ITIS 3200 Introduction to Information Security and Privacy

ITIS 3200: Introduction to Information Security and Privacy Dr. Weichao Wang

Syllabus • See handout – Homework will usually has 4 -5 questions and due in one week. It is due at the time that the class begins. – Late homework • Within 24 hours: 50% of full score • After that: 0% – Project • Individual project, consists of two parts – First part: Hands-on experiment – Second part: Choose a security problem and write a survey paper – A reference question list will be provided – Midterm and final exam – Misc: eating, drinking, and cell phone (text & twitter)

Before class • An interesting question – Two companies each has some private data. They need to jointly calculate some result without disclosing their information. • Secure multiparty computation • Is this solution useful? – Zero knowledge proof: • Can I prove to you that I know a secret without telling you anything? (practically) – Anonymously publishing data or information

Examples in real life • Attack on Twitter – Hack into the victim’s email account – DDo. S to paralyze Twitter, facebook, etc • Data mining attacks on public database – In Tenn, a newspaper generates a database about all residents that have CCW permits. – In CA, there is a webpage listing all people that donate to Proposition 8 ballot measure

Examples in real life • Code during the war – Navajo Code in WWII – http: //www. imdb. com/gallery/ss/0245562/W 266 R. jpg

– Computers have controlled our lives • Medical, ATM, banking, business • Air traffic control

Security overview • Risks – Why there are risks • Adversaries – – Smart and dedicated Many of them Hiding in the dark From fun to profit (worm self-changing botnet)

Security overview • Physical security is not enough (can you be sure that your physical security methods are sound and enough? Example in Las Vegas, supply chain attacks) • Networked computers can be accessed remotely

Security overview • What can go wrong – Trojan war story (trojan horse) – Corrupted internal worker – Vulnerabilities of protocols or security mechanisms (security patch has problems too) – By-passing protection walls – Backdoors for systems (Linux password) – Known attacks ignored (push and poll)

Information security • Encryption – You can read the information only when you know the key • Authentication – You are who you claim you are • Authorization – The role and the right

Information security • Information integrity – The data has never be changed or changed in an inappropriate way • Non-repudiation – Cannot deny your words • Privacy – Who should know, how much, how to use the information • Your cell phone or medical records • RFID

Security overview • Defending methods – Prevention • • Prevent (password, salt, private salt, searching) Deter: raising the bar (password guessing, login slow) Deflect: making other target more attractive Diversify – Detection • Monitoring (who, what, and how) • Intrusion detection (signature based, anomaly based) • IP telephony track

Security Overview • Recovery – Recover data (check point) – Identify the damage – Forensics – Confinement • Tolerance – Maintain a decent service quality – Automatically degrade video quality while reserving bandwidth for voice