Security fundamentals: CIA, threats and attacks

The second half of the course starts here. In the first eight weeks you learned how packets are carried; now we will look at how the same packets are abused. This week looks like a vocabulary week, but the exam has two kinds of questions: choosing the right definition (is this a vulnerability or a threat?) and small risk calculations (risk score, ALE, DDoS traffic). Five golden rules:

1. The vulnerability is inside, the threat is outside. A vulnerability is a weakness of the system; a threat is the event or person that could exploit it. An attack is the two meeting.
2. Tie every attack to one of the CIA properties. Reading → confidentiality, modification → integrity, inability to access → availability.
3. Risk = likelihood × impact. The monetary version: $ALE = SLE \times ARO$.
4. In DDoS, find the traffic by multiplying. Number of bots × bot rate, or attacker rate × amplification factor.
5. The smaller the attack surface, the better. Every open port, every service, every user is an entry door.

Basic concepts

In the language of security, the words are very close to each other, and these are exactly what the exam asks. Let’s think about it through a bank’s online branch.

The chain is this: a threat agent carries out an attack through a vulnerability and harms the asset. A countermeasure breaks one link of this chain: it closes the vulnerability, detects the attack, or limits the harm.

PITFALL · confusing a vulnerability with a threat. An “unpatched server” is not a threat, it is a vulnerability. “A botnet scanning this server” is a threat. Ask yourself: is this a property of my system (vulnerability), or something that could come from outside (threat)?

The CIA triad

Information security has three basic goals. The abbreviation is CIA (the CIA triad):

• Confidentiality: only authorized people read the information. Tools: encryption, access control.
• Integrity: information is not modified without authorization; if it is modified, this is noticed. Tools: hash, MAC, digital signature.
• Availability: an authorized user reaches the information when needed. Tools: redundancy, backups, DDoS protection.

Two goals often added to these: authentication / authenticity, meaning the message really comes from the claimed person, and non-repudiation, meaning the sender cannot say “I didn’t send it”.

Risk calculation

There is no budget to close every risk at once. First you rank the risks. The simplest method is a qualitative scale: likelihood and impact are scored from 1 to 5 and multiplied.

$R = L \times I$

The risk with 20 points is addressed first. The product determines the order; two risks with impact 5 are not equally important.

Monetary risk: SLE and ALE

The quantitative method converts risk into money:

• AV (asset value): the value of the asset.
• EF (exposure factor): the fraction lost in a single event (between 0 and 1).
• SLE (single loss expectancy): loss from a single event, $SLE = AV \times EF$.
• ARO (annualized rate of occurrence): the expected number of events per year. For “once every 4 years” it is 0.25.
• ALE (annualized loss expectancy): the expected yearly loss, $ALE = SLE \times ARO$.

Worked example. A database valued at 400 000 USD loses 30% of its value in a breach. A breach is expected once every two years.

SLE = AV × EF   = 400000 × 0.30 = 120000 USD
ARO = 1 / 2     = 0.5
ALE = SLE × ARO = 120000 × 0.5  = 60000 USD / year

Whether to adopt a control is decided like this: (ALE before − ALE after) − annual cost of the control. If the result is positive, the control pays for itself. If negative, accepting the risk (risk acceptance) or transferring it by insurance (risk transfer) makes more sense. The four strategies: avoid, mitigate, transfer, accept.

Types of attacks

First the big distinction: a passive attack only listens (eavesdropping, traffic analysis); since it does not change the system, it is hard to detect, and the countermeasure is encryption. An active attack changes something: it modifies a message, replays it, impersonates an identity (masquerade) or stops the service. Active attacks are hard to prevent, but they can be detected.

DoS and DDoS

Denial of service (DoS) targets availability. If it comes from a single source it is called DoS, and if it comes from thousands of compromised machines (a botnet) it is called distributed DoS (DDoS). Three main classes:

• Volumetric: fills the link with traffic. Example: UDP flood, amplification.
• Protocol: exhausts the server’s state tables. Example: SYN flood.
• Application layer: sends expensive requests. Example: thousands of queries per second to a search page.

Botnet calculation. 5000 bots, each sending 2 Mbps: $5000 \times 2 = 10000$ Mbps $= 10$ Gbps. A 1 Gbps link is exceeded ten times over.

Amplification (reflection/amplification). The attacker sends a small request to an open server, making the source address the victim’s address (spoofing). The server sends a much larger response to the victim. If the request is 64 bytes and the response 3200 bytes:

factor        = 3200 / 64     = 50
attacker      = 10 Mbps of forged requests
to the victim = 10 × 50       = 500 Mbps

SYN flood. Recall the TCP three-way handshake (week 7). When the server receives a SYN, it sends a SYN-ACK and keeps the half-open connection in a queue (backlog) until the final ACK arrives. The attacker sends SYNs from forged addresses, and the ACK never arrives. If the queue is 2048 entries and the timeout is 60 s, $2048 / 60 \approx 34.1$ SYN/s is enough to keep the queue full. A very low rate. The defense is SYN cookies: the server keeps no state and encodes the information in the sequence number of the SYN-ACK.

TIP · DDoS questions are always multiplication. Bots × rate, attacker rate × factor, backlog / timeout. Watch the units: when converting Mbps to Gbps, divide by 1000.

Man-in-the-middle (MITM)

The attacker gets between the two parties and acts toward each as if it were the other. It can read the traffic (confidentiality) and modify it (integrity). On a local network the typical way is ARP poisoning (week 4): the attacker broadcasts a forged ARP reply saying “the gateway’s MAC address is mine”. Countermeasures: end-to-end encryption and server verification with a certificate (TLS), static ARP entries, dynamic ARP inspection on the switch.

Spoofing (identity forgery)

Forging an identity. IP spoofing: changing the source address of the packet; used in DDoS reflection. ARP spoofing: a forged MAC mapping. DNS spoofing: redirecting a user to another server with a forged DNS reply. Email spoofing: forging the “From” field; reduced with SPF, DKIM and DMARC.

Phishing

Convincing a user with a fake message to enter a password or open a file. The targeted version is spear phishing, the one aimed at executives is whaling, the SMS version is smishing, and the phone version is vishing. It exploits human weakness more than technical weakness; it is a kind of the social engineering in week 11. Countermeasures: awareness training, multi-factor authentication (MFA), email filters.

Malware

The attack surface

The attack surface is the sum of all the points where an attacker can touch the system. Three components: the network surface (open ports, services), the software surface (every function that takes input, APIs, plugins) and the human surface (every employee who could fall for phishing). Ways to reduce it: shutting down unused services, restricting ports with a firewall, deleting unnecessary code and accounts, giving each component the least privilege.

Authentication is part of the surface too. Weak passwords are open to brute force:

8 characters, lowercase only: 26^8 = 208 827 064 576
10^9 guesses per second      →   ~209 s (3.5 minutes)
8 characters, 62 symbols:     62^8 ≈ 2.18 × 10^14
10^9 guesses per second      →   ~2.5 days

As the length and the symbol set grow, the time increases exponentially. Still, the real defense against an offline attack is a slow, salted password hash.

Common mistakes