1

SECURITY IN
COMPUTING,
FIFTH EDITION
Chapter 2: Toolbox: Authentication, Access
Control, and Cryptography

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 2

Objectives for Chapter 2

• Survey authentication mechanisms
• List available access control implementation options
• Explain the problems encryption is designed to solve
• Understand the various categories of encryption tools as
well as the strengths, weaknesses, and applications of
each
• Learn about certificates and certificate authorities

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 3

Authentication
• The act of proving that a user is who he says he is
• Methods:
• Something the user knows
• Something the user is
• Something user has

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 4

Something You Know

• Passwords
• Security questions
• Attacks on “something you know”:
• Dictionary attacks
• Guessing likely passwords/answers
• Defeating concealment
• Exhaustive or brute-force attack
• Rainbow tables

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 5

Distribution of Password Types

One character
0%
Other good Two characters
passwords 2%
14% Three characters
14%

Words in
dictionaries or
lists of names Four characters,
15% all letters
14%

Six letters,
lowercase Five letters,
19% all same case
22%
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 6

Password Storage

Plaintext Concealed

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 7

Biometrics: Something You Are

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 8

Problems with Biometrics

• Intrusive
• Expensive
• Single point of failure
• Sampling error
• False readings
• Speed
• Forgery

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 9

Tokens: Something You Have

Time-Based Token Authentication

Login: mcollings
Passcode: 2468159759
PASSCODE = PIN + TOKENCODE
Token code: Clock
Changes every synchronized to
60 seconds UCT
Unique seed
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 10

Federated Identity Management

Identity Manager
User (performs Authenticated
authentication) Identity

Application Application
(no authentication) (no authentication)
Application
(no authentication)

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 11

Single Sign-On
User Single Sign-On Identification and
Shell Authentication
Credentials

Password Token

Authentication Authentication Authentication

Application Application
Application

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 12

Access Control

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 13

Access Policies
• Goals:
• Check every access
• Enforce least privilege
• Verify acceptable usage
• Track users’ access
• Enforce at appropriate divided
• Use audit logging to track accesses

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 14

Implementing Access Control

• Reference monitor
• Access control directory
• Access control matrix
• Access control list
• Privilege list
• Capability
• Procedure-oriented access control
• Role-based access control

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 15

Reference Monitor

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 16

Access Control Directory

User A Directory Files User B Directory
Access File Access File
File Name Rights Pointer File Name Rights Pointer

PROG1. C ORW BIBLIOG R

PROG1.EXE OX TEST.TMP OX

BIBLIOG ORW PRIVATE ORW

HELP.TXT R HELP.TXT R

TEMP ORW

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 17

Access Control Matrix

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 18

Access Control List

Directory Access Lists Files
Access List Access
File Pointer User Rights
BIBLIOG
BIBLIOG USER_A ORW

TEMP USER_B R

USER_S RW
F TEMP

HELP.TXT USER_A ORW

F
USER_A ORW

USER_S R

USER_A R HELP.TXT

USER_B R

USER_S R

USER_T R

SYSMGR RW

USER_SVCS O

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 19

Problems Addressed by Encryption

• Suppose a sender wants to send a message to a
recipient. An attacker may attempt to
• Block the message
• Intercept the message
• Modify the message
• Fabricate an authentic-looking alternate message

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 20

Encryption Terminology
• Sender
• Recipient
• Transmission medium
• Interceptor/intruder
• Encrypt, encode, or encipher
• Decrypt, decode, or decipher
• Cryptosystem
• Plaintext
• Ciphertext

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 21

Encryption/Decryption Process

Key Key
(Optional) (Optional)

Original
Plaintext Encryption Ciphertext Decryption
Plaintext

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 22

Symmetric vs. Asymmetric

Key

Original
Plaintext Encryption Ciphertext Decryption
Plaintext

(a) Symmetric Cryptosystem

Encryption Decryption
Key Key

Original
Plaintext Encryption Ciphertext Decryption
Plaintext

(b) Asymmetric Cryptosystem

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 23

Stream Ciphers

Key
(Optional)

…ISSOPMI wdhuw…
Plaintext Encryption Ciphertext

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 24

Block Ciphers
Key
(Optional)
.. XN OI TP ES

Plaintext IH Ciphertext
Encryption

po
ba
qc
kd
em
..
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
 25

Stream vs. Block

Stream Block
Advantages • Speed of • High diffusion
transformation • Immunity to
• Low error insertion of
propagation symbol

Disadvantages • Low diffusion • Slowness of

• Susceptibility to encryption
malicious • Padding
insertions and • Error
modifications propagation

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.