41. What is the purpose of the X.509 standard?
Ans:
X.509 defines a framework for the provision of authentication services by the X.500 directory to its users. The directory may serve as a repository of public-key certificates. Each certificate contains the public key of a user and is signed with the private key of a trusted certification authority. In addition, X.509 defines alternative authentication protocols based on the use of public-key certificates.
42. 1. Consider a one-way authentication technique based on asymmetric encryption:
A → B: IDA
B → A: R1
A → B: E(PRa, R1)
Explain the protocol.
Ans:
This is a means of authenticating A to B. R1 serves as a challenge, and only A is able to encrypt R1 so that it can be decrypted with A's public key.
43. Consider the following simple authentication dialogue:
C → AS: IDc II Pc II IDv
AS → C: Ticket
C → V: IDc II Ticket; Ticket = E(Kv, [IDc II ADc II IDv])
Where: C = client
AS = authentication server
V = server
IDc = identifier of user on C
IDv = identifier of V
Pc = password of user on C
ADc = network address of C
Kv = secret encryption key shared by AS and V
Explain the process of this protocol.
Ans:
C sends a message to AS
AS checks the database for user ID and password match, and whether the user has access permission to (Server) V.
– If passed, it takes the user as authentic
– AS creates a ticket.
> The ticket contains user ID, server ID and network address, all encrypted by a secret key shared by AS and V.
C sends a message to V with C's ID and the ticket.
V decrypts the ticket
– verifies whether the user ID in the ticket is the same as the unencrypted user ID
- If those matches, the server grants requested service
44. In Kerberos, when Bob receives a ticket from Alice, how does he know it is genuine? Ans:
It contains the Alice’s ID, Bob’s name, and timestamp encrypted by the KDC-Bob shared secret key. (KDC – Key Distribution Centre)
45. Provide a brief definition of Network Access Control (NAC). Ans:
Network access control (NAC) is an umbrella term for managing access to a network. NAC authenticates users logging into the network and determines what data they can access and actions they can perform. NAC also examines the health of the user's computer or mobile device (the endpoints).
46. What is an Extensible Authentication Protocol (EAP)? Ans:
The Extensible Authentication Protocol (EAP) acts as a framework for network access and authentication protocols. EAP provides a set of protocol messages that can encapsulate various authentication methods to be used between a client and an authentication server. EAP can operate over a variety of network and link level facilities, including point-to-point links, LANs, and other networks, and can accommodate the authentication needs of the various links and networks.
47. List and briefly define four EAP authentication methods. Ans:
EAP-TLS (EAP-Transport Layer Security): EAP-TLS (RFC 5216) defines how the TLS protocol (described in Chapter 17) can be encapsulated in EAP messages. EAP-TTLS (EAP-Tunneled TLS) is similar to EAP-TLS except only the server has a certificate to authenticate itself to the client first. EAP-GPSK (EAP Generalized Pre-Shared Key) is an EAP method for mutual authentication and session key derivation using a Pre-Shared Key (PSK). EAP-GPSK specifies an EAP method based on pre-shared keys and employs secret key-based cryptographic algorithms. EAP-IKEv2 supports mutual authentication and session key establishment using a variety of methods.
48. Briefly define the deployment models of cloud computing Ans:
a. Public cloud: The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.
b. Private cloud: The cloud infrastructure is operated solely for an organization. It may be managed by the organization or a third party and may exist on premise or off premise.
c. Community cloud: The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, etc).
d. Hybrid cloud: The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability.
49. Describe some of the main cloud specific security threats. Ans:
Abuse and nefarious use of cloud computing: For many cloud providers (CPs), it is relatively easy to register and begin using cloud services, some even offering free limited trial periods. This enables attackers to get inside the cloud to conduct various attacks, such as spamming, malicious code attacks, and denial of service.
Insecure interfaces and APIs: CPs expose a set of software interfaces or APIs that customers use to manage and interact with cloud services. The security and availability of general cloud services is dependent upon the security of these basic APIs.
Malicious insiders: Under the cloud computing paradigm, an organization relinquishes direct control over many aspects of security and, in doing so, confers an unprecedented level of trust onto the CP. One grave concern is the risk of malicious insider activity. Cloud architectures necessitate certain roles that are extremely high-risk. Examples include CP system administrators and managed security service providers.
Shared technology issues: IaaS vendors deliver their services in a scalable way by sharing infrastructure. Often, the underlying components that make up this infrastructure (CPU caches, GPUs, etc.) were not designed to offer strong isolation properties for a multi-tenant architecture.
Data loss or leakage: For many clients, the most devastating impact from a security breach is the loss or leakage of data.
Account or service hijacking: With stolen credentials, attackers can often access critical areas of deployed cloud computing services, allowing them to compromise the confidentiality, integrity, and availability of those services.
Unknown risk profile: In using cloud infrastructures, the client necessarily cedes control to the cloud provider on a number of issues that may affect security.
50. What security areas are addressed by IEEE 802.11i? Ans:
IEEE 802.11i addresses four main security areas: authentication, key management, data confidentiality & data integrity.
51. List and briefly define threats to a wireless network. Ans:
Accidental association: A user intending to connect to a LAN may unintentionally lock a wireless access point from a neighboring network. Although the security breach is accidental, it nevertheless exposes resources of one LAN to the accidental user.
Malicious association: In this situation, a wireless device is configured to appear to be a legitimate access point, enabling the operator to steal passwords from legitimate users and then penetrate a wired network through a legitimate wireless access point.
Ad hoc networks: These are peer-to-peer networks between wireless computers with no access point between them. Such networks can pose a security threat due to a lack of a central point of control.
Nontraditional networks: Nontraditional networks and links, such as personal network Bluetooth devices, barcode readers, and handheld PDAs, pose a security risk in terms of both eavesdropping and spoofing.
Identity theft (MAC spoofing): This occurs when an attacker is able to eavesdrop on network traffic and identifies the MAC address of a computer with network privileges.
Man-in-the middle attacks: This attack involves persuading a user and an access point to believe that they are talking to each other when in fact the communication is going through an intermediate attacking device. Wireless networks are particularly vulnerable to such attacks.
Denial of service (DoS): A DoS attack occurs when an attacker continually bombards a wireless access point or some other accessible wireless port with various protocol messages designed to consume system resources.
Network injection: A network injection attack targets wireless access points which are exposed to nonfiltered network traffic, such as routing protocol messages or network management messages.
52. List some security threats related to mobile devices. Ans:
Some of the threats to the security of mobile devices are lack of physical security control, use of untrusted mobile device, use of untrusted networks, use of application created by unknown parties, interaction with other systems, use of untrusted content, and use of location services.
53. Briefly describe the five IEEE 802.11i phases of operation. Ans:
Discovery: An AP uses messages called Beacons and Probe Responses to advertise its IEEE 802.11i security policy. The STA uses these to identify an AP for a WLAN with which it wishes to communicate. The STA associates with the AP, which it uses to select the cipher suite and authentication mechanism when the Beacons and Probe Responses present a choice.
Authentication: During this phase, the STA and AS prove their identities to each other. The AP blocks non-authentication traffic between the STA and AS until the authentication transaction is successful. The AP does not participate in the authentication transaction other than forwarding traffic between the STA and AS.
Key generation and distribution: The AP and the STA perform several operations that cause cryptographic keys to be generated and placed on the AP and the STA. Frames are exchanged between the AP and STA only
Protected data transfer: Frames are exchanged between the STA and the end station through the AP. As denoted by the shading and the encryption module icon, secure data transfer occurs between the STA and the AP only; security is not provided end-to-end. Connection termination: The AP and STA exchange frames. During this phase, the secure connection is torn down and the connection is restored to the original state.
54. In IEEE 802.11, open system authentication simply consists of two communications. An authentication is requested by the client, which contains the station ID (typically a MAC address). This is followed by an authentication response from the AP/router containing the success or failure message. An example of when a failure may occur is if the client’s MAC address is explicitly excluded in the AP/router configuration.
a. What are the benefits of this authentication scheme? Ans:
This scheme is extremely simple and easy to implement. It does protect against very simple attacks using an off-the-shelf Wi-Fi LAN card, and against accidental connection to the wrong network.
b. What are the security vulnerabilities of this authentication scheme? Ans:
This scheme depends on all parties behaving honestly. The scheme does not protect against MAC address forgery.
55. What are three broad mechanisms that malware can use to propagate? Ans:
The three broad mechanisms malware can use to propagate are: infection of existing executable or interpreted content by viruses that is subsequently spread to other systems; exploit of software vulnerabilities either locally or over a network by worms or drive-by-downloads to allow the malware to replicate; and social engineering attacks that convince users to bypass security mechanisms to install trojans, or to respond to phishing attacks.
56. Classify viruses based on the targets they try to infect. Ans:
A virus classification by target includes the following categories:
Boot sector infector: Infects a master boot record or boot record, and spreads when a system is booted from the disk containing the virus.
File infector: Infects files that the operating system or shell consider to be executable.
Macro virus: Infects files with macro or scripting code that is interpreted by an application.
Multipartite virus: Infects files in multiple ways. Typically, the multipartite virus is capable of infecting multiple types of files, so that virus eradication must deal with all of the possible sites of infection.
57. In general, terms, how does a worm propagate?
Ans:
a. Search for other systems to infect by examining host tables or similar repositories of remote system addresses.
b. Establish a connection with a remote system.
c. Copy itself to the remote system and cause the copy to be run.
58. What is a DDos? Ans:
A denial of service (DoS) attack is an attempt to prevent legitimate users of a service from using that service. When this attack comes from a single host or network node, then it is simply referred to as a DoS attack. A more serious threat is posed by a DDoS attack. In a DDoS attack, an attacker is able to recruit a number of hosts throughout the Internet to simultaneously or in a coordinated fashion launch an attack upon the target.
59. List and briefly define three classes of intruders. Ans:
Masquerader: An individual who is not authorized to use the computer and who penetrates a system's access controls to exploit a legitimate user's account.
Misfeasor: A legitimate user who accesses data, programs, or resources for which such access is not authorized, or who is authorized for such access but misuses his or her privileges.
Clandestine user: An individual who seizes supervisory control of the system and uses this control to evade auditing and access controls or to suppress audit collection.