"\Jlli,
must be protected with the same level of network security. Setting up an Internet fir:
without a comprehensive security policy is like placing a steel door on a tenL ·
A firewall is an approach to security. Il helps implement a larger security poh,y !hi
defines the services and access to be permitted, and it is an implementation of chat pob .:
terms of a network configuration, one or more host systems and routers. aod other secun11
measures such as advanced authentication in place of static passwords. The main pul"pQ;e 01
a firewall system is to control access to or from a protected network, i.e. a site. ll impleWJID
a network access policy by forcing connections to pass through the firewall. where lhti ,JJ:
be examined and evaluated.
A firewall system can be a router, a personal computer, a host. or a collec11on oi ho,;.,
set up specifically to shield a site or a subnet from protocols and services that can b abu,ec
from hosts outside the subnet. A firewall system is usually located at a higher-lcvd ga1 11ai
such asa site's connection 10 the Internet. However, firewall systems can be located al1° «
level gateways to provide protection for some smaller collection of hosts or ,ubnets.

Why Firewalls?
Thegeneral reasoning behind firewall usage is that withouL a firewall, a subnet's ;i,n:•
exposethemselves ehrent l ·insecure services, and to probes and am1.:k 1·n,01 •"''
lom· Y
elsewhere on the net k fi I 1 · . iol 'lli l , ,n
1n . woe • t rewa l -less environment,
. network securit) .r l ' , e · · I
a •mus •m Ia sense, cooperat e to achieve a uni formI\
h
hosts
of
ost secu
.
rity and all 11••h··• 1 1(

um e s ec;: :·0 W:ger

 di( th
c-• e ubnet, the less manageahle it is to nuiinrnin all hn,t, n: in,
occur
u not the
secun ty . As mistakes and I . . 11 hr -1
resuI o t r apses m secunty become morl' i:om111u · . 1 J
Ulldequate passwords. complex attack be I •ur1111111'
111 cause of simple error 111 t·cu1 ig '
b
s,
A firewall .._ ,. . ,oil
"'-• . 'T.,.._..provides .numerous a d vantages to sites
. .·r·1sc ''"
- leCUrity. The follow· by helping lll incl .. ii
mg secuons sum , . 11rt11•
manze the primary benefits of u 111g
1 a
 protection of Vulnerable Services 117
;\ nrcwall can greatly improve network. sec. u n t y a nd reduce. ,
nlleriog i·ohkcren·Lly in ecI ure <tervices· A s re ,u l 1 I n, , h) h11,1
:a
fc ,errts ·s. smce on y protocols· , • t 1euhnctnetwork en · 'on the ,ubni.:t, bv
10 selected
Forexample,a ftrewallcould pro • •. w,11 he .ible 10Jla, 1 vimnmcnt is expo ed
File Ss) tem •
from eme,ing or 111h11 ·rt ' I 1rnugh the l
•rcwall.
. (NLFh 1eav•,ng " 10 vulncrahle ,er.v1ccs u;;h. N
S)
a
,ifpreventmg e service frombeing . prn1ectcd uhnct Tl · . il, ctwl)rk
rn, 1it the useoftheseserviceswith exp 0 11lcd by out 1dc attacl:,c ,&,.rrovidl! the benefit
i-·
111 great1y redu d , · 11u1 at the ame 1•
Firewalls can also provideprotcctio r cc nsk of cxplonat,on ,me
;ind ,iu.:mpts to dir n rom 1·11utin<> b d ·
re ect routing path&10com b. ase auack\, uch & \c>ur routin
protocol orICM.P redirects. A firewallc ldpro'.11,setl Sit1;s via lnLcmet Control M e s. .sa ge.
OU reJeCI all &
redlJ' cts and t1i cn miorm administTators of lhe .incidents.
.
. <Jurcc-routed paclr.eL1 and lC..MP

Controlled Access to Site Systems

A firewall also provides the ability to control acces l ·
can be madereachable fromoutsidenetworks .: 0 SilesyS tems. For example. some ho ts
d . , w creas others can be effei:ti vely '\Caled
Ir from unwaote a cess. A site_couldrevem outside ai:cess to its hosts except for al
cases such as mail servers or mformauon servers. pee
This b gs tothefore an access policy that firewalls are particularly dept at enforcine.
don t pr v1de access to hosts or services that do not require access. l(. for examplea. u,;r
requires little or no network access to her desktop workstation. then a lirewall can .:nforce
this policy.

Concentrated Security
A firewall can actually be less expensive for an organization in lhaL all or most modined
software and additionalsecurity software could be located on the firewall !.y 1e= as oppo,ed
to beingdjstribured onman.y hosts. In particular, one-lime password <\}'Stems and other
add· onauthenticationsoftwarecould be located at I.be firewall as opposed to .:ach sy<t.em
that
needed to be accessed from the[ntemet.

Enhanced Privacy
Pnvacy is of great concern tocertain sites, since what would nonnalb be ci)n,idertd
i3nn0<:uom
infonnation m iohtactuallycontainclues thal would be usef ul io an ,tt ta c k c r .
' " d · N S e t , cc
U ,' .n g f i rc Y .i l l , O
some F m i !cr
sites wishdtoblock
1 , pl services
:i,' such as finger an 1 · •1 d Oth.·r
· . . · · • bom•1uhtner thacncv h,1,c rcttLI n1:,11 .m
<
nfonnauoo aboutuser•s such as their Lasl 1ogin umkt:w c b 0
· I h ·)\\ .ot1cn J ,},tcm. is u-.,J•
1
items. But, fingercould leak information toauac·ers a. . 1 ,.. svstcm ould tx·
au.icJ..cJ
1
whether thesystem hasactive users connected. and 11
hcllli:
 ·••
without. drawingattention. bl ·k . !It'. s, ,tcm, thu,. the
til"'Lll
trewalls can also beused to
DNS oc1nformat10 1 1 ,v ln·t.:ni.:t• ho,b \,>11\L' ,1tc,
· , .
F . .
Id 111,t be uvt\l a,,1 10
1 b.
1
of sitey wms wuu, ' h d ng 1.111tl£11\at1•11n
names and 1 1 t\t""l iu\J olh n11,.: c
TPaddres•.ses• "
feel that by blocking this informa11on. 1hcy :m: •

useful to attackers.
! 218
Need for Usag
e- -==-:::: . Network
f- <·omnir,c-0,

m the Internet pusses through ti h_rcwall, thelirc:wo11c·

'
1
J\,il11c1 • p
"'··r.,•,

all ac:«SS 10and fro . • , about network usage. A l1rcwa.Jl, withupn. •tn lot
Ifd
providev al abletansucs •,, I ·1 ,,1onri111, •t...,
an bell u . · , .. ,1 occu rs, cun also prov1uc c elm s onWht•th, t 11lilrni
soundw d
suspiciousac11v c, lhc hr,
1)
. robed or attucke · t1>.•IJ
netw<>Ck are beingP llect statistics about network u ugc and cviut;n,•.
11. 1s•
. mportanl
• 10 co
Of •mary, importance ,s. . k•nowI11g c o1 Pr,)h 1 ,.t 'll\J
. wI HllI 1cr the l1rcwa1t
be of reasons. pn b I ·1 , I,\ 111,u Or•
D I I I
. ... , , and auacks. and determining whet er .
D r •contro:, on the hrcwau. I1"•.n,1
. .,..,_. - t1e JcJ
NW-eork t .. 1,,.s arc also in1portant as rnpul 11110 netw<)rk 4(<:qt.._
requircr,n
usages1a11s 1.... 0c rs \tu-...
risk analysis ac. uv1.1. ltt 1.-
1es.

Policy Enforcement
Lastly. but perhaps most importantly.
. a firewall provides tbe
. means for implem,COhng W!l;j
enforcing a network access pohcy. In_effect. a firewall provides access 10
u., l"l Jr.I
control
services. Thus,a network access llcy can be enforc d by a firewall, whcrca, lluhoura
firewall. sucha policydepends en ely on the cooperatlon _of the users.. A site ma: heab:.;
to depend on its own users for their cooperation. However. ll cannot or tt should nm depe,
on the Internet users in general.

Firewall Components
The primary components (or aspects) of a firewall are:
I. Network policy
2. Advanced authentication mechanisms
3. Packet filtering
4. Application gateways.

The following sections describe each of these con1ponents in detail.

Network Policy
twolevels of network policy tbat directly inlluencethe design 1n,1all;tu,,n: .:
ate
• flfa firewall system. The higher-level policy is an issue-sp.:cifk nct11u1I,.;.1,·,,·,, r•'.''·
51 - .1.1_ serv1·c s h' h ·11 · I • r'''11"''
e w 1 c wt be allowed or explicitly dcnwd lron1 l 1, '. · .
=t. how these · ·
I
r ,• ,'.
. services will be used, and the conditions for c.x,·cptwn, ... ,,
h• 111'
F·levcl pol y describes how the firewall willactually go ,thtllllr,,,1n,·un1?ih,·.,,.,,
t he aerv1ces th t d fl - .. ,11, 1
. . .,- -
Pol.iCICI 1. n abriewf.ere e ncd in the higher level policy. nu: foll,1111111-"

111d• pcm
the service ace ess policy
• should focus on Jntemet-,p,·u
. r 1•' •usr11',,,.111.l
It''•

._.Well. alloutsidenetwork access (i.e., dial-in p,1h1.'}· ,mJ.s 1 ,, wl

1
• Policyshould be an extension of w1 ovc1·:ill nr/!:11111·'11
 219
= - ==----------
l:":-1-I"i·>· regfarIdjnhg thepTo. tection or ini-ff:or m=a·t=t ·on r es

i,e' uccess u , L e
• ti access polic
service ource in th -
ore
a implemen ting rewaJ\. A Y must be . e organ· .. Fllr a lirewall
be,, k
reat1·s11·c polircea1_. 1slic andou. l11
nuIL<1aUdon.
rotecring the networ. from known risk y is one tlial : n should be drafted
r·ources. 1f a firewall system denies or '. While Still providinprov1desa balance
betwee11 res restricts s
r lo prevem thel1rewa1r.·,e.rv1ces, g users a
lite service access po icy il usually reui ccc s tc,network
"OC basis. Only a management-backeds s,tctcss controh frttm. " tes thestrength of
v e1ng
ad A firt1wall can rmplcmcnt a numb • ound can provid e th ·. od1' fi
" p fr 1 edon ru,
°.
er o servic e
ic y
. . is.
m

polic,v roay be Ato

al ll oh w no access to a ·site f rom the Inatccess oHwevcr a ty 1
policie·s
10 th.: Internet. no er typical policy would h e to a l l oCwT n. et, liut allow acce., from
p ie a_
theerhl aps
t e onIy to se Iected systems such a-, jn o 80
rne acceh from the Int. ·
. • · • . . rmationerver . . d . crnet. but
P .
oflen imp1emen1 s ervice acces :, policies a e-ma,1server
. A' h , .
a ow some n
s
11
. ,·• 1"rew,a11
that u .,
, elected intem dl os ts, but Lh1s access would b e : rac c e :. from the ll)
·lnternct
• • • e granted o 1 · r
11 I
could be comb10ed with advanced aulhenlicatJ·on. Y necessary and only if ,t

firewall design policy. The firewall design pol' . .

the rules used to impJament the serviceaccess P i ytsdpec1fic tothe_firewall It define
vacuum isolated from undcrstandincrissuesstic,haoslry. n. ecanbn?el sign I.his policy tn a
. o 11 capa 1hlles and I · ·
II ewa
threats and vulnerabilities associated with TCP/IP Pire 11 ·. tmuauons. anti
following two basic design policies: · was genera Y implement one of the

I. Permit any service unless it is expressly denied

2. Deny any service unless it is expressly permitted.
A firewall that implements the first policy allows all services to pass into the site bv
default, with the exception of those services that the service access policy has tdenlifi.:tl a·
disallowed. A firewall that implements Lhe second policy denies all services by dcfau!L,
hut passes those services that have been identified as allowed. This second policy follows
the classic access model used in all areas of information security.
The first policy is less desirable, since it offers more avenues for gelling around the
firewall, i.e. users could access new services currently not denied by the policy (or e,en
addressed by the policy) or run denie<l services al non-standard TCP/UDP port lhat art not
denied by thepolicy. Certain services such as X Windows. FTP, Archie. and RPC cannot be
filtered easily and are better accon1modated by a firewall that implements the t1 1 . 1pi olicy.
The
3
second policy is stronger andsafer, but is more difficult to implement and may1mp 1 tN:N
in that certain servicessuch as those just memioned may have to be blod,ed or r tncted
The relationship between the high-level service access policy and tt low:rlcvc!I -:oun
.:rp:l
 is reflected in the discussion above. This relationship exisb be cau se the '1 : iP ( c m ,1n l tl<J
h
tnifn ,", T · J 1t m 1 1 · 1ll ll l l\
l e service access policy is heavily dependenl upon the capab1 iues t nc I .111•, the."'·nted
fi a) · blems assoclllLCl \\ k

r ew I system, as well as upon the inJ1ere nl 1 · •· .. a.""' pohn 111.1\

In
sect unt y p ro · the siin 11.:t· C'-'",.,
d r services.
emet , d For example wanted services e ,ne 11 · •
in<it t-.· .;fti:-:•,.cl)
havet be
tJicsc ' . bl · 1n '.
sen 1ct:s c m
O denied if the inherenl security pro ems . • " ta l .e, 1,r.:cc,kn,e
"Ver
COnttolledbY th 1e ower level pol.icy an.u1•tf th c,- s,-·.urilYol I· on
· , ,thc c ,er.\•
Other
then . etwor 1 c.
11
,actors. • h 1 hc·1v1h Jcpenc" .,.1
·1
to
llleet· On the other hand, an org:rnizauon l a ' • •• 11 these st·rli.:c, · ns
t
. •k and •illuw acccs
lls mission may have to accept highern · '
 ---------:-=: ::--::-: ::: :·An
E-commr,r,.,
1
. access policy and iu. lower-level cou 1n<J
0
'·1, ,,.•
a
·h 1.
. t,eiwc:en these rvice
. ._ th mus t. e Tea lbllc and nte "'a
_ _, . · r 1t 1
pn ,v uc mg
rel1tionsl11P Nw•ess in defining .,o. ' . ound Poli•·•'""1!
·ve p,- . . , ihemos• significant component of the ', . 1 '•
an i•e= ro
n, ,.1!,
descr.i.....·$ervice
1 1 ~ access pohc,ysused
m n onents ore 10 implement. and f enforce
• thePt)li irdY cr,bcd
, ( \n·'
.,,._ ot / l el' three co , .,- .y should be a rellecu on o a st rong overall orou a . : a1 n·t
, .,e ·. eiu:ccs po1ic . . .,n1zat 1 ,,.,
bovt the serv1c • f the firewall system ID protecung the networkd on '1:1.1 '
1

• • '!1le e ffectiveness .Ot'<>n used. the use of proper fi1rewa II procedures epend 1,n1' 11•J
p0licy.)
of firewall implementa • . , and the I t
type . Ci,,i,_,
access policy. .
Advanced Authentication .
Secur ity laps e s o n the identity of Internet users have occurred
h 10 bpart
· due to
d. the
.weadk11t . h t a d itional passwords. For years, users ave e en v ised to
choose . a, ' 1
associate w,1 r al h . d El Pa sv. o ,,
thal wouId be fficuJL guess or not to revc· t eu passwor s. owcver even
• . . .' u1e
i., 1
dl 10
u·

follow thisadvice (and many do not), the fact that mtruderscan•_iddomonitor the lme l
, . , passwords that are transmitted in the clear bas rend ered tr a<liu ona lpasswords O\isoJ
, o Advanced
r authentication measures such as smartcar ds, aut en.11catJon
h . .tokens,bioroe«it1
Cl

andsoftware-based mechanisms are des_igned 10 counter theweak es es or traunionai

passwords. While the authentication techniques vary, they arc indeed Sumlar in one
aipe,1 The passwords generated by advanced authentication devices cannot be reused by n
auackt, who has monitored a connection. Given the inherent problems with passwords on
the1nte1111!
an Internet-accessible firewall that does not use or does not contain the hooks to use
advanced authentication makes little sense.
Some of the more popular advanced authentication devices in use today are c lltt!
one-lime password systems. A smartcard or authentication token, for example. generate;1
,esponse that the host system can use in place of a traditional password. The token or
can! works in conjunction with software or hardware on the host, and therefore. lhe
generated response ls unique for every login. The result is a one-time password which. 1f
monitored cannot be reused by an intruder to gain access to an account.
Since firewalls can centralize and control site access, the firewall is Lhe lugical plart
for the advanced authentication software or hardware to be located. A Ithough advanced
-.Cn on mCl!Sures could be used at each host, it is 1nore practical and rnunugeabk t,,
the measures at the firewall. Figure 5.4 illustrates that a sitc without u tin:wull u IP£

r·
ltlVIIICel1 authentication permits unauthenticated application traffic, such ns Tdnct•>1 .11'
.41iud1 to site 5Ystems. If the hosts do not use advanced authentication, then intruders coulJ
Ip crack passwords or could monitor the network for login sessions tlutt W(>Ultl uiclu-"
, .. . w o r da. The figure also si ' te w·ith a firewall u l.llg advanced ttllll''.•ntl a u. on.
.iiini! h t h a t. ..
shows a,
·llfflUI'""'""" aIIItDa.ea t-.o_ r FI'P sessions ori g ·mau· ng from the Internet to site systt·1n, 11111.st
•n·a" tll' .,.._...,cation
' before be· • · · 1
1 •111, 1ni
,.. .l1 ltM: p a s o r da ma
perm1ued- u, . .1 :abefore
t i permitting access. However 1hc c
the site systems. The "' s•'
iJ lll'
pas:.wor(b woii .1,i
_. on, even if the ' 1, advun•
.lllMnt ....••A ft•'-- passwords arc monitored, a1-long as tic "1,r
.»
i'!:T"J:'l"ffl'l"':-
, i 1n111
1
-r firewall component11prevent. .mtrudi.:rs t.rom, 11r

pc c
,
 2.2.,

Unauthenticated
Telnet, FTP Traffle

I ,,....--
Firewall System Authenucated

figure 5.-l Advanced authentication on f 1

a irewa I to pre-authenticate Tein"'r>, FTP trat.h,

Packet Filtering
IP pack-et filtering is done. usually. usin"o- a a filten•ng rou1er d•sum·d r
P c ·1
ket
packets, as they pass between the router's interfaces.A pack ·et fil1erin"2· ,irn utt'n- ne
e c
ro ute
Jilter JP packelS based on some or all of the following fields: - r Uliua ) can
1. Source 1P address
2. Destination JP address
3. TCP/UDP source port
4. TCP/UDP destination port.
Not all packet filtering routers currently filter the source TCP/UDP port. though ,en,for,
ha,•e now staned incorporating this capability. Some routers ex.amine th.: router·, nct"ork
interfaces in whicha packet arrives. and then use thi asan additional till ring ntenon
Some UNIX hosts provide packet filtering capability. aJ1hough most dt' not
Filtering can be used in .a variety of ways to block connecuon, fr,,m ,ir 1,, sp,x1t1-
bosts or networks, and to block connections to specific ports. A ite nug.h1 \\ 1,h Ill t> t,l,.
·I connections from certainaddresses, such as from hosts or site$ that 1t .:om,id<'r' Ill t>e h,,,t,le
or untrustworthy. Alternatively,a si1e may \Visb lO block conn .:u,,n li,,m - II a1'ddr<'; '
CJ;ternal to the site (with certain exceptions. such as SM TP for rece 1 v 1ng -m; u l ) 1
oun,
r U ) I . .- r 1al11'1"...,,nnn-
As an example of packet Ii ltering. conshkr a po l)tlh
1 '') rn '1 .n , t,, ,,nh 1,n<'h,,-1.
1
I lO a network of address 12· ·34 *· ·* . Telnet connectums \\.Ill b,1111
. i l l\ n \ < 1
I 'i : \1 11' ,·,',11
• l 11
,,,111 1,·, "' '
23-4-5.6, which may be the site's Telnet applicatwn g:He\\':\\.• h: t· 111,, et.-,•1n1n1,
be 11 'i S h ·b n1·11 b, 1 ' '1 " ' •
_a Owedto two hosL , 123.4.5.7 and i 23.4.• '· " ic • 11 1 ·d ,11th 11 ..,m 1h..- ,11•'
N,,mNIIaiT,1,"
l gateways NNTP (Network New
. I;1 4 ...Q :111,I "• •
Tran fc:r Pnito. .:,,I )
. N
N TI '
 111 1"'
· · 48 ·-?54 • ,inti only
S\'l'\l'I. - • • •
P feed system' 1296 llll' "
<N All nthN "'" 1 ..0 t 111, cr, ar,· "' ,.:-
.-,·,u ' •
etwork Time Protocol) is allowed w ull ho\1 "· •
blocked. An example of the rule-set 1s in T:iblt- 'i...l.
 t SMTP Traffic only PacketFIitering Router

... ,.lnJterne 1

Telnet Traffic Only

-·-
Figure s.s Representation of packet filtering on Telnet and SMTP.

TABLE S.4 Packet Filtering Table

f ' -·• Jill Destination Source port Destination Actioo

... iiddn11s address {>Ort
TCP • 123.4.5.6 >1023 23 peanu
TCP • 123.4.5.6 >1023 25 pennit
TCP * 123.4.5.6 >1023 2 penn1t
TCP 129.6.58.254 123.4.5.6 >1023 119 penmt
UDP • 123.4.*.* 123 pellllll
>1 0 23
• • • ,. * d n)

1bc first rule allows TCP packets from any source address and port gre ter Lhan ; :
CIII tbe
Internet to the destination address of 123.4.5.6 and port of 23 al the site. i>o. g(li
die port uaociatedwith e Telnet server. and all Telnet client should_hav: un::' ,-er,
,. poda of 1024 or higher. The second and third rules work m a srn11lar (ashi •ucJ
.... .lodeatination addresses 123.4.5.7 and 123.4.5.8, and·port 25 for S1-tTP. are 11
,,
'Illefounh rule pennits packets to the site's NNTP server, but only from sour, \N11'
.6.48.254to deatination address 123.4.5.9 and port t 19 (129.6.48.254 i theon/ 10,1(11
-••-.·.. •lite should receive news from, thus access to the site for NNTI' 10 "" ,-er.
-) The ...... xiseL1 tu
• - • ...... rule pennits NTP traffic 1 which uses UDP as opt ' . II u1h,-r
9 • toany
t,'.l destination address at the site. Finally, the sixth rule 0 0• •a,bc1>·
• ii IIOl pre&ent, the router may or may not deoy nil oubscqucnt i;1,11 11 1
,,......!llltPwaemple of Packet filtering. Actualrulespermit more complex
•
 V'hik sornc ol 1hcsc ,c,vkc• 'l .
. ., ' IC1l 'I\ 'I
223
. • 111 thc,,cc1v1<:c,- con1pk-1<.:1y ,nauh '· c •H:1 or VI p
u•• '' " ' I
• r • i ,cqunc.
accc:-, lo ull , l' loo,,,.
sc, vicc, 11 <INltL a nrc
lo1 inhcnmll Y nsky, hlockinu
Sll•p
lly
••uc •
· I iten1et to on y I 1 IHS yl'
Mcm, 1 ·01 cxu1111,1 m 1 my \lie, N 1 "'
. c, rc ,n 1;,1u 'I' . ·
th• I
1hut ,c llllII\' Ihe IIC o, ,, I •Ystem,
C1n 1 ur F(l>
11
,•,isl St•rvircs Nuch n, NNTJ> muyhccn, 111 . , cc , c:111 imi1rovc !he ,c Mee.- from
u,111 ,hos,· ,yMl'lll thm nccd them hcl11•· lpo 11111(, lhrcat. hu1 rc,1rict 1nvuri1,y oJ U\cl'\ a1
1, 1 '
1 1 1 1. ., o crc·11c t 11:sc ,crv·
1
. ,
1
• :, ccan1;1 network · · ice,
ttt'> thl' liJ..c 1100< o cxplnilalhm liorny 1l11 11,scnv• • I env1rnnmcnt and
r<< l1 c1c1vulncrah1l11rc\ und ihrew,
c 1ic
,4ppfication Gateway ' ·
counte,r()Im: ol lhcWcakncs\Ch ussoo,uicd w1·il
r·c11,of1ware • • 1 p ckc1ltlicr' ,
1
u,;-rl'
upp 1cu111111s lo lorwar<l anll fillerc 0
Such an apphca111111 . . . ts rclcrri;d
. to ti\ a pmxynncctmn
.
.
. · r,1 ring
. , rr>ulcrh.
·. such
services
fircw;.lls need t<i
a 'Iclnt:t ant!
l r ., Cl vice, wl11((! Iht: h, l
t•ivire is re ,cm;u 10 as an applicaLion Ap . . . 1s runmng the I pro y
P 1
' gateway . ·
router can be combmed lo provide higher levels of IC, tlum gateway1, , 1nd . k
. · _'_ p ac et h lcnng
wen.:. "d·•l1)nc security and rlcx1b1lity than if either
U!' ·

What Should a Firewall Contain?

- Once the decision is made to use firewaU technology Lo implement an organization's ,ccuntv
policy. the next step is lo procure a Arewall that providc-s the appropriate level ol
protecuo and is cost-effective. However, whal features should a firewall have. al a
rmnimum, 10 provide effective protection? One cannot answer this qucsuon entirely with
spec1lics. but ii is possible to recommend that, in general. a firewall should have the
following ,gruricant features or attributes.
L .Be able to support a "deny all services except those specifically penmttetl" de>1gn
policy, even if that is not lhe policy used;
2. Support your securily policy, not impose one; _ _
3. Be flexible and able to accommodate new services and needs ii the ecunt} policy of
the organization changes: . • . r. . ,
4. Contain advanced authentication measures, or should contmn the hl ok, .or in,ia1rn
advanced authentication measures; . Ii d h l,t ",tem, J.'
5. Employ filtering techniques io permit or deny service to specLc l, ·,· '
needed; . . . • .. rTP and Tcln<'l. s11 that advan,rd uu1h,·n·
6. Use proxy services for services uch as . iire,,all 11 ,<'I'\ 1,c, ,u,h
. . I d and centrali1ct 1 al I1\C . d
t1cation measures can be emp oye • .. sh(luld cnntuin the .:t1!'Ti."s1x1n ,ni:
11
r as NNTP, http, or gopher arc required, thc firew,i
d proxy services; r ,Ju.:c thr<'ct s 1TP conm.•c-ti,,: ,
1 11
7. Contain the abilily LO ccn1rali1c Thi
SMTP s n:acl·css.
ults 111 l:<''.. inliicd
• h,inJlinf ol sile e,mau
f bet
· ween &ite and remote systems · · ,1
11trmuuon cJn !::
blI'c 111s,;r'< '
, .· IC such 1hal pu J w1 re,1u1r<"
8• Accommodate public access to 1I1c s, · · .. ttc ,s,i,·111, 1h.1l '1 1
protected by , . ,re11•itcd 111111,1 ·
h
 the firewall bul can c sq_! =-•
the public access;
 224 ---------- -------:.::·" "'"'t<>,A
concen u:ate and filter
d dial-in
, . acceg 5
, d'
'4.n-.
h.
,,
eon :..
_._:,'
'n the auu 1Yto I0 gging traf1ic an susp1c1ous activity
1
'-."ii.
9. meehanisms are readable and understanda_bla· nd alsu ,,"·
JO eon-· . for· gs
· for log so thato1 e,
th and correct_ness is verifi•
redueu_oanmanner
10 that its s1reng
""t
i,1
e developed th3I it can be undcrslood and mam1 inec1; able, It, .
JJ. B , fl •
simpl e designso and other bug xes,I a1 ar l une '"'I I
" 'I,
in regu inte
h
pd8 red wilh patee
5
rva1 .
12. Beu • operating system such UNIX, a ecu d ·
all requires an U ·th h re v...
"- If the m
w<-w d be a part of the firewa . w1 ot er securitylOOls --•100
aperating sys1erosh ul 't The operating $ystem should have all patches necc1s1
ensure firewallh sl= e should be flexible. user-frien_d_Jyro programa. 1t.11IC1 1 l\J1,
The IP fil nng 7,ossible including source and destinal1on TP address shou1 fili
on as many attnbutesasTCP/UDP
and desunauon port, and inbound• and outbound
h interface···Protl\cc.111);·
source nd btably more issues and reqwrements. owever many or
There arehu ·t 0: own needs. A thorough requirements definition and hlo11
llll Will
specific to eac s 1e . • he\ ""
'dentify most issues and requirements; 1owever 1t should b ee e- b ...
assessment w1•ui , rk N 1vu1nerabil"1t1es can arisemp,.,a;itio
. [nlem et is a constantly changmg
.
oetwo '. ew ·a1 d'ff i . '
•tah an
t d enhancements toother serv ices may represent potenu 1 cuh1 cs for a n,,u ,
services
teh . , 6ll'lllll
installation. Therefore, flexibility to adapt lo changmg nee1 • 1s an 1mportan1 considera1illl.
.

Benefits of an Internet Firewall

Internet firewalls manage access between lhe Internet and an organization', private netwo1k.
Withouta firewall, each host system on the private network is exposed to attacks from ollm
hosts on the Internet. This means that the security of the private network would
dependoo the "hardness" of each host's security features and would be only as secure as
the weak!\! syJICm.
Internet firewalls allow the network administrator to define a centralized ''choke
()Oiw.· that keeps unauthorized users such as hackers, crackers, vandals, and spies, out of
Lheprota:ttil network, prohibits potentially vulnerable services from entering or leaving
Lhe pr t(Cl aetworfc, and provides protection from various types of routing attacks. An
Internet bre\iall ti plUlessecurity management, since network security is consolidated on the
firewallsyscem> llllber dwi being distributed to every host in the entire private
network.
Miewa!Is offer a convenient point where Internet secarily can be monirorcdnd alSll;
ii':'.lt sbould benoted that for organi2-ations that have connections to Lhe lntemcl. .
11 not
beth · : 1ra1ors
w,l-"
w 1111 1
d
er lt ks will occur but, when do they occur?
Networl-.a
llldthe all significant traffic through the firewall. If the network admi_n1_ m- ire
to rcs nd to each alann and examine logs 011 a regul ll;:1 ·re,l"Jil
l'W all, smce the network administrator will never know ii ti"
}1tacked1 .. thJl
the Internet has been experiencing an i1ddress spar,nst 1 t 1,1
'liy eabae scarce resource. This • . wan
mean that organ1zam >n
•
111
et'l1
IIOt able to obtain enough registered IJ>addrcsse IO e
 ,.. e c 1 i r t ¥ ; ; ; ; ; ;,;;:::-:::
\odrcss
d.of ,h eir u ,cr p o pulation . A n ln temf ir
J t11110s• rra11sl:nor (NATi that can help al l • ewa11 i a 100; ., 1
bet h ev1a1e lb, d .,.cuplace l d
'25
2

' Jl&ed to renum w e? an orgunization chano.•c a tire \ Pace ho eploy a Ne1wor1t

th , Internet f irewall is perlect po·tnl ., c s l ls ISPs oriage and el,
, ,n . . . to . iu u · · rn1nalt
l he
.
ork
adrn1ntstrator lo JUSllfy the exp 1
1or log lnie 1
1hC )lu';nntential
lll ' " ne handwidth boLLlenecks andcpnsr·e of lhe Internet co 1:tl1on age.Th, perm,,·
rorgo111
, . _. .ti,za11
I,S-1he
•
on ,s Ii ' OVtde a m"h for
(CJ
llll,nagcmem
f 1h1, fi I llancial model· .1. od ,,.. mental cha
I1 An 111rernct rewa can also offer a central .
den•rt
rge-bacl(.,'
. , . ro customers. Th e internet firewall i lhe 111
or contact for infn
crH C "
°'
•ctP
1
fi
' d FTP servers. The rewall can be 1 ca locali 11f rmatmn del
1JO •I, • • •e ° ordeploying WtJrld WdI etVtl")-
configured 1,. ..,"1"' ow Internet Web
,, h1 ·ie proh1b1t111g 0 cx r
. hn a acccs lo other •systems accc,s to the ,c
final!)'. some m1g l argue that the denloyin on fthe prote c 'ted network. ,en·1ce,
•
t• ent o an lnte fi
n111nL of foiJure. It should be emphasized that if thec .rnet lOrewall
r- , • l t k . . onn ecuon t h In create," ,in•le e
rcani-zalion s pn va e n c wo r' w1 11st ill continue to b e ternet la.lls. ihe
o,., .1 . f O
perate l ough the lm
If [here are mulup e points o access. each one becomes 3 tent" . ernet acce!;!> "
Jost. network administrator mu t firewall and monitor regularly. po Jal point of auack
that the
By adequately securing little c-01ncrs of cyberspace· you can .tnst.il and maintain_ th
n"•hl level·s of t ms· twor thinetsiss• that your customers both demand dd . , c
h an eserve We have s«o
ihat c-secunly requud:es a o ·uc •approach. .It is as much a set of·
behavtou a. .•tt 1s ab ·unJl.e
of software to_ols an ne wot:k sruff rs which, by t.hemselve . llllght lea,e us with a [al5t
sense of secunty. Analogies abound 10 our everyday lives. We buy expensive alarm
svstcms for our homes, move around elite communities, opt for a German Shepherd or a
Dobeanan Pinscher, and yet we know that these are only partial solutions.
True security requires that you educate yourstaff, develop manageable security pofu;ie,
and procedures. and create a secure organization (whether it be one or many emplo)« l
that enforces those policies. It requires that you properly configure your necworl- for your
organization, without assuming that off-the-shelf con.figurations are righ1 for you. 11 !!ho
means investing in the tools and expertise that you deem necessary to eYaluat.e and moru101
your network in order to detect intrusions before they actually happen as well a, de,·elop
a clear strategy for dealing with an intrusion when it inevitably happen, Finallya, "° unc
network calls for constant vigilance. This means keeping up with the technolog1 al change,
:iround you by reading trade journals and periodicals. joining user group, thllt Ji u." cunt
issues and disseminate the latest security information. and attending conteren.as. ,cmmm.
aad any relevant training that will keep you abreast of evohiog secunty ueed,

Defining an Enterprise-wide Security Framework

Trad'[' ,• •
111 munic,1tc I, , . 1tn•,t1H'> f ,,,1n
1 ionally, organizations have relied on poltcicsto0 h11!h· '" ' 1 1,irt1
the . . · k a tl1p-d,1" -n1\ ' c9.in,
·1 tlu•nrl/
. management. ThesedocLUnents once, sued, pro,ll ' J •rnpl<>) ,·, t•urih<'[""·*
in the
•• company-from•business • to dcpanm.:n 1 11
units ' indn1 mi.11 iu·, ,·H'lu11 11n t,•,·11 •:111<'
u1e5e pol' . • ·111 1he ur<>anI ' · 111 I11 artJ "
tu .
1 c1es typically were developed al "' 11,tni1auon l '•
cu -
eoneume
th, 1 • II ·n,,e, tor mt or.,.
.,....,t environment. One of lhe m:ljorc ,a "
·'
 People

Technology Polley

Fipft S.6 People, polirv and te,hnoloS?y model

Al,- aovc towards the unioo of elemeob. the 1.ontrub en, 1ro
.._ • P a-tovcngc. la Wi unden.tand these 1hrec elem nb md1\ldualh
Pert• 1- COft dcuw:n1 i, the most important, The people l"knll"DI romp -.;;
• •• R>lea ad rapomibilities wilhio the organaz1111t111. l hc-..c
arc lht· p(\ r,n:
,. • I lfllc1e I '° ..,,.,.. aad li!lpp,)rt the procc" A fr ic role.-, 1n,lud
J
rmN m
• b:::::U.S. 'Yllem Ind IT admm1stra1t1r-,. end u..er,, and 11ud1wr;
1 1
,.... 4 U -.Glllprila lhe ICCurity \'i ion 1atenK"nt, se, uni\ poh.-. ao<l
•• [ p •-
'ML
• .... 11ba111cally 1he riucn sec-uni) c.-n,1ronnl('OI
D11'W'L:-
I I .,;n Ider IO ror direction und 1!Uiilitn.:,•.
II
-- rt la;;; 1!■ lool1, mclhoch. and1ncchani-m, an pl:i,c 10 ,u
 · y 1001---cmhraccd hy lhc o,·g·in . , - -
• .;ccUr1 1 l _- 227
c: 1Z..:tllon
th• nil" anti opcra11(1nal lonls lhat will f .. , I l IC leth11ology !hen i• lh I
1110 111111 .,. uC1Hate 1hcpmcc , ,, e en01ccmcn1,
fhe concept 1s that each core clement couldh. ..
,ssues can he mea,urcd against thc mudcl cdmca,urcdlt,r cffec11vcncs\ nndc•>vcr-i".
1,1,0. ·
h, , , ctcrm,nc wh· , be
,sue 'fhC t>hJCCllVC I <:n IS LO l110VC issue,· into11,le <11 CUl\lrol \;l)Vt.:ruoc fnr lh·1
1·· i·n·il ob•ecovc
1hC 1 • .
111of muvlng the issue llllo v ,h... -' 1" "111crscct1nn
ldl "'urea, • "
ol the element, "-wnh
c11 0J"c • 1 ot
• . 5,,re· i dcn111icd,heach tcp lof manage
'
ii into th .st. covc111ge,
Iogy. 1 the . the is
, . ,uc r i s kw ·1,I ,, .one ' c,f gn.::u A, ri k
· ' l e policy, or r<:solvud 1 1emcms of
.,.,op • lh . core c
rec no issue 0111: lht: cl• · d
,.- f the tither clements can ' '- WI nt a drcs,ini
enhance Lhi rcsoluuon A lh , cments. ,tJ h
one o,ils environment and uultzcd . . . concert the · ' e Core clemcnt, ., arc addc 111
conlr• ·
• . •. 111 issueisth rtJso1 Ie
'
s coverage 1s g1cater. ·· n V<:u un scv ral lrtmts- lhc
co111rOl·

The People, Policy, Technology (PPn Model

Th PPT model can be illustrated with a few simple examples. Figure s 7 ,how lhc PP'T
moJel with regards to Internet l\sage and misus.c. User are educated on the proper usage
ot theJntemel. The controls environment relies solely on the user. An 1nternct u,age pulic)
is
written 10 document proper use or the Internet and the consequences of misuse 'The controb
environment now is supported by two of the three core elements.

8. Install Firewall +
Train Firewall Administrator
C.Install Firewall +
Train Firewall Adm1n1Strator
Write Firewall
Standards

A.Install Firewall

Policy
Technology

D.Firewall Administrator Leaves

d , ., t•\t'l1Wn1'
. coveragr Iiy II1 r , '
Figure 5.7 lnternt'I connection
. h, 1· . ·ti,· ,, I • ,l,1\\11 )ilhl
hn1 <11
The PPT
, • 1 ,· of a "I . 1ssU.'.'.. 11 I .111 1111h1, 1m11Ill"'I •
n 111
C
lh ,,._ model is simply the anaysis . ,cc.fl ort'.i ·h cnrc ., ,.,,: i-,, all
ck . an he dctcrn 1 11' t •h
c uuce core elemenli, acu on item c n •u,d 111t1111ac -
Ill ,uH •" .
• ' > ,Jcmcnt Ill lW ••
COntro( coverage can be moved 1rom onee
of the elements.
228
ding the secur,·ty Framework
untJerstanreferred to as lbc "Four Pillars'' lo Information se "u ri[\,
. •
nli, ,, Ille(...
l(ey eleme alo • .tnnagementC mmitroenl u\,le:
s o
Solid Senior•"""'. Vision and Slrategy
• An overallsecuntY . . and Awareness Program
• . Tnuning S .
comprehensive ·ty Management tructure including
A k & rrnation S e c u n . F" 58 ey Sl\ill '>eti
• • A solidlni o . . . . as depicted w igure . .
documented respons1b11t11cs
a11c

Business
Initiatives &
Decision Drivers Threats
Processes
j
Technology Vulnerability
and

- strategy & Usage

I
Risk Assessment
_I

C
Cl>
' E
Design : e
Phase €
E Policy ' ll.
fl)
E (/)
Ill
8
'E
a, 1
E
Cl>
C
0,
«l
C
(U
Security Model e
::E
·0
c
l C
m
0,
C
C
l>
Security Architecture and C
Implementation en
Phase Technical Stc1ndards "
Administrative and End-user
Guidelines and Procedures

1
Enforcement
Processes Monitoring Recovery
Processes Proceses

Figure 5,8 Information security management structure.

W"dhia the four "pillars" of the program, several phases are included. t11<· bu,111tS>
._,._ islbcDe c i s io nDriver Phase, which contains factors detern110111.!! oti
• :JJIJl
• '.lbeBC include Technology Strategy and Usage. Busmes frutt ··se-:urtl)
..,,,r ta.Vulnerabilities and Risk. All these combine to form a
11_111lj
i,c <,
1
JOV
on. The"profile" needs to be reflected i11 the Secunt)
 ,.it• ,111,Y
'f)lC ncXI fuCCI ot lht• t11l011111111u11 <• l1Jly I
• >l'Ll 11•1
,. t:nviro11111ct11. a Isu calkd lhc t ),,,1.II, , 1,1111,•wo,J
-uril) i I' ' r 1 1lllM• 11 111<1111l1· ii t
,f\. •111s ,1, sccu1 ty po icy, llw c1u11,· I . ,,,," 1111 I' •ll'l wh' It ''"•'I'" ,,1 ti'1
•ur11c.: • u \·11v ,
,hi' hl"'/ level A key,•knll'l11 111 1l11s 11111. 11 il1>111,·111 ,1111I cl, ,t '" I"'
1 u11•111111,11111r,
1,.c11110 ,. . • 11·ss , 1101 • ' w,11), 11111 1
ihCY ,d 1cd1111ca1 rnntro• 1 111lo1111,,1i1111• 11111 1,1,., Ih "S '"' y1 1111• , 1.',11c 11'111111,,"
' ''I '"' 1h,·
,,i,>11
l".inl11rrn:.1r 1 1
Clas 1hca111m and Risk AsN , ' c111111y M,.,1
1 1
,,r ' "
n1 th , 111. 1
'11111y
·c,,
,11•:•.·''
111c111
I11,w
1
,
the mga111n111011tn 1111,11·,l'" ,,s 14
111,•1111 ' 11 11 1111'1,·1 1111 , ''1" ''
1 ,tti,m u, cts. .' :tpp111p1 l 'ltl'I J
11
'1"'" Ill I h1
. ' Y •111 1 11Jrn11Iy t h" e , \C
,,1111 1111 . f I . 11
' ,md v,,t,1
° j
Tht hiwl laccl ll I lC lnlonnallon Sccniiiy I•
. 1i-: in hy documcn, ttng tI 1cAdmmistntiv. 1 11111rwc11I " II 111pl1·111,·n1 ,111"1 1.1
J I
]'hi' . _ . ' ' \: un, b11I I f cr 1r 1 . ' ,a e
. ,• 11u1dd1ncs mu , he ucc111c1 und ncxihk lor 11 , l'"" du, ,111,1 111,1<:i:cl,,r
, 1 <w,c ., ring. and R ccovcry proccss..:s arc then 'hyt'r •d 1 mn,rn1 l•.111,,r n,cnr
1•I1111110 . It c
• ·urily p,ugrom. These processes arc ·'whcre C
, UI ,I 1111 Iii• c1, U(Jf'(•rl .,, ihc
uliau "'I' cnv111
"' d . thl' l 1111, 11cr,,11t>11,1l
11c1 c the .-., ul" \II 111 l
• '-'ccunty Prt\gram eslgn and documcnt·,tion arc ., . 1 ., ' c >c:111h <ii
•
IJll ., • urm11w11cu 11 ii I 1101 I I
1
unoper:uional day-to-day basis. fl nuuc lcct on
1

secure Physical Infrastructure

All of us are concen1ed about physical and cnvirc,nmcnlal scc.:urity We m;iy nt1l alv.d\
do a fonnal risk assessment exercise. but intuitively. we try to en,un:: that W\! arc c..ur
BS 7799 is very explicit about the requirements or 1his thmwin, which " ••l"Ph'-'••hle 10 the
bu ines premises and business informa11oa proccss111g t'ac11it1cs D 1gn 11nph:mcnt,llllln dlld
monitoring of many controls for thi:, domain will have 111 he join1ly don "'11h the ph)si
I
security department.
Security can be best achjeved by ensuring multtplc laycJ ol sccuril) and n,11,.kpcn<lmc
on a single measure. This principle is very evidont he.-.!. The to1111111' lnr phy,1<:al and
environmental security are delincd in three arllas.

• Security of the premises

• Security of the equipme11t
• Secure behaviour

Security of the Premises

Pb ' , iw h11u111larl' ul th(' pirnu• ' illlI
111111
r
Ys•cal security perin1etcr. We begin hy tit:
111 1 111
1!l . : , 1._,t ''·" w J, 1h,
· • t d
exm · tn tng the security reqm remcnt, 1nsl ! Lh • ns , , l· ,m 1111
a • ·. 11 th, ,111,, ,,,,uit, 11' '
Wtll be un k ,
to walk around the premises I , .. • tl •·1111111 1·, .,luat<' 1 1
1d1 ,1111, I),, ni•I • 41'C
i ' •
.,
 v. 1 1
hh an1 t,, t it · 1t 'll!l'lll'\ 1• 1
1
• c an intruder could come in. Tak..: hd1> 01 ·' Sl' '·
11
"'' u11111t th,·prein 1
'"" '
lll
. 'I11
_
1
t '
on yo . l'·tl 111111111" 1
ur sk ,lb as an uctcct1vc. I·111' " ' • ., ,,. t,·,1 1,,
armchatr
to creat
l
e multiple barriers. . • hi, 111•11m,·w1 1' ' 1 ' •
S J 111\ll h ll'M''·'"'' f I • iii .,11,,11, Ii ,
"" . tart With the outc1mos1 pctimctcr. 0" ,II 1 i,,• phi'"•' 'I'" 11,11,
I 11'•d 111 <1l't H1l 1
r• O V ide? •on nsk asscssn1cnt, Y
1111 ,·nt11 I'''""' \" '•"1h1• i
h e ig
8 d h ,' •
aset Widthf 11 N I n '(11\Sl(1 ,I11 illl' 1 'l ', c 11 110 ,.11 ni:
en 'L or the protcc11vc wa, l ' X, l'I 11", ,.-1111
•·
,11t JI[ "'"'

oUgh? Arc 1
•1
\r,· ilw "1111• .•
tt-,colt- ...,....,..,,1hlf:e door lrumcs strong cm111g 1
"' I .

.
---- -=-=::-:::
111:e, c· = = =" -.
v, 11 e· 'I n Ind
'◄np
230 . D 0 1he hys·,cal barriers extend from real ll "1,.,,
. .-.f with grills? P • .• O()rl
IY 1g. and real ceilmg through which so
.O
r\!41,.• 1,
sc,c111"" false ce1 111 . h . llleboo "'''Iii
tif1Jl gllP 1,ecween akest link while assessing l e pcnmcter tlefe Y t<iuld t, 1
is there aeed 10 detecl the we oatrolled through card-contrQlled cmry gainc 110,,t.,i,
•,,? We n rded? Are they c . e,•1A i,t
11
•
points gua . ·ng the entry points.? re ,,., lh I\•
,coess recep1ionisl moniton c
guatdS or ontrols. O ly tbe authorized · personsI should be allowedac.
C c_..s to
en c . Id be nachjeved by hav inga c ear access control Po l t11e 't<:,
.
area. - T hiso, b,ective co . ..;. olicy appropr iate measures sI1ou b e .in place Tichy def1n1n, ',',i
u . Id
. hts Based o n " " " P • I" e s.wipe . c •"'
access ng · f a c c ess co ntrol conLroll ccl nic._ ,ri,
. k d
dev ices th I
car d
may take e fonn. s and visible identification badges. tior , liii 11 ,,
information about v1s1tor ,1
Secunng . o f1i ces, roo ms and facilities. Location of . the
k secure. .office wahin lhc Phh1
secure
. hould be chosen with care. AU the ns·s perta1111ng lo fire. Ho0c1, C.lf1
penmelers d d. t exp\01·
d other forms of natural or man-ma
t e threat e 1sas er should be considered . Iii>1
al ban
civilIdunres .
from neighbouring prenuses. caused b Y l ea"age
,. of water, spread·
cou so
fire. 1btr . ·a1 E b lk . 10a ,
or storage of toxic/inflammable/explos1:e maten . ven u · supplies like Sla\i4
should not be stored within the secUie prellllses.
The secure location should not be publicized in any manner. No display board,
bannen signs to indicate the presence of any important information processing activity.
Even internal telephone directories should not be readily accessible to outsiders.
Support facilities like photocopier, fax machines. which are constantly acces a b)
everyone, should be located away from the secure area. Suitable intrusion detection
£ystemi lite CCTV, motion sensors etc. should be installed and regularly tested.

Working in secure areas. Security equipment like CCTV and swipe-card controlk,J
gates are of no use if the persons working in these locations are not trustworthy or of!
incompetent, or simply lack awareness of their responsibility. They should be hand-pitkC!l
and ttained for these operations. They should not brag about their nature of work or locaoon
Also, information should be provided on need-to-know basis. Segregation of duties houl,I
be scrupulously followed with strict supervision. Third-party personnel should be gr nttd
cled access. No photographic, video, audio or other recording equipment must be allo111
IIIBide the premises, unless authorized.

!-'•tedlellivery and loading areas. We have taken care of every aspect of physical,,-.: :,
18
lbe above P graphs, but do we know how canteen facilities get into secured pre:01_''.·
How lbe trash takenout? How the courier delivers lhc parcels? In indu tnttl pr,ou-c;,
18

... co,slclbe ovement of i•ncom·ing and outgoingmaterial. AIJ tlr·n, tr,,iftlc l\ N'
constanmt
to• uolaled from the secure offi .
ce area, so that 1t does not pose a threat
Security of the Equipment
111d protect1o ·1· of lll<
. n. Our next concern is the appropriate $ecun) \("1cl
cessmg equipm r 1 11et
. en t needs to be handled careful 1 'l'ht.. 11tht'
on phyaical location. The location should nunim 1.e
1
ror uni
we
II
1c cs ury
ihdl ai.
aCC<'S'-, as
asI
L
lC
well prevent
as
nsk lrum
.
.
nut \noop1n u
--
l
should -
231
,
i,k ,
tJI • I · 1
urn tl1,astc t 1. "" such a6 01
1· c.Jer nsks hl-c e cclnca1 and ch:clmma, ... · r, 1ke fire, flood . m1mnu1,e •lu:
-u n,1 gilChc mterfc . · chemicals e tc Al
, , ,iics. .
lnfonnat1on proccsking w· ii rc ncc, humidit y etc. , so.
pu11•e11111
• • 1 come I h I
ly This .:ould be lhc WOJ'bl lypc ol a den,·I I f Q u l '" lhe ab;encc of, ..
, i l 'J ' , 111 n1 is nccossm y to understand lhe ima '•service au ck. A thorougah,hu11 t,le power
, , , ., e =
· ·irions, cd I I . pact c.,n nun . I b . usme,;, n h
B.i• 011 11c cva ua11011, llppmpn lc •. •ava1a 1lny or pnwcr f . . ·
t1u1, 11,csc couldbe: measures need tu he taken. or certam

1· Taking aplowh er Ifrom. multiple feeds of el,"..c·tn·c supply

2. In case I l e e ectnc supplies fail simultaneo l ·0
power supply (UPS) with adequate banery cu, _Y•.Y u need to have an uninturruptiblc
load. apactly capable of su taining the ,mual
3 · The UPS could in-tum be supported by backup generaror sei,,.
4. The back '1 lp ge nera t or would require adequate supply ueI· Y. h 1. ch also needs to be
off · h I · h
stored Lt rep_enis ment, assured by the suppliers.
5, Proper mslalla. uon of emergency lights should also be 11· ghllll.ng protecu·on
,n..lann=·.
should be provided lo the power instaUation and the communication lines

Cabling security. We really need co remember every detail. including the proverbial la,t
nail. Do we know the physical layout of power cables and commumcation cable, m our
premises? The first step will be lo obtain wiring diagrams and update them. Then. do
physical inspection and assess the protection needs against damage. interference or1merception
F.,tablish the best practices for laying the network cables as well as power cable .
anJen.,ure that 1hcse are actually implemented. The next step is todecide on additional secunty
protect1 1n required for the network. This could be ex.pensive for an old in mllation.
Saiet} measure, like use of aanoured conduit cables, underground ducts. or fibre optic
cabling will require huge investment and need to be justified based on risk assessment
But simple measurt! like providiQg locks to the communication cable
patch board, which are often 11,er-looked.
should be immediately implemented.
Equipment maintenance. ll is noanally expected tha1 due cartl 1, taken for equipment
• . . d F ·ecur·11v ''""k t\\\l mOrt! mca,ure,
mamtenance, and proper records arc mamtame . roma s . • =•,:. • , _ , , 1,,
1
are required. One is to maintain record of faults that were nolu:ed. uml ' ,ccmid ,tr, th
maintain records of aU equipment sent off the premises form:Hntcmmc,·.
S · • 11 1
,· 11f cnmpu1er, aml l''-P·mdin ' ' c
e c 1ur1ty of equipment off premises. Shnnkrng 11 •xtrcmdy
$LI mt'h 11', Pw.,., ' ·111 • "di a,,
· .1,
ar e a ne works have made the computer cqui
•
pmt:i r ll i• uh hn \t'I! I
stora . · II 1:· ,. Moon.·, 1,1,, •1 •
g e capacny of mobile devices has been to owm,. .. tr. \ 11wu, ,·1>ntn•h
m o n s. St h ecurm<>
. . these devices is as .tmportallt sec °' the. d,lla .,en
111 I c..,,r1x•r.11e poll,) ' 111
lha1 h <> ' • 11..1 •, I'•urin"
kll p,•n111ssu,n,
'
·8 . 1 ' ' , .• ,

ouJd be consideredare:adminil\lrnt1vc 1 111' , ,·unn)!. th(' ,k\l,c

contni
u e of b' . 1 . phy 1cal l'l)l\lH' ' •.• •,111111>1
. mo 1le computers in places hk.: mrp nnes, 111 .1. ,., us111g .1,"" '
W11h sec . . . 11 n, -,,twwu, I'1• '
 . u nty alarms and storing 111cm • 1111 .11,tn,ut
. . ,. , o,l'f
de V tces l 'k
chains •
•
1 e USB tokens, and finally laking .ic1eql' ' ·
 232
[-c,m,me
re" A
_........menL Storage devices have long Ill 0
.'•.·'1"'.fl..
-- e11-r-- Tb. . . ei:nory
., 1 •,
Jc_,:=i id cl""'
deleti0
is not enough. is L/\Nomes m1ponanl \\•he •UJ\1t,,,
rransferred 10 QJlOther loca11on. Equipm " an O1la11,._
'

c q u iJ disposed _ M ·or of dat.a from lhe 'deleted' storage devj:nt sen1 rnr
e, qr---
u , )
I IY ·bJe lO """"1ng d . tin d es. Ev t
toa thorough erasing an overwn g t eMroy the !11thi,"'
,111111"' be sot,jeeted could be recovered even after multiple overw .• data_ i.. llt\,

k-- ,
di . . n l !n & a
,- .,.uclaim that the dapthaysically l e me a con ta1 rung top secr e t . nd
WO dcSirable to 1nfol'.l'ctai· ill!,.
h fl"ll'tiii.• ,
destroy
SecUN! BehavioUr . .
cl screen policy. Our concern for tnformatrno security ,
aeardeskaad and equipment. SensiLive information could be acshouldalll11
securing the premise 5 h .f tess1b.J ·
al 1t c e 10- identify
.IS o essarv and protect
• 'fy t e m ormation in all ll S.<1nca 1n n i, ;
. a t, ,
. J
fc,ml&th
: and
. f • -' o n na ti on will help to . ., ut having a n
e
b
C)assdicallOll o 1w, • ,,
1denu sen s 1t 1v .
"clear desk and clear screen po!Lcycould ensure actu apro1ect1on.
uy,
l _
.
. it
In bnef, organii :tl!rii
_- - ,i , , . nder lock and key and do not allow anybody to snoop. Theg gu1i1e11li,
foUowin ·
c ; n , , 1,. . . . . .g U
should be issued: ..
• Lock up all documents and media when not being used.
• Prorect the computers and terminals through use of key locks, password .il]}d
savers.
• Fax.and telex machines used for confidemial information should not be teftunai1endli)
• Access to photocopiers and scanners is restricted after office hours.
• Printing of classified information should be supervised and all printouts mllliii
mnoved immediately.
JlftnO'qJ ofproperty. Any movement of equipment, information or oftware shoold«
only with proper authorization. All these movements should be logged and
recordsmainJ3iwJ for all outgoing and incoming items. In these days of storage media
capable of conulin gigabytes of infonnation, this procedure becomes very important.
Employees should bemm! aware that spot checks would be carried out to ensure full
compliance.
Security is being paranoid about threats. Physical security is very demonstrative abOOIlhi>
,. •• But, it also sets the tone about the organization's concern about information see,Jlll)

orn,ation Security Environment in lndia4

•••-•-ctaecuaty
- ""-" 11 1! \, Mie s that are aiming
;'!111 -'--•
1
1ev to. go global will require certifying thcir 3 1·v
. · n se,....·
els when scout ing for international clients. Informa u o
'..
'i'1t,IU
1

112 C(IOli1"1
but it is fast becoming a factor for companies to,11ihl_lT
............
r..e. quirement
111
' •·A" and reliable"
envkonment-defined by st rongc P dus1ri_1; lltivefor thegrowth
and future
· · success of Lhe!TES-BPibcl (li:ill in · pushing
ve
1h.il thi.s
,r -
cause and ensuring a · u1 n,,.-
benchmarks with the best across the gloll<'- In
 secllritY Environment in India
1na: ,,",mpan1c, I urc \..nown tor their quality llch vc•.ra ble, Intern· I I
<l()( l went ,1 ong wa) m e,1abh,h1ng 1h,, rcputat,on I 1k a. iona ctruhc lmn like
10
rJ, n 1nforma1io,nccunl) 1s .ilso helping ewisc tollo1111ng mu:rn u,mal
Ind 1
'1•rs Whilemo,1lndian BP() firms arc r«og' "1zcdom,pamc, hu,h.l crcd1h1hty amon
10 c · . . . · e or high nualll
c, nformauon secw-ny practices aced to be constant\ ., Y proce and
!Cl'.._ : 1
;p,dlychaogmgenv1ronmcn1 Customerdatadcmayndrc,,ev. dlaf updated accordmg
10 u,.,
nd
pe"a ocus
JnJiancompame have ro .hu,1security pracuce, comparable 10 lho,e 1o11owed by111c 1cm
r
..,.,,,..-.-,·,c, Indian 1.:ompCames pa• ma.nly comply wnh BS 7799-·•, ghiha,l tandard
that co,cn all Jornains of ,c unty ompamcs ,1gn Service Lc,cl Agreements tSLA). v.hich
have Ct} stn<ct onlidenuahty and security clau<,e, built into them at th.. net O k and dau
level S11th
I
st.A, aho co er all relevant law, that the companies want it, ofhhorc provu.le to co I
,ih ndacuons that can be taken in case of breaches. mp
l 11
Law, ,uch as the IT Act, 2000, Indian Copyright Al.:I, lndi.m Penal Code Act and the
IDdiill ContractAct, I972 provide adequate safeguard to companies off honn., .,.or\; \;S
anJ UK Most of the BPO compamcs pro,iding ,er,;ices to UK client eMurc comp c
with UK DataProtccuon Act, 1998 (DPAI through contrnctual agreement,
Companies dealtng with US clienb require compliance depending uron the
industry
icned. e.g. HealthcarerequlfCScompliance w1lh HIPAA, fmanctal ,er\lcCS require comp
v,uh GLBA To en urecompliance with such law,, Indian ,cndors follov. =nt)
pncu
as specified by clientssuchas security awareness. protection of informationn n-disd ur
aireements. screening oremployee:., etc. f·urther. cheat, conduct P' n, iic audlb to ensilJ
compliance.Manycompanies inIndia are undergoing/ha,c undergone S.\5·0 Audit
1 ,.s.
11 ignmenb help:. servicecompanies operaung from India to 1mplerrn nJ
1
1mpro,c
COOUUls, cn:.urc minimaldisrupuon to bu!>ine,s from clients' uull1tor and pot t marl
tool 10 the face of increasing competition.

EXERCISES
I. Describe how onlincweb,itc opcrution, .111 h,· prott-tcd frum
2. WOu 1 h•at 1s the role of a
3firewall' c, to en re lo m,e 'un
t
 ,,1
111 111
' tsidc hrewalh, what arc the 111a111r t<•t·1 11"•tl

1l e
4• What ts the use of a prolly ,c cr'! · ·
,3: 4::: £-com_ :..:.;.::.ITl(':.::..:.:rc::e:.'.. n l
n tda, 1

r s. Wbal;,a d<ni,J-of-><rv;ce a1ta<k and howdocs ;i alfoc,, bu,m

6. Which is easier 10 mainl'in---d<f•ull de•Y °' defauh penni,, ''" o,,.
7. Why shoulda finn care about IP i,poofing. auacki, that originate ro.m,b
f
not posea threat to its own computerecunty.
a. Whal are the necesi.ary componenti. for an organi1,at1on ,ecurity po1I
C
9. Why shoulda firewall be able to supporta ·deny a,llerv,ccs, except
those
pennined·. if 1his is nOI !he policy cxpeeied 10 beused'
10. Discuss the relative merits of developing firewalls in-house or huyin
tin,wall softw.,.. g
lL What are some of the potentially dangerous internet sen-ice:-, and \\
hy'