49Cyber Security
Exclusive OR (XOR): Two bits are compared. If both are the same, the result
is0. If they are different, the result is a 1. To perform the XOR cipher method, the
XOR is performed on a key value with the value being encrypted—for example:
Plaintext A 01000001
Key V 01010110
Ciphertext A XOR V 00010111
One-time pads (aka Vernam cipher): This cipher, invented by Gilbert Vernam
while he was working at AT&T, adds a random set of characters (only used
one time) to a block of plaintext (of the same length). Each character of the
plaintext is turned into a number and a pad value is added to it. The result-
ing sum is converted to ciphertext. If the sum of the two values is above 26,
then 26 is subtracted from the total. Here is an example using one letter:
Plaintext = E
Plaintext value = 5
One-time pad text = J
One-time pad value = 10
Since the sum of plaintext and the pad is 15 (thus less than 26), it is converted
to the ciphertext letter O.
Book cipher: The ciphertext contains a list of codes that represent the page
number, line number, and word number of the plaintext in a particular book.
The encoded message may look like this (50, 20, 5; 75, 30, 3; 300, 4, 7). Thus, on
page 50, line 20, word number 5 is the rst word in the message. The second
word in the message is on page 75, line 30, word number 3, and so on.
3.5.1 Types of Cryptography or Cryptographic Algorithms
There are essentially three types of encryption: symmetric, asymmetric, and
hashing (Conrad 2011):
Symmetric key encryption: Using the same key to encrypt and to decrypt.
This encryption technique came rst. The disadvantage to this type
of encryption is that it is difcult to distribute the key securely. If
the wrong person gets the key, you are out of luck because anyone
who has the key can decrypt your message. There are many different
types of symmetric encryption. The most widely known, developed
by IBM, is data encryption standard (DES). The successors to DES
are triple DES (3DES) and advanced encryption standard (AES). This
type of encryption can be used if the two computers that are commu-
nicating are known so that the key can be installed on each computer.
50 What Every Engineer Should Know About Cyber Security
Asymmetric key encryption: Also known as public-key cryptography,
asymmetric key encryption uses one key to encrypt and a different
key to decrypt. The encryption key is a public key and anyone with
a copy of the key can encrypt information that only you can read
with the private key for decryption. This type of encryption solves
the problem of symmetric key encryption, that the key can be easily
accessed by an attacker. The private key is only known by your
computer, while the public key is known by anyone who wants to
communicate securely with your computer. Even if the message is
intercepted in transit, you can only read it with the private key. An
example can be found in Figure3.4.
Hash functions: No key is used for hashing. Hash functions are mostly
used to conrm data integrity (that the data have not changed).
There are many hash algorithms used. One of the widely used hash
algorithms is MD5. A good algorithm is determined by having a
limited number (e.g., one in one billion) of collisions (two distinct
les resulting with the same hash value). When the hash algorithm
is performed on the plaintext, a hash value is created. Therefore, if
the plaintext changes, so will the hash value.
3.6 Network and Telecommunications Security
The telecommunications and network security knowledge domain includes
a vast amount of concepts and technology needed to protect the security
triad (condentiality, integrity, and availability). These include fundamental
©Microsoft
plaintext ciphertext plaintext
encryption decryption
is is a big
secret.
Wklv lv d elj
vhfuhw.
is is a big
secret.
Public key
Private key
FIGURE 3.4
Asymmetric encryption example.
51Cyber Security
network concepts such as network structures, transmission methods, and
transport formats in order to provide authentication for transmissions over
private and public communications networks and media. Clearly, someone
working in the cyber security area would need a deep understanding of
those fundamental concepts to know what he or she is protecting. However,
that topic deserves its own book and thus is out of the scope of this sec-
tion. The focus and goal of this section is for the reader to gain an under-
standing about the controls that need to be considered to secure the networks
and to protect the transmission of data over a network (telecommunications).
Following is a simplied view of the priority 1 recommendations by NIST for
the system and information integrity baseline:
Control Name
Impact Level
Low Moderate High
Develop system and information integrity policy and
procedures that dene, facilitate, and implement the
roles, responsibilities, management commitment,
and coordination among organizational entities and
compliance
✓ ✓ ✓
Test, correct, and report information system aws
✓ ✓ ✓
Malicious code protection at all information system
entry points and any device connected to the network
✓ ✓ ✓
Information system monitoring to identify
unauthorized use and any attacks
Not selected
✓ ✓
Continually receive security alerts, advisories, and
directives from a designated external organization
✓ ✓ ✓
Verify the correct operation of security functions Not selected Not selected
✓
The information system monitors software and
information integrity
Not selected
✓ ✓
Spam protection at all information system entry
points and any device connected to the network
Not selected
✓ ✓
The system validates information input Not selected
✓ ✓
There are other control baselines that could also be applied to the security
of network and telecommunications. It would be best to review the NIST
special publication 800-53 to determine which controls would be most effec-
tive for your situation.
3.7 Operating System Security
The topic of operating system (OS) security overlaps with many of the topics in
this chapter. The most essential security mechanism for an OS is access control,
which was covered in Section 3.4. The OS actually facilitates the enforcement
52 What Every Engineer Should Know About Cyber Security
mechanism of the access control (e.g., which users or systems can perform
which operations using which resources). As mentioned previously, the type
of access control is determined by the protection needed. The amount of pro-
tection is based on the system’s impact level (low, moderate, high).
Jaeger (2008) describes three guarantees of a secure operating system:
1. Complete mediation: All security-sensitive operations are facilitated.
2. Tamperproof: The access enforcement cannot be modied by
untrusted processes.
3. Veriable: The system should be testable to demonstrate that
security goals are being met.
Many companies have mail servers; hence, reviewing the NIST-
recommended checklist for securing a mail server operating system is a
great example of an OS security task (Tracy etal. 2007):
Category Action Completed
Patch and upgrade
✓
Create and implement a patching process
ID, test, install patches and upgrades to OS
Remove or disable
unnecessary services and
applications
Remove or disable unnecessary services and
applications
Use separate hosts for other services (web,
directories, etc.)
Congure operating system
user authentication
Remove or disable unneeded default accounts and
groups
Disable noninteractive accounts
Create the user groups for the particular computer
Create the user accounts for the particular
computer
Create an effective password policy (e.g., length,
complexity) and set accounts appropriately
Congure computers to prevent password guessing
Strengthen authentication by installing and
conguring other security mechanisms.
Congure resource controls
appropriately
Set access controls for resources (e.g., les,
directories, devices)
(Continued)
53Cyber Security
Category Action Completed
Limit privileges to authorized administrators for
most system-related tools
Install and congure
additional security controls
Install and congure software to provide
additional controls not available in the OS
Test the security of the OS
Test OS after initial installation for vulnerabilities
Periodically test OS for new vulnerabilities
3.8 Software Development Security
To develop and maintain software free from security problems is no easy task.
It is one of the many nonfunctional requirements a software engineer needs
to design into software, (e.g., usability, maintainability, scalability, avail-
ability, extensibility, security, and portability). But, in this era, special atten-
tion needs to be paid to the security requirement. This can be achieved by
building security into applications during the development process (Khan
and Zulkernine 2008). However, two of the difculties software developers
face are the lack of application security knowledge and schedule pressures
(Payne 2009). The eight-step process developed by Talukder etal. (2009) to
elicit both functional and nonfunctional security requirements can be part
of the solution where the security issues of the application are analyzed up
front. Following is the summarized version of the eight steps:
1. Functional requirements: Capture requirements using UML analy-
sis artifacts.
2. Identication of assets: Identify the critical assets of the organiza-
tion and categorize them by their perceived value and loss impact.
3. Security requirements: Determine possibilities (diagram a misuse
case; see the example in Figure3.5) for attacks (e.g., denial of service
[DOS], data tampering) and tampering with the data characteristics
(e.g., condentiality, integrity, and availability).
4. Threat and attack tree: Analyze each misuse case and determine
the threat path.
5. Rating of risks: Assign values to each threat/risk to determine the
highest risk.
6. Decision on in vivo versus in vitro: Determine which threats need
to be addressed within the application (in vivo). This is done by com-
paring the threats to the assets.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.