30
1 Security Hiroshi Toyoizumi toyo @u-aizu.ac. jp toyo @ aoni . waseda .ac. jp

1 Security Hiroshi Toyoizumi [email protected] [email protected]

  • View
    251

  • Download
    1

Embed Size (px)

Citation preview

Page 1: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

1

Security

Hiroshi [email protected]

[email protected]

Page 2: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

2

Social Engineering

• Your kindness may put you in danger.

• You as a team may put you in danger.

• Your reliable person may put you in danger.

• What can you do?

Page 3: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

3

Malicious Mobile Codes: Viruses and Worms

Page 4: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

4

Laroux: Excel Macro Virus

Page 5: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

5

Current epidemics

Page 6: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

6

Cracking

• Hijacking your machine.• Stepping stone.• Tamper with www pages.• Leak of important information.

Page 7: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

7

Scanning IP addresses

Page 8: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

8

Detect Windows shared folder

Page 9: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

9

How to protect cracking

• Anti-virus• Pacth• Encryption• Firewalls• IDS:Intrusion Detection System

Page 10: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

10

BlackICE: An IDS

Page 11: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

11

Secure communication using cryptography

• Encrypt important information. • Certify the other party.

• Public Key Cryptography• PKI : Public Key Infrustructure

Page 12: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

12

Common key system   Cryptograhpy

Page 13: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

13

Give it a try! Cipher communication

AliceBob

Page 14: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

14

Any problems?

• It is easy to eavesdropping the key on thei internet.

Page 15: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

15

Public Key Cryptograhpy

Page 16: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

16

Give it a try! Public key cipher communication

AliceBob

Page 17: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

17

Any problems ?

• Swiching the public key. • Man-in-the-middle-attack.

AliceBob

Page 18: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

18

Digital signature

Page 19: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

19

電子証明書は印鑑証明

Page 20: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

20

Key with digital signature

AliceBob

Page 21: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

21

Real cipher communication

Page 22: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

22

Public key and digital signature

Page 23: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

23

Certificate authority

Page 24: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

24

e-Government

Page 25: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

25

Topics

• Stop Blaming the Victims• The author of Sasser• Adware,Spyware• Spoofing, Backdoor• Personal Firewall• Anti-virus• Spam• Intrusion Detection System• Cookies, Java, Active-x• Biometric

Page 26: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

26

Role Play

• Cast Ohta: Employee of Microsoft Yamada: Employee of Takada delivery compan

y Employees of Waseda Hospital

Yamaguchi: accounting section Yano: freshman in general affair

Page 27: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

27

Scene 1: call from waseda delivery

1. Yano: Hello, this is Yano, general affair section in Waseda Hospital.

2. Yamada: Hi, this is Takada delivery calling. It seems that one of our customer wrongly faxed her address to your company. Could you fax it to us?

3. (after checking the fax machine.)4. Yano: No, we haven’t received your fax.5. Yamada: You may found it other place… Maybe in y

our accounting section? If you find it, please fax it to us at 03-1111-1111.

6. Yano: OK.

Page 28: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

28

Scene 2:call from Microsoft

1. Ohta: Hello, this Ohta from Microsoft customer service. We found that your PC is sending too much viruses on the internet, and we received many complaints about it. Please download the anti-virus software that I will mention and install it on your PC.

2. Yano: Sure. Where can I find the software?

Page 29: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

29

Scene 3:call from other section

1. Tahara: This is Tahara from accounting. Could you do me a favor?

2. Yamaguchi: Yes. What?3. Thara: Our computers are all infected by viruses, but I n

eed the address of a patient, Ryoko Hirosue. Could you call up the data on your screen and fax it to me at accounting section?

4. Yamaguchi: No problem.

Page 30: 1 Security Hiroshi Toyoizumi toyo@u-aizu.ac.jp toyo@aoni.waseda.ac.jp

30

Quiz

• Did you find any security problem in the role-play?

• Write them down.• Describe the counter measures.