CS707 Complete Handouts

Lecture 1

1.2.1 Classical Cryptography

The earliest known use of cryptography is found in non-standard hieroglyphs carved into monuments from Egypt's Old Kingdom ( 4500+ years ago).

Scytale:

The ancient Greeks and the Spartans in particular, are said to have used this cipher to communicate during military campaigns. Sender and recipient each had a cylinder (called a scytale) of exactly the same radius. The sender wound a narrow ribbon of parchment around his cylinder, and then wrote on it lengthwise . After the ribbon is unwound, the writing could be read only by a person who had a cylinder of exactly the same circumference.

Polybius Square:

Another Greek method was developed by Polybius (now called the " Polybius Square"). Each letter is represented by its coordinates in the grid. For example, "BAT" becomes "12 11 44“. Developed for telegraphy e.g. pairs of torches

Caesar Cipher:

The Romans knew something of cryptography (e.g., the Caesar cipher and its variations). The method is named after Julius Caesar, who used it to communicate with his generals. The Caesar Cipher is an example of what is called a shift cipher. To encode a message, letters are replaced with a letter that is a fixed number of letters beyond the current letter.

Atbash cipher:

Later still, Hebrew scholars made use of simple mono alphabetic substitution ciphers (such as the Atbash cipher) beginning perhaps around 500 to 600 BC. The Atbash cipher is a very specific case of a substitution cipher where the letters of the alphabet are reversed. In other words, all As are replaced with Zs, all Bs are replaced with Ys, and so on.

Cryptography from Muslim History (Medieval Cryptography):

AlKindi, wrote a book on cryptology, the " Risalah fi Istikhraj alMu'amma" (Manuscript for the Deciphering Cryptographic Messages), circa 850CE. This book apparently antedates Western European cryptography works by 300 years and predates writings on probability and statistics by Pascal and Fermat by nearly 800 years. He was a pioneer in cryptanalysis and cryptology, and devised new methods of breaking ciphers, including the frequency analysis method. In his book Al-Kindi described the first cryptanalysis techniques, including some for polyalphabetic ciphers, cipher classification, Arabic phonetics and syntax, and, most importantly, gave the first descriptions on frequency analysis. He also covered methods of encipherments, cryptanalysis of certain encipherments, and statistical analysis of letters and letter combinations in Arabic.

Cryptography in the Renaissance Period:

Essentially all ciphers remained vulnerable to the cryptanalytic technique of frequency analysis until the development of the polyalphabetic cipher, and many remained so thereafter. The polyalphabetic cipher was most clearly explained by Leon Battista Alberti around the year 1467, for which he was called the "father of Western cryptology".

Modern Cryptography:

Both cryptography and cryptanalysis have become far more mathematical since World War II. Even so, it has taken the wide availability of computers, and the Internet as a communications medium, to bring effective cryptography into common use by anyone other than national governments or similarly large enterprises. The era of modern cryptography really begins with Claude Shannon, arguably the father of mathematical cryptography, with the work he did during WWII on communications security.

The First Encryption Standard:

The mid-1970s saw two major public (i.e., non-secret) advances. First was the publication of the draft Data Encryption Standard in the U.S. Federal Register on 17 March 1975. The proposed DES cipher was submitted by a research group at IBM, at the invitation of the National Bureau of Standards (now NIST), in an effort to develop secure electronic communication facilities for businesses such as banks and other large financial organizations. The aging DES was officially replaced by the Advanced Encryption Standard (AES) in 2001 when NIST announced FIPS 197. After an open competition, NIST selected Rijndael, submitted by two Belgian cryptographers, to be the AES.

Lecture 2&3 The Threat Environment: Attackers and Their Attacks

The world today is a dangerous place for corporations. The Internet has given firms access to billions of customers and other business partners. But the Internet has also given criminals access to hundreds of millions of corporations and far more individuals. Wireless transmission has brought new mobility but has also allowed attackers to enter corporations stealthily. Bypassing firewalls designed to keep intruders from coming in through the Internet

The Threat Environment:

The threat environment consists of the types of attackers and attacks that company face.

Security Goals:

Three common core goals are referred to as CIA:

Confidentiality

Integrity

Availability

Confidentiality: Confidentiality means that people cannot read sensitive information, either while it is on a computer or while it is traveling across a network

Integrity: Integrity means that attackers cannot change or destroy information, either while it is on a computer or while it is traveling across a network. Or, at least, if information is changed or destroyed, then the receiver can detect the change or restore destroyed data.

Availability: Availability means that people who are authorized to use information are not prevented from doing so

Countermeasures:

Tools used to thwart attacks

Also called safeguards, protections, and controls Countermeasures can be technical, human, or a mixture of the two

Three Types Of Countermeasures:

Preventative: keep attacks from succeeding. Most controls are preventative

Detective: identify when a threat is attacking, and especially when it is succeeding. Fast detection can minimize damage

Corrective: get the business process back on track after a compromise.

The TJX Data Breach: The TJX Companies, Inc. (TJX)________ It is an online business company. A group of more than 2,500 retail stores companies operating in the United States, Canada, England, Ireland, and several other countries. On December 18, 2006, TJX detected “suspicious software” on its computer systems. They called in security experts who confirmed an intrusion and probable data loss. They notified law enforcement immediately. Company estimated that 45.7 million records with limited personal information included. Much more information was stolen on 455,000 of these customers. TJX was not in compliance with Industry-Data Security Standard (PCI-DSS) (later found to meet only 3 of 12 control objectives). TJX has suffered from damages of $256 million.

Lecture 4 Employee and Ex-employee threats:

Are “insiders” the biggest threat? They are dangerous because they have knowledge of internal systems. They often have the permissions to access systems. They often know how to avoid detection. Employees generally are trusted. Employees and ex-employees are dangerous because they have extensive knowledge of systems, have the credentials needed to access sensitive parts of the systems, often know how to avoid detection, and can benefit from the trust that usually is accorded to “our people” . IT and especially IT security professionals are the greatest employee threats. " Who will guard the guards themselves?”

Sophisticated computer knowledge not required:

In 23 financial cybercrimes committed between 1996 and 2002, 87 percent were accomplished without any “sophisticated programming” – Keeney. The US department of justice has a website which lists federal cybercrime prosecutions. Roughly half the defendants are IT or IT security employees or ex-employees.

Employee Sabotage:

They may destruction of hardware, software, or data and plant time bomb or logic bomb on computer. Sabotage comes from the French word for “shoe” because disgruntled workers in the early years of the Industrial Revolution supposedly threw their wooden shoes into machines to stop production. Tim Lloyd, a computer systems administrator, was fired for being threatening and disruptive. In retaliation, Lloyd planted a logic bomb on a critical server. When pre-set conditions occurred, the logic bomb destroyed the programs that ran the company’s manufacturing machines. Lloyd also took home and erased the firm’s backup tapes to prevent recovery. Lloyd’s sabotage resulted in USD 10 million in immediate business losses, USD 2 million in reprogramming costs, and 80 layoffs. The attack led to a permanent loss of the company’s competitive status in the hi-tech instruments and measurements market because the company could not re-build the proprietary software it had been using. -Sharon Gaudin, Computerworld, 2002

Two traffic Engineers working for the city of Los Angeles pleaded guilty to hacking the city’s traffic center and disconnecting traffic signals at four LA’s busiest intersections. They then locked out the controls to these intersections so that it took four days to restore control. They did this a few hours before their union’s scheduled job action against the city in support of contract negotiations. For this infraction, they received