introduction
play

Introduction CMSC 414: Computer and Network Security Spring 2016 - PowerPoint PPT Presentation

Jan 24, 2024 •196 likes •682 views

Introduction CMSC 414: Computer and Network Security Spring 2016 What is computer & network security? Normally, we are concerned with correctness Does the software achieve the desired behavior? Security is a form of correctness

  1. Introduction CMSC 414: Computer and Network Security Spring 2016

  2. What is computer & network security? • Normally, we are concerned with correctness • Does the software achieve the desired behavior? • Security is a form of correctness • Does the software prevent “undesired” behavior?

  3. 
 What is computer & network security? • Normally, we are concerned with correctness • Does the software achieve the desired behavior? • Security is a form of correctness • Does the software prevent “undesired” behavior? The key difference: Security involves an adversary 
 who is active and malicious. 
 Attackers seek to circumvent protective measures.

  4. What are “undesired” behaviors?

  5. What are “undesired” behaviors? • Reveals info users wish to hide (confidentiality) • Corporate secrets • Private data; personally identifying information (PII)

  6. What are “undesired” behaviors? • Reveals info users wish to hide (confidentiality) • Corporate secrets • Private data; personally identifying information (PII) • Modifies information or functionality (integrity) • Destroys records • Changes data in-flight (think “the telephone game”) • Installs unwanted software (spambot, spyware, etc.)

  7. What are “undesired” behaviors? • Reveals info users wish to hide (confidentiality) • Corporate secrets • Private data; personally identifying information (PII) • Modifies information or functionality (integrity) • Destroys records • Changes data in-flight (think “the telephone game”) • Installs unwanted software (spambot, spyware, etc.) • Denies access to a service (availability) • Crashing a website for political reasons • Denial of service attack • Variant: fairness

  8. What are “undesired” behaviors? • Reveals info users wish to hide (confidentiality) • Corporate secrets • Private data; personally identifying information (PII) • Modifies information or functionality (integrity) • Destroys records • Changes data in-flight (think “the telephone game”) • Installs unwanted software (spambot, spyware, etc.) • Denies access to a service (availability) • Crashing a website for political reasons • Denial of service attack • Variant: fairness This is a subset

  9. Attacks are common From just the past 9 months or so:

  10. Why are attacks common?

  11. Why are attacks common? • Security is a property of the systems we build • Many attacks begin by exploiting a vulnerability • Vulnerability = software defect that can be exploited to yield an undesired behavior • Software defect = the code doesn’t “behave correctly” • Software defects arise due to • flaws in the design and/or • bugs in the implementation

  12. Why are attacks common? • Because attacks derive from design flaws and/or implementation bugs • But all software has bugs: so what? • A normal user never sees most bugs • Post-deployment bugs are usually rare corner cases • Too expensive to fix every bug • Only fix what’s likely to affect normal users

  13. Why are attacks common? Attackers are not normal users • Normal users avoid bugs/flaws • Adversaries seek them out and try to exploit them

  14. Why are attacks common? Attackers are not normal users • Normal users avoid bugs/flaws • Adversaries seek them out and try to exploit them This extends beyond software: 
 Attacks are possible even with perfect software

  15. Why are attacks common? Because it’s profitable And because a system is 
 only as secure as its weakest link

  16. In order to achieve security, we must: Be able to eliminate bugs and design flaws 
 and/or make them harder to exploit.

  17. In order to achieve security, we must: Be able to eliminate bugs and design flaws 
 and/or make them harder to exploit. Be able to think like attackers.

  18. In order to achieve security, we must: Be able to eliminate bugs and design flaws 
 and/or make them harder to exploit. Be able to think like attackers. Develop a foundation for deeply understanding 
 the systems we use and build.

  19. In order to achieve security, we must: Widespread misuse of crypto Be able to eliminate bugs and design flaws 
 and/or make them harder to exploit. Be able to think like attackers. Develop a foundation for deeply understanding 
 the systems we use and build. This is an encrypted image

  20. In order to achieve security, we must: Widespread misuse of crypto Be able to eliminate bugs and design flaws 
 and/or make them harder to exploit. Be able to think like attackers. Develop a foundation for deeply understanding 
 the systems we use and build. This is an encrypted image

  21. In order to achieve security, we must: Widespread misuse of crypto Be able to eliminate bugs and design flaws 
 and/or make them harder to exploit. Be able to think like attackers. Develop a foundation for deeply understanding 
 the systems we use and build. This is an encrypted image 50% of Android apps that use crypto encrypt in this manner

  22. In order to achieve security, we must: Be able to eliminate bugs and design flaws 
 and/or make them harder to exploit. Be able to think like attackers. Develop a foundation for deeply understanding 
 the systems we use and build.

  23. In order to achieve security, we must: Be able to eliminate bugs and design flaws 
 and/or make them harder to exploit. Be able to think like attackers. Develop a foundation for deeply understanding 
 the systems we use and build. Software Hardware Protocols Users Law Economics

  24. The Goals of CMSC 414 In order to achieve security, we must: Be able to eliminate bugs and design flaws 
 and/or make them harder to exploit. Be able to think like attackers. Develop a foundation for deeply understanding 
 the systems we use and build. Software Hardware Protocols Users Law Economics

  25. This time • What is security? • Administrative • Analyzing a system’s security 1. Summarize the system 2. Identify the assets 3. Identify the adversaries & threats 4. Identify the vulnerabilities • Trusting trust

  26. Administrative Communicating • Resources and all this info will be on the class website • http://www.cs.umd.edu/class/spring2016/cmsc414 • Who • Me: Dave Levin (dml@cs.umd.edu) • TAs: Frank Cangialosi 
 Jacob Hammontree 
 Lee Williams 
 Chengxi Ye • Office hours are on the website • If my office hours don’t work for you, email me and set up a time • We will be using Piazza • You should have been added; let me know if you haven’t

  27. Administrative Textbooks • None required • Mostly in-class and papers posted on website • Recommended texts, if you are so inclined • “Security in Computing”, Pfleeger & Pfleger • “Introduction to Computer Security”, Goodrich & Tamassia • “Security Engineering”, Ross Anderson Free online: http://www.cl.cam.ac.uk/~rja14/book.html -

  28. Administrative Outside reading • The best way to learn is to reinforce • Lots of security resources (something is always breaking). • Krebs on security • Bruce Schneier’s blog • reddit.com/r/netsec • Any other favorites? Let us know on Piazza

  29. What’s in this course?

  30. What’s in this course? Software How do we build software that is secure? Security Memory safety Malware Web security Static analysis Design principles

  31. What’s in this course? Software Security Crypto What it is, and how to use it responsibly A black-box approach to crypto Designing protocols that use crypto Authentication: proving who you are Anonymity: hiding who you are

  32. What’s in this course? Software Security Attacks on TCP & DNS Crypto Botnets Underground spam economies Network 
 How to build secure networked systems. Security

  33. What’s in this course? Software How do we build software that is secure? Security Crypto What it is, and how to use it responsibly. Network 
 How to build secure networked systems. Security Attacks and defenses across all of these

  36. Ethics and legality • You will be learning about (and implementing and launching ) attacks, many of which are in active use today. • This is not an invitation to use them without the explicit written consent of all parties involved • If you want to try something out, then let me know and I will try to help create a safe environment • This is not just a question of ethics; to do otherwise would risk violating UMD policies and MD/USA laws

  37. Prerequisite knowledge • You should be reasonably proficient in C and Unix • You should also be creative and resourceful (those who try to attack your systems will be!) • Otherwise, this course won’t require any prior knowledge in networking or crypto

  38. What’re grades based on? • Grade breakdown • 50%: Projects (P1-P3: 10%, P4: 20%) • Midterms (2 x 12% each) • Final (25%) • Meet your instructor (1%)

  39. Meet your instructor (that’s me!) • You come by my office at some 
 point before the last day of 
 classes and we chat • Gives me a chance to get to know each of you, learn about your interests, chat plans/research… • Again: if you are booked during my office hours, just email me to set up a time.

  40. Midterms & Exams Expected dates Midterm #1: Midterm #2: Final exam: Mar. 10 Apr. 21 May 18 12% 12% 25% Please see the syllabus for information about excused absences

  41. Trusting Trust

Recommend

INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION

INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION

TRAINING COURSE ON SOCIAL PROTECTION & FORMALIZATION TRINIDAD AND TOBAGO MARCH 15, 2017 INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION Design of the NIS Assistance from the

547 views • 23 slides
INTRODUCTION Introduction 2/42 INTRODUCTION Alternations I am giving bread to the

INTRODUCTION Introduction 2/42 INTRODUCTION Alternations I am giving bread to the

Patterns of variation in the expression of case and agreement Andrs Brny Leiden University Centre for Linguistics 9 November 2019, BaSIS Workshop a.barany@hum.leidenuniv.nl INTRODUCTION Introduction 2/42 INTRODUCTION

1.37k views • 42 slides
Introduction Introduction Introduction Introduction Outline Motivation Failures

Introduction Introduction Introduction Introduction Outline Motivation Failures

Introduction Introduction Introduction Introduction Outline Motivation Failures Definition and concepts Process and product properties Principles SE Approaches Motivation Software and the economy The economies of

1.03k views • 49 slides
Introduction Introduction Introduction Nationwide Cause for Concern 1

Introduction Introduction Introduction Nationwide Cause for Concern 1

Introduction Introduction Introduction Nationwide Cause for Concern 1 https://www.cdc.gov/std/stats17/infographic.htm Introduction Epidemiology in Western Colorado CPHE Surveillance Data Report, May 2018 Chlamydia Epidemiology in Western

977 views • 39 slides
DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every

DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every

DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every meeting (2) Some ideas of diagrams for section 7.1 (Introduction) of TP. Giles Barr 25 Jan 2018, Pembroke College On DUNE, the reality is there is a

474 views • 10 slides
INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT

INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT

ADVANCED COMPUTER SECURITY INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT IS SECURITY? A systems security policies describe What the system is supposed to do Store and provide access

479 views • 16 slides
Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL

Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL

Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL Writing a SMIL file Adding Media Objects Martin Halvey Clipping media files January 2008 Timing and Synchronising Layout World Wide

387 views • 14 slides
14 Introduction Introduction Bad guys can put malware into Example: hosts

14 Introduction Introduction Bad guys can put malware into Example: hosts

Introduction Introduction source Encapsulation ISO/OSI reference model message M application segment H t H t M transport network datagram H n H n H t M presentation: allow applications to frame link H l H n H t M interpret

583 views • 4 slides
Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL

Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL

Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL Writing a SMIL file Adding Media Objects Martin Halvey Clipping media files January 2008 Timing and Synchronising Layout

322 views • 8 slides
Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL

Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL

Introduction Zynq Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL Processing System Processor Peripherals Data Buses AXI Bus Conclusion BTE5380 - Embedded Systems Octobre 2014 Andreas Habegger

1.81k views • 30 slides
2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04

2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04

2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04 Project References S E 5 PART.1 SMILE5 Introduction M I L Introduction STORION-SMILE5 Residential Energy Storage System Inverter 5kW Output Input

1.06k views • 25 slides
Introduction to CICS Course introduction Course introduction What is CICS? What is an

Introduction to CICS Course introduction Course introduction What is CICS? What is an

Introduction to CICS Course introduction Course introduction What is CICS? What is an application server? Why use an application server? Course introduction Services provided by CICS How CICS applications are defined Scaling CICS to meet

1.84k views • 146 slides
Network Visualization Introduction Presented by Shahed Introduction Introduction Basic

Network Visualization Introduction Presented by Shahed Introduction Introduction Basic

Network Visualization Introduction Presented by Shahed Introduction Introduction Basic building blocks Node Links (relationship between nodes) Spatial information Network data

584 views • 9 slides
Introduction Introduction (1) Main argument of the paper: universities are not only

Introduction Introduction (1) Main argument of the paper: universities are not only

Le jugement des pairs comme outil de management des universits Peer-review as a management tool Christine Musselin (CSO, Sciences Po et CNRS) Avril 2013, Lirrsistible ascension du capitalisme acadmique Introduction Introduction (1)

590 views • 28 slides
Introduction Introduction to storage and to storage and filesystems filesystems Introduction

Introduction Introduction to storage and to storage and filesystems filesystems Introduction

Moreno Baricevic Gilberto Daz Axel Kohlmeyer Stefano Cozzini ULA ICTP CNR-IOM DEMOCRITOS Merida, VENEZUELA Trieste, ITALY Trieste, ITALY Introduction Introduction to storage and to storage and filesystems filesystems Introduction

1.19k views • 51 slides
JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of

JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of

JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of the brand new JA-100 alarm system Visions Basic architecture System components Setting Help us with final validations You are the FIRST ones

1.69k views • 111 slides
1 Introduction Introduction Communication System Baseband an adjective that describes

1 Introduction Introduction Communication System Baseband an adjective that describes

Introduction Introduction Physical Layer Mobile network Global ISP Provides the means to transmit bits Basic Concepts of from sender to receiver, Data Transmission Defines the mechanical, electrical, and Home network timing

463 views • 7 slides
Welcome! Todays Agenda: Topic Introduction Course Introduction Team Practical

Welcome! Todays Agenda: Topic Introduction Course Introduction Team Practical

INFOGR Computer Graphics Jacco Bikker - April-July 2015 - Lecture 1: Introduction Welcome! Todays Agenda: Topic Introduction Course Introduction Team Practical Details Assignments Field Study State of

869 views • 62 slides
Introduction (00) RNDr. Martin Madaras, PhD. madaras@skeletex.xyz Introduction Introduction

Introduction (00) RNDr. Martin Madaras, PhD. madaras@skeletex.xyz Introduction Introduction

Virtual and Augmented Reality Introduction (00) RNDr. Martin Madaras, PhD. madaras@skeletex.xyz Introduction Introduction Who am I? What do I do here? 2 About me Short research bio: - 2014 - finished PhD at FMFI UK - 2014 2016 -

1.3k views • 39 slides
PRESENTATION The Introduction What is the Introduction ? The introduction prepares the audience

PRESENTATION The Introduction What is the Introduction ? The introduction prepares the audience

PRESENTATION The Introduction What is the Introduction ? The introduction prepares the audience for your presentation. It tells them what your presentation is about, why it is important, and finally, what to listen for in your speech. Get the

505 views • 3 slides
How to make a presentation with L A T EX? Introduction to L A T EX Introduction to Beamer

How to make a presentation with L A T EX? Introduction to L A T EX Introduction to Beamer

Introduction to Beamer Hafida Benhidour How to make a presentation with L A T EX? Introduction to L A T EX Introduction to Beamer Introduction to Beamer Hafida Benhidour Department of computer science King Saud University November

732 views • 49 slides
Shenzhen Cuilu jewelry Co., Ltd was founded in 1996 and its a large private enterprise

Shenzhen Cuilu jewelry Co., Ltd was founded in 1996 and its a large private enterprise

Introduction Introduction - - Brief Brief Introduction Introduction of of Cuilu Cuilu Group Group Introduction Introduction - - Brief Brief Introduction Introduction of of Cuilu Cuilu Group Group Shenzhen Cuilu jewelry Co., Ltd

147 views • 14 slides
Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org

Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org

V olunteer C ommunications N etwork (V-C-N.org) Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org Academy Course - 2012-02.24-2208 262: Introduction to ICS-214 : V-C-N.org : Slide: 1 V olunteer C

735 views • 34 slides
Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org

Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org

V olunteer C ommunications N etwork (V-C-N.org) Introduction to ICS- -214 214 Introduction to ICS Official Unit / Incident Log - A V-C-N.org Academy Course - 2012-02.24-2208 262: Introduction to ICS-214 : V-C-N.org : Slide: 1 V olunteer C

558 views • 18 slides

More recommend