Module in Information Assurance for Telecommunications/

Data Communication Course

Cybersecurity Workshop at Indiana University of Pennsylvania

Charles R. Woratschek (woratschek@rmu.edu) & Terri L. Lenox (lenoxtl@westminster.edu)

August 4-9, 2002

 

1.0       Introduction.

 

The general introductory networking course on the undergraduate level provides the student with an introduction to the theory and practice of 1) data communications (transmission, media, signal encoding, link control and multiplexing); 2) communication networks (ATM, LAN); and 3) TCP/IP protocols.

 

It is possible to integrate an information assurance module (security) into this course by eliminating one or more of the topics offered in the traditional course.

 

Why add information assurance to the traditional telecommunications course?   

  • Ninety percent of respondents (primarily large corporations and government agencies) detected computer security breaches within the last twelve months. (2002 CSI/FBI Computer Crime and Security Survey (http://www.gocsi.com/ press/20020407.html).
  • Eighty percent acknowledged financial losses due to computer breaches (2002 CSI/FBI Computer Crime and Security Survey).

2.0       Possible Module Topics

 

The following lists the possible topics for the information assurance module.  The information provided in this list was developed by Wayne Summers for the Information Assurance Workshop at IUP (http://csc.ColumbusState.edu/summers).  Since this document describes a multi-week module in an existing course, this list must be pruned.  See section 8.0 for an estimate of the hours required for each topic.

 

  1. Definitions:  computer security, information assurance.
  2. Threats to computer security.
  3. Scope of computer crime (legal, economic, privacy, warfare).
  4. Security policies.
    • Who, what, why, how.
    • Implementation of policy.
    • Consequences of violations.
    • CERT Coordination Center at CMU (http://www.cert.org/).
    • Electronic Privacy Information Center (EPIC) (www.epic.org).
    • National Computer Security Association (http://www.trusecure.com/ncsa.shtml).
  5. Risk assessment.

    6.
  6. Vulnerability : Information gathering.

a.       Who.

      • Level (network, machine, application).
      • E.g., Sam Spade, Whois, Nslookup, open source public information.

b.      IP addresses

      • E.g., ARIN, Neotrace, Traceroute.

c.       Active machines.

      • E.g., Ping, Ping War, Ping Plotter.

d.      Open ports or access points.

      • Port scanners.
        • Eg.., NetBrute, Nmap.
      • War dialers (find out modems).
        • E.g., THC-Scan.
      • War drivers.
        • http://pasadena.net/apmap/losangeleslarge.gif

e.       Operating system.

      • E.g., Nmap.

f.        Services on each port.

      • Default port numbers.
      • Vulnerability problems with Telnet, finger.

g.       Mapping the network.

      • E.g., Traceroute, Visual ping, Cheops, WhatsUp
  1. Vulnerability : Spoofing.
    • IP spoofing.
    • E-mail spoofing.
    • Web spoofing.
    • Non-technical spoofing (e.g., social engineering & reverse social engineering).
  2. Vulnerability : Session hijacking.
    • Passive.
    • Active.
    • E.g., Nmap, Ethereal packet sniffer software, Juggernaut, Hunt, TTY Watcher
  3. Vulnerability : Denial of service.
    • Crash or flood system.
    • Ping of Death, SSPing, Land Exploit, Smurf, SYN Flood, CPU Hog, Win Nuke, RPC Locator, Jolt, Bubonic, Targa, Trip Flood Network, Trinoo.
  4. Vulnerability : Buffer overflows.
  5. Vulnerability : Password.
    • Why passwords.  Length & character implications.
    • Legality.
    • Biometric scans.
    • Password management.
    • Password attacks via dictionaries, brute force, social engineering.

·        E.g., Lc4 (l0phtcrack), NTFS to DOS,

  1. Vulnerability : Viruses, worms, Trojan horses, and logic/time bombs.
    • Virus detection (E.g., CodeRed).
    • Virus protection (E.g., Norton, McAfee).
  2. Vulnerability : Hackers.
    • http://csc.ColumbusState.edu/summers/Research/NetworkSecurity/security/hacking.html
  3. Security solutions.
    • E-mail security.

·        E.g., PGP (Pretty Good Privacy), S/MIME.

    • System Security.

·        Intruders & viruses.

o       CodeRed, Nimda

o       http://www.mcafee.com/anti-virus/default.asp

o       http://www.cert.org

·        Firewalls.

o       E.g., Cyberguard, CheckPoint

·        Examine the files for unauthorized activity.

o       E.g., TripWire

·        Periodically check for Rootkits

o       E.g., Carbonite

    • Encryption.
    • Access control.

·        E.g., Tripwire, Portblocki.

·        Turn off Telnet, gopher, ftp.

    • Automatic call back.
    • Node authorization.

·        E.g., Kerberos, X.509.

    • Differentiated access rights.
    • User authentication.
    • Passwords & passphrases (why, store, encrypt, crack).
    • Challenge-response systems.
    • Token or smart cards.
    • Exchange of secret protocol.
    • Biometric (personal characteristics).
    • Warning systems.

·        E.g., ANT Exp, Attacker, klaxon.

    • Disaster planning.
  1. Common criteria from NIST.
    • csrc.nist.gov/cc
    • Note:  good for Software Engineering course.
  2. Database security & privacy issues.
  3. Ethics & privacy issues.

 

3.0       Hands-on Exercises In Class.

 

Types of exercises will depend partly on whether or not an isolated network is available.

 

·        Try some of the software tools, such as :

o       ARIN

o       Neotrace, traceroot.

o       Ping, Ping Plotter.

o       Virus detection software – e.g., CodeRed .

  • Study the log files for the system.

·        Ethereal or tcpdump exercise.  Watch packets across the network.

·        Password cracking exercise?  Think carefully about implications & what machines to use.

 

4.0              Assignments.

 

Types of assignments will depend partly on whether or not an isolated network is available.

 

a.       Outline components of security policy at your university/college or organization.

·        What elements are missing?

·        Modify the policy.

·        Write a security policy for WePassEmAll U.

·        If you were to require laptop computers for all students, what security issues would arise?

·        Using a wireless network?

b.      Using Ping or Ping Plotter, find the route from your computer to the following sites.  What’s the latency?

·        http://csc.ColumbusState.edu

·        http://www.vuw.ac.nz

·        http://www.cairo.eun.eg/

·        http://www.ed.ac.uk/

c.       Build a wireless network antenna from a Pringle’s can.

·        Antenna on the Cheap (http://www.oreillynet.com/lpt/wlg/448).

d.      Install and run the Attacker software on your computer.  Monitor the activities for a 48 hour period.  If an off campus IP address appears, try to trace the source using Neotrace and ARIN.

e.       Track & decipher e-mail headers to find where an e-mail message originates.

f.        Perform an analysis of a network security tool with source code. (http://www.cse.fau.edu/%7edan/COT4930/)  Explain its use, give examples, and how it is used for protecting/attacking systems.  The goal of this analysis is for us to be able to build a similar tool using the architecture and flow chart that you reverse-engineered. Below is a list of the tools that you can research on.

·        Snort (http://www.clark.net/~roesch/security.html)

·        Tripwire (http://www.tripwire.com)

·        Netcat (http://www.10pht.com/)

·        Tcpdump (http://www.tcpdump.org/)

·        Nmap (http://ww.insecure.org/nmap)

g.       Describe briefly a model for protecting your computer(s) at home.

h.       Describe a comprehensive solution for protecting your credit card information transmitted through Internet. What security services need to be provided? What types of cryptographic algorithms that you need to build a solution? (http://www.cse.fau.edu/%7edan/COT4930/) 

5.0       Expected Outcomes.

 

  • Discuss major issues concerning information assurance.
  • Understand system security issues.
  • Recognize the various types of security solutions, their advantages and disadvantages.
  • Use standard security tools to detect security breaches.
  • ?? Use standard security tools to repair security breaches.

 

6.0       Issues to be resolved.

 

  • Network resources & isolated machines.
  • Appropriate software to show students.
  • Appropriate cases & assignments – resources, legality, etc.
  • Check list of topics at http://www.cs.fsu.edu/~yasinsac/Papers/Yas01b.pdf   Yasinsac, Alex.  Information Security Curriculum in Computer Science Departments: Theory and Practice.

 

 

7.0       Possible Text Books.

 

  • William Stallings (2000).  Network Security Essentials:  Applications and Standards.  Prentice-Hall: Upper Saddle River, NJ.
  • John Viega and Gary McGraw (2002).  Building Secure Software:  How to Avoid Security Problems The Right Way.  Addison-Wesley: Boston.
  • Cliff Stoll (1990) Cuckoo’s Egg.
  • Eric Cole (2001).  Hackers Beware, defending your network from the wiley hacker. New Riders Publishing. ISBN: 0735710090.
  • Bruce Schneier (2000).  Secrets & Lies: Digital Security in A Networked World. John Wiley & Sons. ISBN: 0471253111.
  • Donald L. Pipkin (2000).  Information Security, Protecting the Global Enterprise. Prentice Hall PTR. ISBN: 0130173231.
  • Simon Garfinkel and Gene Spafford (1996).  Practical UNIX &Internet Security.  O'Reilly & Associates. ISBN: 1565921488.
  • Charles P. Peleeger (1996). Security in Computing. Prentice Hall PTR. ISBN: 0133374866

 

8.0              Topics and Time Frames

 

Topics

Possible Software

Est. Hours

Useful in Another Course

Introduction.

 

1

Intro

Definitions.

 

 

 

Threats to computer security.

 

 

 

Scope of computer crime.

 

 

 

Security policies.

 

 

 

Risk assessment.

 

 

 

Information gathering.

 

2

 

Who.

Sam Spade, Whois, Nslookup, ARIN, Neotrace, Traceroute, Ping, Ping War, Ping Plotter

 

 

Open ports or access points.       

NetBrute, Nmap, THC-Scan.

 

 

Operating system.       

Nmap.

 

OS

Services on each port.

 

 

 

Mapping the network.        

Traceroute, Visual ping, Cheops, WhatsUp.

 

 

Spoofing.

 

.5

 

Session hijacking.               

Nmap, packet sniffer software, Juggernaut, Hunt, TTY Watcher, IP Watcher.

1

 

Denial of service.

Ping of Death, SSPing, Land Exploit, Smurf, SYN Flood, CPU Hog, Bubonic, Targa, Trip Flood Network, Trinoo, WinNuke, RPC Locator, Jolt.

1

 

Buffer overflows.

 

.5

Intro programming

Password.             

Lc4 (l0phtcrack), NTFS to DOS.

1

 

Viruses, worms, Trojan horses, and logic/time bombs

CodeRed, Norton, McAfee.

1

 

Hackers.

 

.5

 

Security solutions.              

 

4

System Eng.

System Security.

PGP (Pretty Good Privacy), S/MIME.

 

Tele

Encryption.

 

 

Tele., Programming

Access control.            .

Tripwire, Portblocki.

 

Tele

Automatic call back.

 

 

Tele

Node authorization.    

Kerberos, X.509.

 

 

Differentiated access rights.

 

 

 

User authentication.

 

 

 

Passwords & passphrases

 

 

Programming

Challenge-response systems.

 

 

 

Token or smart cards.

 

 

Tele

Exchange of secret protocol.

 

 

 

Biometrics.

 

 

 

Warning systems.       

ANT Exp, Attacker.

 

 

Disaster planning.

 

 

System Eng.

Common criteria from NIST.

 

2

System Eng.

Database security & privacy issues.

 

 

Database

Ethics & privacy issues.

 

1

Intro

 

 

15 hours.