Help me to simulate the year 2012

I wake up by my magic device’s alarm sound. What is this magic device? Oh, it is a device and if you follow up, you will find out why I call it a magic device. One of the features of this device is that it works with voice commands. When I wake up, all I need to say is “Alarm Off” then the device will shut the alarm down. Then by saying my favorite radio stations’ names, my favorite radio station will be broadcasted from my magic device. While I am listening to the news, I go to the bathroom (of course I take my device with me). Then I just need to say “turn the shower on” it will be turned on. I test the water to see if it is cold or hot, I can tell my device “Warmer”, it will sent the signal to the tap and the tap will turn a little to the left. Now it is time to shave my face after my shower. While I am shaving my face, I can listen to my favorite songs by saying “Play (song’s name)” then my device will search that song from Internet and will play it. While I am preparing my breakfast I can chat with my friends. I just need to say “Who is Online”, then my device will call all my online friends. Next, I say the one’s name whom I want to chat with. Then, whatever I say will be transmitted to my friend as a text, and what my friend sent me as a text, my device will convert it to voice for me. I also can turn the TV on and switch it to my favorite channel. When I leave the house, I set the house alarm and lock the door by my device.  Now I am getting in my car. I do not have any key, what I need to do is to say “open the car’s door” then I say “start the car”. I want to listen to the traffic report; I just need to say “traffic report” then my device will turn the car’s radio to the traffic report station. Also I need directions to my destination. My device will navigate to the address that I mention. I forgot to mention, when it is sunny, my device will charge up its battery. Yes, it is using solar power as well. Now it is time to park the car and turn the car off. I say “turn the car off”, my device will confirm it by asking me “are you sure you want to turn the car off?” and if I repeat “turn the car off”, it will turn the care off. I get out of the car and say “Lock the car”, now my car is off. I need to get my bag from the trunk, I say “open the trunk”, now it is opened.

Privacy Scales in Ubiquitous Computing Forum

Digital Privacy

Chapter Thirteen

Privacy Scales in Ubiquitous Computing Forum

People buy and use devices. All these devices can be connected to each other wirelessly. Also all these devices can be recognized automatically. People can track the devices; find their addresses, also potentially, trigger services or activities. Ubiquitous computing refers to the environment where these devices are enhanced with digital qualities.

Control is one of the UC problems. The control issues have been raised and this causes privacy issues associated with UC. Author states two reasons for losing privacy in UC environments.

1.      Losing control over being accessed: People will perceive control when they are aware that their response can lead them to desired outcome. Author stated that in a UC  environment, “this aspect would imply that people can easily opt out of being accessed by the intelligent infrastructure”

2.      Lack of control over inform use and maintenance

Based on RFID PET research, privacy enhancing technologies has two type models:

1.      User Model: In this model, users have full control over RFID tags.

2.      Agent Model: In this model, RFID tags are answering the network requests.

And also author has presented three scales developer of a UC and RFID technology.

1.      Control Definition and initial items development

2.      Empirical item testing

3.      Internal consistency and reliability of control items.

Reference:

Acquisti, Alessandro, Gritzalis, Stefanos, Lambrinoudakis, Costas, De Capitani Di Vimercati, Sabrina (2008). “Digital Privacy, Theory, Technologies, and Practices”. Auerback Publications. Taylor & Francis Group, LLC

Security by Design

Beautiful Security

Chapter Ten

Security by Design

Authors believe security is beautiful when system designer apply it in system design lifecycle (design, built, and test). And they believe it is ugly when we use it as an afterthought. Also they believe security is highly interrelated, and is achievable in cost effective way. When you want to have a secure environment you need to know, and clearly define the environment to have an effective environment security posture. Whenever we need a secure system you need to have a clearly known, clearly defined system.

Security vulnerabilities contribute to low reliable, poor system performance, and poor quality system. What we need to do is focusing on achieving security and quality before expanding the feature set product. What the authors suggest is achieving appropriate levels of quality and security then transition a product to volume production.

Before developing a program;

·        Determine the attributes that need to be measured

·        Interdependencies of these attributes

·        And the acceptable levels for these attribute.

Some suggestions:

·        Develop risk based security programs that address security at all phases of the system development lifecycle.

·        Instead of testing security into the system, design security.

·        Good design discipline reduces the total cost of designing, developing and operating a system in many cases.

·        Well designed system will provide significant benefits in improved security.

Reference:

Oram, Andy, Viega, John (2009). “Beautiful Security, Leading Security Experts Explain How They Think”, Copyright 2009 O’reilly Media, Inc.

The Evolution of PGP's Web of Trust

Beautiful Security

Chapter Seven

The Evolution of PGP's Web of Trust

What is PGP: PGP or Pretty Good Privacy was people’s first opportunity to use strong encryption in 1991. It let people from all around the world to connect with privacy. And it solve the problem of connecting people who never had exchanged secure keys. PGP is a software. It is an implementation of many implementation of the OpenPGP standard.

Few concept related to PGP

Trust: the mechanism that is used to decide whether a key is valid. Trust is a relationship that helps us determine validity. 

Validity: Validity is only a score to determine whether the name on a key is accurate. A key is valid if it is actually owned by the person who claims to own it.

How PGP works: you tell PGP whom you trust to sign keys, and PGP tells which keys are valid by tallying up a score for each key depending on who signed the key and how much you trust the person who signed it.

Trust Models: A Trust model is a general scheme that formalized trust.

Direct Trust: The most straightforward type of trust. It is the best, simple, well and trustworthy model of trust. In this model a certificate that holds the key is signed by the certificate itself. This model has one problem. It does not scale very well to the size of the internet.

Hierarchical Trust: In this model validate a certificate which has signed by someone whom you believe to be accurate. This model is a straightforward model. It has an obvious risk. If the authority makes a mistake the effect of that mistake is great.

Cumulative Trust: This model takes a number of Factors and uses them to decide whether a certificate is valid.

PGP web of trust:

In the PGP trust model, all users are also certification authorities. This mode uses “introducer” instead of “authority”.

Revocation: all PKIs need a way to revoke certificates. Revocation is theoretically simple in a hierarchical PKI. Revocation is needed because people lose their control of keys or computers. PGP web of trust has two mechanisms for revocation:

1.      Key revocation: users must be able to revoke the whole thing. By signing this key, revocation signature invalidates all of its certifications.

2.      Signature revocation: A key can create a signature declaring that another signature is no longer valid.

Scaling Issues: The Web of Trust works at its best with groups of people up to few thousand people. But it does not work well with a large network such as internet, because there are few paths between people who do not know each other. There few ways to improve the scaling.

1.      Extended introducers: expanding introducers to multilevel hierarchies is one way which improve the scaling. Each signing node in the tree must be given trust.

2.      Authoritative keys: Some keys or certificates are presumed to be genuine just because they come from an appropriate authority.

Reference:

Oram, Andy, Viega, John (2009). “Beautiful Security, Leading Security Experts Explain How They Think”, Copyright 2009 O’reilly Media, Inc.

Beautiful Security Metrics

Beautiful Security

Chapter three

Beautiful Security Metrics

To turn IT security into a science instead of an art, security metrics are needed. This chapter states that medical research, in order to advance human health has used metrics. The author has stated that as you can feel health but you cannot touch it, you can feel security but you cannot touch it.  Also health and security are about achieving the absence of something. In health care is about absence of failures in physical or mental well being. And security is about absence of failures in confidentiality, availability and integrity.

5 questions which Security metrics should deliver are;

1.      How secure am I?

2.      Am I better off now than I was this time last year?

3.      Am I spending the right amount of dollars, effort, or time?

4.      How do I compare with my peers?

5.      Could that happen to me?

There are three problems to answer these questions:

·        First: What is the definition of secure?

·        Second problem is Context. For Vulnerability in an IT asset, the criticality, use, and connectedness of the asset should be considered.

·        The third problem is Uncertainty. Many executives have no idea about vulnerabilities.

Security Metrics:

One example for security metrics: TJX (outsider breach) the biggest case of payment card theft ever recorded (as of 2008). Author believes this breach have started in July 2005 and continued for 18 months until December 2006, when TJX took action. Card holders began to see strange transactions on their credit card bills.

How it happened:

Public perspective:

·        TJX Cos says it suffered an unauthorized intrusion into its computer systems

·        Credit card companies, banks and customers begin to report fraudulent use of credit and debit card numbers

·        TJX reports that hackers may have access to its computer

Technology perspective:

·        Wireless LANs born: IEEE 802.11b completed and approved.

·        Hack to crack WEP protection of wireless communication demonstrated.

·        IEEE 802.1 X ratified to address port-level security using extensible authentication protocol (EAP).

·        IEEE 802.11 B security weaknesses stated.

·        TJX use of WEP protection still prevalent at retail stores.

Some recommendations:

·        Set the value of all SSIDs for IEEE 802.1b to something obscure.

·        Change the default setting for authentication to disallow open access for all clients

·        Update the configurations for every client and WAP when you change the key management for WEP

·        To achieve a strong wireless security:

ü  Turn off WEP

ü  Select obscure SSIDs

ü  Isolate wireless subnets with routers and firewalls

ü  Use 802.1X for key management

What did TJX wrong?

o   TJX did not follow guidelines issued. The hackers used this fact to access to TJX’s network.

o   They used default configuration for WAP

o   They used self-evident SSID’s and open access

The TJX’s WAP’s let hackers gather enormous quantities of valuable data with an incredible small investment.

Reference:

Oram, Andy, Viega, John (2009). “Beautiful Security, Leading Security Experts Explain How They Think”, Copyright 2009 O’reilly Media, Inc.

Proactive Detection of Client-Side Exploits

Hackers are taking advantage of client software’s vulnerabilities to control and infect systems, even the systems that are protected by firewalls. Once they are compromised, the attacker can use client side exploits for several malicious activities. For example; they can steal people’s online banking credentials. Even worth, they can use victims’ computer as part of their distributed denial of service (DDoS) attack or a spam delivery system. It is interesting to know; how an attacker utilizes vulnerabilities? Both client and server would be exploited by contagion worm. First attacker needs to upload malicious code to typical web server security flaws, then this code will be downloaded whenever users’ browser visits the website.

Attackers target client systems because not too many of client software are developed by expert people. Even most technical people are trained and just follow through with updating the server software. Most users are not trained to create secure software or run the most recent signatures antivirus product or even worth, they don’t update their operating system software.

Honeyclinets: Security depends on the knowledge of existing exploits and vulnerabilities. This knowledge can use to proactively patch vulnerable or create intrusion detection system.  Honeypot is a popular tool which is used to acquire advanced knowledge. Honeypot is a passive device and limited to detect server software attacks. The vulnerabilities are growing in client side (like mail or web browser). A new technology was needed to discover exploits for these vulnerabilities. Honeypot could not detect malicious behavior until the attacker happens upon them.

 Honeyclient is a concept which instruments client software and drives it to detect new exploits. It drives vulnerable client software (like web browser) to malicious websites and then monitors system behavior to indicate compromise. honeyclient emulates the client side and acts as a bot or spider, it monitors client behavior to see whether it falls outside of normal operational bounds.  

The first generation honeyclient: the author started designing honeyclient in 2004. The first honeyclient was open source prototype code. In order to detect exploits, the author used comprehensive check for changes on the client. Windows as an operation system and IE as a web browser were chosen because the largest populations of users were using them.  The idea was to let a real browser visit each suspected website. If honeyclient software becomes compromised when it encountered a malicious website, then that website can be presented as a bad websites and potential consequences of infections.

The second Generation honeyclients: the idea was to keep parts of the original prototype, but add new features such as running the honeyclient in virtual machines. Also they wanted to retain honeyclient quickly the compromised operating systems for later attack forensics analysis. The author wanted ease of use, speed and scalability.

The change in honeyclient architecture was to add plug-ins to enabled or disabled honeyclient. The second decision was client-server model. The server controls higher level operations for the honeyclient. These controls were:

·        Cloning and suspending virtual machines

·        Detecting changes to the honeyclent system

·        Communicating whit an external honeyclient database

·        Logging full packet captures

Reference:

Oram, Andy, Viega, John (2009). “Beautiful Security, Leading Security Experts Explain How They Think”, Copyright 2009 O’reilly Media, Inc.

Psychological Security Traps

There are 3 influencing factors in security which warns us of potential security danger.

1. The first fact is called “learned helplessness”: New technologies are constantly being discovered and developed. These new technologies need to be compatible with existing solutions. This is the “backward compatibility” problem of technology deployments. New technologies are developed to meet the need for greater security. The question is what happens to the old technology? Will they still be supported?  Achieving backward compatibility is important. Developers need to focus on new technology and combine the legacy technology to the new one with minimal attention to the legacy’s effects. The most direct solution allows the modern and legacy technology to be achieved simultaneously by compromising the robustness and security strength of the new technology to match that of the legacy solution. From a security stand point, what is important is how backward compatibility will be accomplished without degrading security of the new systems.

What Microsoft did was force their new system to talk to both legacy and current protocol without considering the legacy security issues. What Microsoft could do was to have required the legacy systems to patch the functions required to support logging a final end of life upgrade to the legacy systems.

2. The other issue with security of products is how they are tested to see if there are any flows in those products and how often they go belly up when they are confronted with fuzzed input. For example Microsoft considers a good users experience but they don’t consider adversarial users. They don’t consider that their application would be deployed in hostile environments. And this makes it easy for attackers to exploit “confirmation traps”.

3. The other fact is “functional fixation.” When we talk about security, the concept of functional fixation helps us to understand what is beyond the security. For example, many people think security products increase the security of their system or organization. But this security software might include all sorts of common programming vulnerabilities, such as; unchecked execution, local buffer overflows and lack of authentication in auto update activities which might allow them to be used by attackers.

Reference:

Oram, Andy, Viega, John (2009). “Beautiful Security, Leading Security Experts Explain How They Think”, Copyright 2009 O’reilly Media, Inc.

Digital Copyright Basics

History of copyright

Back in 1980 copyright law didn’t cover software and software companies were hoping that congress would pass the law to turn digital products from cheap to copy products to wealth to copy products. The copyright law provides legal control of digital copying. In 1980, congress passed the law to give express copyright protection to software. This law is a legal tool to protect digital content against unauthorized copying of software.

The nature of a copyright

Copyright is a legal right in order to control coping digital content. This law governs selling copies and distributing. Encouraging expression and creation is the purpose of this law. This purpose will be reached by granting a legal monopoly on performing work, copying and distributing.

US copyright covers;

·         Literary work

·         Computer programs

·         Musical works and sound recording

·         Choreography

·         Visual arts

·         Motion picture

·         Architectural works

Copyright covered works in the form of digital products and any business that communicates is affected by this law.

Computer programs:

As stated above computer programs are covered by copyright law. These programs are a set of instructions or statements which are used in computer directly or indirectly. These programs can be written in any computer language. Also these programs can be a combination of the other programs.

Musical works

Music recording has two different copyright;

1.       The composition: covers musical notes and words.

2.       The sound recording (master recording copyright)

Exclusive right under copyright

1.       Reproduction

2.       Distribution

3.       Public performance: the right to play, perform, display copyright work in public

4.       Derivatives: the right to create works based on a work

How to get a copyright

To get a copyright, the work needs to be gotten in to some fixed form. For digital content, fixed form could mean printout, storage on a network, Rom chip, hard drive or diskette. Copyright is secured automatically when work is recorded in some reasonably personably persistent form for the first time.

Duration of copyright protection

For works;

Ø  By individual authors; it last for the life of the author plus 70 years.

Ø  By employees of a company; it last 95 years.

Public domain

The works which are not subject to copyright like the works that their copyright has been expired and their copyright need to be renewed are in the public domain. These works can be copied, published or derivative without permission.

Infringement

Infringement is violation of the rights of a copyright holder. Under US law, there are several different kinds of infringement.

§  Direct infringement

§  Contributory infringement

§  Vicarious infringement

§  Inducing infringement

Derivative works

Derivative work is a work based on another work for example writing a software game program based on a novel without getting permission of the novel copyright holder. A derivative software program could be;

1.       An update, new version or new release of an existing program.

2.       A “localized” version of program with foreign language context.

3.       A “port” of a program into a different software operating system.

4.       A program substantially derived from another computer program.

5.       A program based on another medium

Work made for hire

Effect of US copyright law;

Ø  If a work is developed by an employee, the program will belong to the employer and employer is considered the author

Ø  Is a work is developed by an independent contractor, the independent contractor owns the work unless a contract says.

The first sale rule

The first sale rule is another copyright act and its concept is; if you sell a copyrighted work, you cannot control the resale of that work. This rule is not good for digital contents. To avoid this rule for digital goods, licensing is used. For example if you license a digital work to someone and both agree that the work cannot be transferred to another person without your permission.

Copy Protection Technology and Anticircumvention Law

Digital Millennium Copyright Act (DMCA) was an important collection of amendments to the copyright which congress passed it in 1998. DMCA made it illegal to circumvent copyright-protection technology or to distribute or sell programs or devices for defeating such protections.

Digital Rights Management Technology and Anticircumvention

ü  If someone wants to control the use or copying of his/here digital work, he/she does not have to rely solely on the law. He/she can use technology. A well known technology called DRM (Digital Rights management) which include:

ü  Software solutions; to limit use or copying of programs of digital works.

ü  Hardware devices; are required for use of a software product

ü  “Watermarking” technology to detect illegal copying

ü  Encryption schemes; to access to digital content, it require “keys”

ü  Web based software; to permits viewing of web content, but it doesn’t allow to save or print the content.

ü  On line passwords; to have access to unavailable content.

Anticircumvention Law Concepts

Some basis concepts of anticircumvention law under DMCA are:

·         “Access control measures”; to forbid or permit access to a copyright content.

·         “Copy Control Measures”; to control copying.

·         “Access control circumvention devices”; hardware methods, services or software to defeat access control measures and other than to circumvention, have limited commercially significant purpose or use.

·         “Copy control circumvention devices” methods, services or hardware software to defeat copy control measures and other than to circumvention, have limited commercially significant purpose or use.

What is illegal under Anticircumvention Law?

Under DMCA these are illegal:

ü  To circumvent an access control measure

ü  To build, import, or distribute any access control circumvention device or copy control circumvention device.

Also it is illegal to remove intentionally from a copyrighted work any “copyright management information” like, the name to the author, the title of a work or other identifying information.

Reference:

Landy, Gene, K. (2008). The IT/Digital Legal Companion, A Comprehensive Business Guide to Software, IT, Internet, Media and IP law. Published by; Syngress Publishing, Inc.