Lectures

Lectures are held weekly on Thursdays, 12:45-14:15 in KN:E-301 according to the following plan:

• ItemCourse objectives
• What assets do we want to protect: confidentiality, integrity, availability.
• Difference between policy and mechanism and the struggles to create a good policy.
• Economics of information system
  • Characteristics of a market:
    • price of information
    • technical lock-in
    • asymetric information
  • Economics of security and dependability
    • Security seems to be a public good
    • Security is a power relationship
  • How much effort should I put into design, development, and testing?

http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ Limits of SMS 2FA Malicious microchips

• The importance of a protocol design
• An assumption under which legacy protocols were designed
• Threat model for network security
  • Man in the middle
  • Participation in the protocol
  • Eavesdropping
• Evil Twin/Honeypot Attack
• ARP spoofing/poisoning
• TCP / IP protocol
  • security guarantees
  • TCP sequence number attack
  • Mitnick attack
• UDP and DNS
  • Dan Kaminsky attack
  • Cache poisoning
  • Changing DNS in a router
  • Impact on the security of web
• BGP protocol
  • Hijacking BGP protocol
  • Defences?

Explanation of BGP man in the middle attack Defense against BGP man-in-the-middle attack Hitchhiker's guide to DNS poisoning Hijacking BGP for profit Examples of hijacking in the press

• Key exchange with public-private keys
• The role of certificates in the exchange
• Advantages of certificates and who gets/lose the money
• Problems of certificates — a revocation nightmare
  • deleting CA
  • OCSP
  • OCSP stapling
  • public ledger
• Issuing certificates — verification of identity
• UI aspect of certificates and who can safely use them?
• Attacks
  • Cache poisoning
  • HTTPS stripping
  • Protocol downgrading
  • Man-in-the-middle attack
• HSTS
• Certificate pinning
• DNS-Sec — chain of trust

Visualizer of DNSSEC trust chain 30 000 mis-issued certificates by Symantec

• What are covert channels
  • storage covert channels
  • timing covert channels
• Side-channel attacks
• Steganography
• Steganalysis
• Watermarking

• Designing policy for security of private networks
• Firewalls and their security problems
• Intrusion detection / prevetion systems
• Intrusion deterrence
• Thin clients