Outline

• Why be Concerned?
• Threats and Responses
• Technology for your Protection
• Common Threats and Responses
• Security - Privacy from Whom?

Why be Concerned?

• The Internet = communication channel
• It is not designed to protect the privacy of information
• Most electronic mail can be intercepted and read at numerous points
• Popular operating systems offer little protection from crackers and viruses

Threats and Responses

• Our society is based on trust (mostly)
• We all take sensible precautions:
  • Don't flash cash in public
  • Don't write secrets on postcards
  • Notarize important papers
  • Learn to use and then carry concealed weapons (in enlightened states)

Examples of Threats

• Unauthorized user reads your files
• Viruses in downloaded software or in your email
• Your email has an unintended audience
• Your credit card number is stolen
• Your identity is stolen

Technology for Your Protection

• Encryption
  • Secret key encryption
  • Public key -Private key encryption
• Digital Signatures
• Certificates of Authority

Encryption

• Secret Key Encryption
  • example: password
  • limitation: every authorized user must be told the secret key
• Public Key - Private Key Encryption
  • example: PGP key
  • advantage: only the recipient needs the private key
    
  • mathematically secure based on factorization of large prime numbers

Public Key - Private Key Encryption

Public Key	Private Key
Anyone can encrypt files with key. No one can decrypt them with it.	This key decrypts files encoded with the public key.

Digital Signatures

Public Key	Private Key
Anyone can verify that the private key signed a file or message. No one can sign with this key.	This key creates a digital signature for files and messages.

What Makes Encryption Secure?

• Bad: "Security through Obscurity"
  • Most proprietary security software use secret, unverified algorithms.
  • Cracking programs are often freely available on the Internet.
• Good: "Trust but Verify"
  • Publicly available algorithms are time-tested through prolonged public scrutiny
  • Example: the simple XOR function with a very long key is unbreakable

Security and Key Length

• "Key length" is the size of the key in binary "bits". Each additional "bit" doubles the difficulty in breaking a key.
• Secret Keys
  • 40-bit: can be broken in real time
  • 56-bit: can be broken in days
  • 128-bit: secure (for now)
• Public Keys
  • 1024-bit keys are reasonably secure.
  • 2048-bit keys are more secure.
• A lucky guess can break any key.

Certificates of Authority

• An independent entity that guarantees that the signer is authentic
• Much like a notary public
• Commonly used in Web browsers. Will become more common as digital signatures become more widely used.
• You can create your own digital certificate of authority, but who will believe it?

Common Threats and Responses: General Measures

• Use robust operating systems
  • Linux is rapidly approaching desktop ease of use. It is reliable and as secure as any other system. It costs $50 plus learning time.
  • Microsoft NT has well-known security holes. Fixes come only from Microsoft.
• Use secure Web servers for anything you don't want the world to read.

Common Threats and Responses: Someone Guesses Your Password

• Automated "password cracking" software uses entire dictionaries and lots of combinations of words and numbers.
• Don't use ordinary words or combinations of words and numbers.
• Don't use names or dates.
• Do use punctuation and garbage letters.
• Don't write it down.

Common Threats and Responses: Unauthorized User Reads Your Files

• Protect your computer physically (if you can)
• Hide on network behind a firewall (if you can)
• Encrypt your files (you have complete control). Example: www.pgp.com

Common Threats and Responses: Viruses in Downloaded Software or in Your Email

• Change to Linux, which is unaffected by viruses.
• Be very careful from where you download.
• Turn off the macro feature of Microsoft Word.
• Turn off the Active X features of Microsoft Internet Explorer.
• Buy software that checks for viruses, bad macros, and evil Active X applets.

Common Threats and Responses: Your Email has an Unintended Audience

• Be aware that any email you send can appear on the front page of your local newspaper in the morning.
• Be aware that email is copied on "mail serves" as it is sent from your machine to the recipient's machine, and that those copies can persist even if you and the recipient delete your copies.
• Encrypt your email (e.g., Eudora Lite plus PGP)

Common Threats and Responses: Web Browsers

• The common Web browsers keep a record of sites you have visited, pages you have downloaded, and "cookies" you have received.
• These records may be discoverable in lawsuits, and certainly can be scanned by anyone with access to your machine (e.g., your boss and/or your subordinates).
• You can destroy these records by routinely erasing the files that hold them. There are programs that will do this for you automatically.

Common Threats and Responses: Your Credit Card Number is Stolen

• Make sure your Web browser is connected in "secure" mode before sending sensitive information.
• Hope that your on-line vendor has good information security.

Common Threats and Responses: Your Identity is Stolen

• A skilled thief can open bank accounts and get credit cards in your name given your SSN, date of birth, parents' names, and similar information.
• Laws protecting victims are weak at this time.
• Law enforcement agencies often cannot help clear your record.
• Protect your SSN and similar information!

Security - Privacy from Whom?

• Medical Information
  • The Medical Information Bureau coordinates sharing of information among 750 insurance companies: credit, medical conditions, driving records, criminal records, participation in hazardous sports.
• Prisoners handle medical information and tax returns in some states (ABC News, 3/98).