Week 13
LBSC 690
Information Technology
Policy
![](3D"slide0001_image001.jpg")
Agenda
&#=
8226;Questions
&#=
8226;Ownership
&#=
8226;Identity
&#=
8226;Privacy
&#=
8226;Integrity
Equitable Access
&#=
8226;Computing
facilities
&=
#8211;Hardware,
software
&#=
8226;Networks
&=
#8211;Speed,
continuity, access points
&#=
8226;Information
sources
&=
#8211;Per-use
fee vs. subscription vs. advertising
&=
#8211;Language
&#=
8226;Skills
&=
#8211;System,
access strategies, information use
Ownership
&#=
8226;Who
has the right to use a computer?
&#=
8226;Who
establishes this policy? How=
?
&=
#8211;What
equity considerations are raised?
&#=
8226;Can
someone else deny access?
&=
#8211;Denial
of service attacks
=
226;How
can denial of service be prevented?
&=
#8211;Who
can gain access and what can they do?
Justifications for Limiting Use
&#=
8226;Parental
control
&=
#8211;Web
browsing software, time limits
&#=
8226;Intellectual
property protection
&=
#8211;Copyright,
trade secrets, privilege
&#=
8226;National
security
&=
#8211;Classified
material
&#=
8226;Censorship
Techniques for Limiting Use
&#=
8226;Access
control
&=
#8211;Monolithic,
multilevel
&#=
8226;Copy
protection
&=
#8211;Hardware,
software
&#=
8226;Licensing
&#=
8211;Shrinkwrap,
shareware, GPL, creative commons
&#=
8226;Digital
watermarks
&=
#8211;Provide
a basis for prosecution
Fair Use Doctrine
&#=
8226;Balance
two desirable characteristics
&=
#8211;Financial
incentives to produce content
&=
#8211;Desirable
uses of existing information
&#=
8226;Safe
harbor agreement (1976 legislative history)
&=
#8211;Book
chapter, magazine article, picture, …
&#=
8226;Developed
in an era of physical documents
&#=
8211;Perfect
copies/instant delivery alter the balance
Recent Copyright Laws
&#=
8226;Copyright
Term Extension Act (CTEA)
&=
#8211;Ruled
constitutional (Jan 2003, Supreme Court)
&#=
8226;Digital
Millennium Copyright Act (DMCA)
&=
#8211;Prohibits
circumvention of technical measures
&=
#8211;Implements
WIPO treaty database protection
The Pornography Debate
------=_NextPart_01C9535A.A8DFEFA0
Content-Location: file:///C:/A678E653/690f0813_files/slide0033.htm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"
&#=
8226;Communications
Decency Act (CDA)
&=
#8211;Ruled
unconstitutional (1997, Supreme Court)
&#=
8226;Child
Online Protection Act (COPA)
&=
#8211;Enforcement
blocked (March 2007, 3rd Circuit)
&#=
8226;Children’s
Internet Protection Act (CIPA)
&=
#8211;Ruled
constitutional (June 2003, Supreme Court)
&=
#8211;Applies
only to E-Rate and LSTA funds
Filtering Technology
&#=
8226;Any
individual approach is imperfect
&#=
8226;Term-based
techniques
&=
#8211;Recall/precision
tradeoff
&=
#8211;Not
as useful for audio (e.g., podcasts)
&#=
8226;Image-based
techniques
&#=
8226;Whitelists
and blacklists
&=
#8211;Expensive
to create manually
&=
#8211;Differing
opinions, time lag
Denial of Service Attacks<=
/div>
------=_NextPart_01C9535A.A8DFEFA0
Content-Location: file:///C:/A678E653/690f0813_files/slide0070.htm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"
&#=
8226;Viruses
&=
#8211;Platform
dependent
&=
#8211;Typically
binary
&#=
8226;Flooding
&=
#8211;Worms
&=
#8211;Zombies
&=
#8211;Chain
letters
Viruses
&#=
8226;Computer
programs able to attach to files
&#=
8226;Replicates
repeatedly
=
211;Typically
without user knowledge or permission
=
&#=
8226;Sometimes
performs malicious acts
![](3D"slide0070_image003.gif")
Viruses
&#=
8226;1988: Less than 10 known viruses
&#=
8226;1990: New virus found every day
&#=
8226;1993: 10-30 new viruses per week
&#=
8226;1999: 45,000 viruses and variants
![](3D"slide0071_image004.gif")
Worms
=
226;Self-reproducing
program that sends itself across a network
&=
#8211;Virus
is dependent upon the transfer of files
&=
#8211;Worm
spreads itself
=
226;SQL
slammer worm (January 25, 2003) claimed 75,000 victims within 10
minutes
![](3D"slide0056_image006.jpg")
Identity
&#=
8226;Establishing
identity permits access control
&#=
8226;What
is identity in cyberspace?
&=
#8211;Attribution
&#=
8226;When
is it desirable?
&=
#8211;Impersonation
&#=
8226;How
can it be prevented?
&#=
8226;Forgery
is remarkably easy
&=
#8211;Just
set up your mailer with bogus name and email
Authentication
&#=
8226;Used
to establish identity
&#=
8226;Two
types
&=
#8211;Physical
(Keys, badges, cardkeys, thumbprints)
&=
#8211;Electronic
(Passwords, digital signatures)
&#=
8226;Protected
with social structures
&=
#8211;Report
lost keys
&=
#8211;Don’t
tell anyone your password
&#=
8226;Use
SSH to defeat password sniffers
Good Passwords
&#=
8226;Long
enough not to be guessed
&=
#8211;Programs
can try every combination of 5 letters
&#=
8226;Not
in the dictionary
&=
#8211;Programs
can try every word in a dictionary
&=
#8211;every
proper name, pair of words, date, every …
&#=
8226;Mix
upper case, lower case, numbers
&#=
8226;Change
it often
&#=
8226;Reuse
creates risks
&=
#8211;Abuse,
multiple compromise
Authentication Attacks
• Guessing
• Brute
force
• Impersonation
• “Phishing”
• Theft
------=_NextPart_01C9535A.A8DFEFA0
Content-Location: file:///C:/A678E653/690f0813_files/slide0018.htm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"
Access Control Issues
&#=
8226;Protect
system administrator access
&#=
8211;Greater
potential for damaging acts
&=
#8211;What
about nefarious system administrators?
&#=
8226;Firewalls
&=
#8211;Prevent
unfamiliar packets from passing through
&=
#8211;Makes
it harder for hackers to hurt your system
We Already Knew a Lot About You
&#=
8226;Governments
have information about life events
&=
#8211;Birth
and death
&=
#8211;Marriage
and divorce
&=
#8211;Licenses
(e.g., drivers)
&=
#8211;Property
and taxes
&#=
8226;Business
exchange information about transactions
&=
#8211;How
you commute to work
&=
#8211;What
cereal you eat
&=
#8211;Where
you like to go for vacation
&=
#8211;What
hobbies you have
![](3D"slide0063_image008.jpg")
![](3D"slide0063_image010.jpg")
![](3D"slide0063_image011.gif")
We Can See Even More Online
&#=
8226;Web
tracking
&=
#8211;Browser
data, clickthrough, cookies, …
&#=
8226;Packet
sniffers
&=
#8211;Detect
passwords, reconstruct packets, …
&#=
8226;Law
enforcement
&=
#8211;Carnivore
(US), RIP (UK), …
&#=
8226;National
security
&=
#8211;Echelon
(US), SORM (Russia), …
Tracking Internet Activity=
ISP
logs
IP
address
Firewalls
Cookies
Browser
history
Spyware
Packet
sniffing
Intercepting
e-mails
Monitoring
news groups
Monitoring
chat rooms
Spoofed
web sites
Wiretaps
Privacy vs. Anonymity
![](3D"slide0060_image013.jpg")
![](3D"slide0060_image015.jpg")
![](3D"slide0060_image017.jpg")
![](3D"slide0060_image019.jpg")
Anonymity
&#=
8226;Serves
several purposes
&=
#8211;Sensitive
issues on discussion groups
&=
#8211;Brainstorming
&=
#8211;Whistleblowers
&=
#8211;Marketing
(“Spam”)
&#=
8226;Common
techniques
&=
#8211;Anonymous
remailers
&=
#8211;Pseudonyms
Practical Obscurity
R=
26;A
lot of government-collected information is
public record
&#=
8226;Previously
shielded by “practical
obscurity&#=
8221;
&=
#8211;Records
were hard to access
&#=
8226;Not
so with the Internet
Ideals in Tension
&#=
8226;Establishing
identity permits access control
&#=
8226;Yet
people don’t want to be tracked
&#=
8226;How
do you provide accountability?
–People’s
behavior change when no one is watching
Whenever a conflict arises between privacy and accountability, peo=
ple =
demand the former for themselves and the latter=
for
everybody else.
Privacy
&#=
8226;What
privacy rights do computer users have?
&=
#8211;On
email?
&=
#8211;When
using computers at work? At
school?
&=
#8211;What
about your home computer?
&#=
8226;What
about data about you?
&=
#8211;In
government computers?
&=
#8211;Collected
by companies and organizations?
&#=
8226;Does
obscurity offer any privacy?
Privacy Protection
&#=
8226;Privacy
Act of 1974
&=
#8211;Applies
only to government records
&#=
8226;TrustE
certification guidelines
&=
#8211;Site-specific
privacy policies
&=
#8211;Federal
Trade Commission enforcement
&#=
8226;Organizational
monitoring
Symmetric Key Encryption
![](3D"slide0042_image021.gif")
![](3D"slide0042_image023.gif")
![](3D"slide0042_image024.gif")
![](3D"slide0042_image025.gif")
![](3D"slide0042_image026.gif")
![](3D"slide0042_image027.gif")
![](3D"slide0042_image028.gif")
Alice
Bob
Plain text
Encrypt
Cipher text
Decrypt
Plain text
Insecure channel
eavesdropper
eavesdropper
eavesdropper
<=
b>key
<=
b>key
<=
b>Same
key used both for encryption and decryption
Asymmetric Key Encryption<=
/div>
![](3D"slide0044_image029.gif")
![](3D"slide0044_image030.gif")
![](3D"slide0044_image031.gif")
![](3D"slide0044_image032.gif")
![](3D"slide0044_image033.gif")
![](3D"slide0044_image034.gif")
![](3D"slide0044_image035.gif")
Alice
Bob
Plain text
Encrypt
Cipher text
Decrypt
Plain text
Insecure channel
eavesdropper
eavesdropper
eavesdropper
<=
b>Bob’s
public key
<=
b>Bob’s
private key
<=
b>Different
keys used for encryption and decryption
Asymmetric Key Encryption<=
/div>
------=_NextPart_01C9535A.A8DFEFA0
Content-Location: file:///C:/A678E653/690f0813_files/slide0055.htm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"
&#=
8226;Key
=3D a large number (> 1024 bits)
&#=
8211;Public
key: known by all authorized decoders
&=
#8211;Private
key: known only by encoder
&#=
8226;One-way
mathematical functions
&=
#8211;“Trapdoor
functions&#=
8221;
&=
#8226;Like
mixing paint (easy to do, hard to undo)
&=
#8211;Large
numbers are easy to multiply, hard to factor
&#=
8226;Importance
of longer keys
&=
#8211;Keys
< 256 bits can be cracked in a few hours
&=
#8211;Keys
> 1024 bits presently effectively unbreakable
The Dark Side of Encryption
&#=
8226;Encryption
is a double-edged sword
–The
ability to keep secrets facilitates secure commercial
transactions
&=
#8211;But
bad guys can use encryption to keep secrets…
&#=
8226;Can
be cracked by “authorized parties”?
&=
#8211;How
should that ability controlled?
encryption
RSA “Public Key”
Encryption
<=
span
style=3D'position:absolute;top:38.75%;left:6.92%;width:52.24%;height:5.25%=
'>print pack"C*", split/\D+/,
`echo "16iII*o\U@{$/=3D$z; [(pop,pop,unpack"H*",<>)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0 <X+d*lMLa^*lN%0]dsXx++lMlN /dsM0<J]dsJxp"|dc`
`echo "16iII*o\U@{$/=3D$z; [(pop,pop,unpack"H*",<>)]}
![](3D"slide0047_image036.gif")
Until 1997 – Illegal to show this slide to non-US citizens!
![](3D"slide0047_image038.jpg")
Trojan Horse
&#=
8226;Malicious
program with undesired capabilities
&=
#8211;Log
key strokes and sends them somewhere
&=
#8211;Create
a “back door” administrator logon
=
226;Spyware:
reports information about your activity without your knowledge&#=
13;
&#=
8226;Doesn’t
(necessarily) replicate
![](3D"slide0072_image040.gif")
Privacy in a Post 9/11 World
The Professional Association of Diving Instructors (PADI), which certifies about =
65 percent of the nation's divers, gave the FBI a computer file containing the names <=
/span>of more than 2 million certified divers in May 2002.
Airlines have handed large amounts of passenger data over to the government (most voluntarily).
Surveillance Law
&#=
8226;USA
PATRIOT Act
&=
#8211;Access
to business records
&=
#8211;Internet
traffic analysis (with a court order)
&#=
8226;Foreign
Intelligence Surveillance Act (FISA)
&=
#8211;Secret
court for monitoring foreign communications
&#=
8211;Special
protections for citizens/permanent residents
Real-Time Local Surveillance
&#=
8226;Built-in
features of standard software
&=
#8211;Browser
history, outgoing email folders, etc.
&#=
8226;“Parental control&=
#8221;
logging software
&#=
8211;ChatNANNY,
Cyber Snoop, FamilyCAM, …
&#=
8226;Personal
firewall software
&=
#8211;ZoneAlarm,
BlackIce, &=
#8230;
Real-Time Centralized Surveillanc=
e
&#=
8226;Proxy
server
&=
#8211;Set
up a Web server and enable proxy function
&=
#8211;Configure
all browsers to use the proxy server
&=
#8211;Store
and analyze Web server log files
&#=
8226;Firewall
&=
#8211;Can
monitor all applications, not just the Web
Forensic Examination
&#=
8226;Scan
for files in obscure locations
&#=
8211;Find-by-content
for text, ACDSee for pictures, …
&#=
8226;Examine
“deleted” disk files
&=
#8211;Norton
DiskDoctor, …
&#=
8226;Decode
encrypted files
&=
#8211;Possible
for many older schemes
Integrity
&#=
8226;How
do you know what’s there is correct?
&=
#8211;Attribution
is invalid if the contents can change
&#=
8226;Access
control would be one solution
&#=
8226;Encryption
offers an alternative
Digital Signatures
=
226;Alice
“signs” (encrypts) with her private key
&=
#8211;Bob
checks (decrypts) with her public key
&#=
8226;Bob
knows it was from Alice
&=
#8211;Since
only Alice knows Alice’s private key
=
226;Non-repudiation:
Alice can’t deny signing message
&=
#8211;Except
by claiming her private key was stolen!
&#=
8226;Integrity:
Bob can’t change message
&=
#8211;Doesn’t
know Alice’s Private Key
Key Management
&#=
8226;Pubic
announcement of public key
&=
#8211;e.g.,
append public key to the end of each email
&#=
8211;But
I can forge the announcement
&#=
8226;Establish
a trusted &=
#8220;certificate
authority&#=
8221;
&=
#8211;Leverage
“web of trust” to authenticate authority
&#=
8211;Register
public key with certificate authority
Certificate Authority
![](3D"slide0051_image041.gif")
![](3D"slide0051_image042.gif")
Alice
Bob
Plain text
![](3D"slide0051_image043.gif")
Encrypt
Cipher text
![](3D"slide0051_image044.gif")
Decrypt
Plain text
Insecure channel
eavesdropper
![](3D"slide0051_image045.gif")
eavesdropper
eavesdropper
![](3D"slide0051_image046.gif")
![](3D"slide0051_image047.gif")
Bob’s public key
Bob’s private key
![](3D"slide0051_image049.gif")
![](3D"slide0051_image050.gif")
Bob’s public key
Cer=
tificate
Authority
Certificates: Example
![](3D"slide0052_image051.gif")
![](3D"slide0052_image052.gif")
Acceptable Use Policies
------=_NextPart_01C9535A.A8DFEFA0
Content-Location: file:///C:/A678E653/690f0813_files/slide0075.htm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"
&#=
8226;Establish
policies
&#=
8226;Authenticate
&#=
8226;Authorize
&#=
8226;Audit
&#=
8226;Supervise
Practical Tips
&#=
8226;Keep
anti-virus software current
&#=
8226;Keep
software “patches” current
&#=
8226;Change
default settings
&#=
8226;Be
wary of anything free
Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level
' + ENDSHOW_MESG + '
![](3D"notes_flag.gif")
No=
tes![](3D"buttons.gif")
![](3D"slide0056_image005.jpg"){kind=link}
![](3D"slide0063_image007.jpg"){kind=link}
![](3D"slide0063_image009.jpg"){kind=link}
![](3D"slide0060_image012.jpg"){kind=link}
![](3D"slide0060_image014.jpg"){kind=link}
![](3D"slide0060_image016.jpg"){kind=link}
![](3D"slide0060_image018.jpg"){kind=link}
![](3D"slide0047_image037.jpg"){kind=link}