Conclusion

Virus writers are getting smarter
o Botnets
o Polymorphic, metamorphic, sophisticated attacks, …
o Future of malware detection?

Malware will continue to be a BIG problem
certification ACLsand capabilities Multilevel security (MLS)
o BLP, Biba, compartments, covert channel, inference control
CAPTCHA Firewalls IDS
Cryptography
o Well-established field o Don’t expect major changes o But some systems will be broken o ECC is a major “growth” area
o Quantum crypto may prove worthwhile…
18
Conclusion
Crystal Ball
Other
software issues
o Reverse engineering will not go away o Secure development will remain hard o Open source is not a panacea
Conclusion
Conclusion
1
Course Summary

Crypto
o Basics, symmetric key, public key, hash
functions and other topics, cryptanalysis

Access Control
o Authentication, authorization, firewalls, IDS
o Bob mentioned man-in-the-middle attack on SSL

Customer wanted to hear more
o So, Bob explainedMiMattack in some detail

The next day, “Bob the lowly intern” became “Bob the fulltime employee”
o Software protection
rights management (DRM)
development
Software
o Open vs closed source
o Finding flaws (do the math)
rating Systems

OS security functions
…and it will be needed in the future Necessary to understand technical issues
o The focus of this class

But technical knowledge is not enough
o Human nature, legal issues, business issues, ...
Classic
ciphers
o Simple substitution
o Double transposition o Codebook
o One-time pad
Basic
Conclusion
cryptanalysis
3
Symmetric Key

Stream ciphers
o A5/1 o RC4

Biometrics
o Fingerprint, hand geometry, iris scan, etc. o Error rates

Two-factor, single sign on, Web cookies
Conclusion
8
Authorization
History/system
o Separation o Memory protection, access control

Trusted OS
o MAC, DAC, trusted path, TCB, etc.

NGSCB
o Technical issues o Criticisms
Conclusion
14
Crystal Ball
o Future of malware, botnets, etc.

Other software-based attacks
o Salami, linearization, etc.
12
Conclusion
Insecurity in Software
Software
Digital
reverse engineering (SRE)
22
Conclusion
curve crypto (ECC)
Digital
PKI
Conclusion
signatures and non-repudiation
5
Hashing and Other


Birthday problem
Tiger Hash HMAC Clever uses (online bids, spam reduction, …) Other topics
o Secret sharing
o Random numbers o Information hiding (stego, watermarking)
Conclusion
6
Advanced Cryptanalysis
Enigma
RC4
(as used in WEP)
Linear RSA

The silence was deafening
21
Conclusion
A True Story

Bob’s boss remembered that Bob had taken a security class
o So he asked Bob, the lowly intern, to answer
16
Crystal Ball


Protocols are challenging
Difficult to get protocols right Protocol development often haphazard
o “Kerckhoffs’ Principle” for protocols? o Would it help?
11
Software Flaws and Malware

Flaws
o Buffer overflow o Incomplete mediation, race condition, etc.

Malware
o Brain, Morris Worm, Code Red, Slammer o Malware detection

Protocols will continue to be a source of subtle problem
17
Conclusion
Crystal Ball

Software is a huge security problem today
o Buffer overflows are on the decline… o …but race condition attacks might increase
o At a major company that does lots of security

One meeting, an important customer asked
o “Why do we need signed certificates?”
o “After all, they cost money!”

Protocols
o Simplified authentication protocols
o Real-World protocols

Software
o Flaws, malware, SRE, development, trusted OS
2
Conclusion
Crypto Basics
Terminology
o As with anything, experience is helpful
Conclusion
20
A True Story


The names have been changed…
“Bob” took my information security class Bob then got an intern position
o …but for now it’s mostly (all?) hype
Conclusion 15
Crystal Ball

Authentication
o Passwords will continue to be a problem o Biometrics should become more widely used
OS
issues
o NGSCB (or similar) might change things…