Information Security Basics Part 3: Cryptography

image source: http://www.motherjones.com/files/cryptokids-nsa425x320.jpg

In a nutshell, this cartoon depict what cryptography is - hidden writing.

Cryptography has 2 distinct operations:

• Encryption
• Decryption

When we hide a message, we need a way to return it to it original form.  A cipher is an algorithm to perform the encryption and decryption.

Cryptography History
Wikipedia has a very comprehensive wiki on the history of cryptography. Way back to the ancient Egyptian Kingdom in 1900 B.C. cryptography is a very simple is being used.  Julius Caesar in 100 B.C has the Caesar Cipher to encrypt secret message to his generals. His cipher is a simple substitution method of shifting the character by 3.

As time progress, more and more complicated cipher is used.  In the 16 century, Vigenere introduced a primitive form of encryption keys.  At the beginning of the 19 century, machines was used as a cipher in the field of Cryptography.

Of course the most famous cryptography machine is the Engima machine used by the German. The movie U-571 is still one of my favorite war movies.

image source: http://www.niwarmemorial.org/wp-content/uploads/2014/02/EnigmaMachineTopCoverRemovedRNM.jpg

As a side note not the U.S. Army is very smart in using the Navajo Indian to use their native language to communicate with each other at the Pacific theater.  In essence,  the Navajo Indian is the cipher machine.  U.S. Marine is assigned to protect this asset and sadly, if necessary the marine has to "destroy" this unique cipher machine and not to let it fall into the hand of the enemy - the Japanese.

Modern Cryptography is based on complex mathematical algorithms.

Cryptography Goal
What we have discussed so far is that Cryptography is the way to encrypt and decrypt messages.  In fact there are all together 4 goals in Cryptography:

• Confidentiality
• Authentication
• Integrity of Data
• Non-repudiation

I think for confidentiality, authentication and data integrity, it is self explanatory.  As for non-repudiation, it means the sender cannot deny sending the message.  For example, my 4 year old son is playing with my laptop and he managed to send you an Email saying I will pay you $1,000 and signed the Email with my private key.  In the eye of the court, I am obligated to pay you the $1,000 because the Email is signed by my private key which no one should have.

Cryptography Types
There are 3 general types of Cryptographic algorithms:

• Secret Key
• Public Key
• Hashing

Secret Key
It is also called Symmetric key cryptography because the message is encrypted and decrypted with the same key. The advantage is speed for encrypting and decrypting.  It is vulnerable for brute force attack for the key to be cracked by hackers.  Key creation and distribution to the various party is also vulnerable for the key being compromised.

The longer the key the more difficult or needs longer time to crack by hackers.  Commonly used symmetric encryption algorithms are AES (Advanced Encryption Standard), DES (Data Encryption Standare) or Triple DES.  Sometimes in the movies or TV show we can see that 1024-bit or 2048-bit encryption is used and how the hacker is able to gain access to a certain computer system or network.

Note: Double DES is not used because it is found that doing the encryption only twice does not increase the efficiency of the key size.

Public Key
It is also called Asymmetric Key cryptography because there are 2 keys one for encrypting the message and the other is used to decrypting the message.  One key is called the private key which should be kept in secret and the other is public.  When I send a message to you, I encrypted it with my private key and you will use my public key to decrypt it.  When you reply, you will use my public key to encrypt the message and then I will use my private key to decrypt it.  The draw back for this method is that it is slow due to the complex mathematics algorithm.

As mentioned in the previous section on non-repudiation, when a message is encrypted by a private key, one cannot dispute that the message is NOT send by that person holding the private key.

Example of an asymmetric-key system is the Diffie-Hellman Key Exchange.

One of the application of this method is to use the Asymmetric key to exchange a symmetric key between 2 parties and after that all the communication between these 2 parties will be encrypted with a symmetric key which is much faster.

Hashing
Hashing is different then the symmetric and asymmetric key cryptography.  It is a one-way encryption.  Plain text go through a hashing function and become a cipher text.  This cipher text, however, cannot be convert back to it original form.

If it is not possible to convert the cipher text back to the original plain text, what is the use of this method.  This method is good for data integrity.  On top of keeping the message confidential, the use of hashing function can show that the message has not been altered either intentionally by another party or unintentionally due to hardware or communication error.

Example of hashing functions are MD5, SHA256/SHA-384/SHA-512

Cryptography Use Cases
The most commonly used case for cryptography is the Secure Socket Layer (SSL).  Everyone uses the web and some website choose to use https instead of http for the communication between the web browser and the web server and https is to have http run on top of SSL.

In OpenStack, as I have blogged about the messaging and queuing system as part of my OpenStack series, SSL is being used to secure RabbitMQ or Qpid.

In an Microsoft infrastructure, Kerberos is used to allow user to log on to the infrastructure and gain access the various compute resources in the infrastructure without having to perform authentication and authorization repeatedly.

Related Post:
Information Security Basics Part 1: Security Models
Information Security Basics Part 2: Defense in Depth
Information Security Basics Part 4: Public Key Infrastructure (PKI)

Information Security Basics Part 1: Security Models

image source: http://prmgsecurity.com/wp-content/uploads/2012/12/shutterstock_103173656.jpg

Security means different thing to different people.

To a home user, security is antivirus protection.  The objective is to keep the electronic device free of Malware of Rootkit so that the device can operate “normally”.  It can also mean safe web site access to bank and/or other financial institutes such that their financial account will not be compromised.  Or in some case, celebrities may want to protect their private pictures or videos.  Failure to protect the user device or user’s financial account can lead to monetary loss.  Identity thief is also a major concern for home computer users.

To the government, security, I think will be the protection of sensitive data and the continuous operation of the various departments and agencies. Around November 16, 2014, the U.S. State Department website was compromised.  And it is the 4^th U.S. government agency to announce a breach of their computer systems within a few weeks’ time.  Failure to protect the government’s computer systems can lead to lost of human lives.

To the private sector, security is the protection of data which can be intellectual properties or customer’s financial and private information such as health history, social security number.  Often times company has the office of Chief Security Officer responsible for the “security” and compliance of security rules of the company such as HIPAA for the health sector or Gramm-Leach-Bliley Act for the financial sector. 

Regardless what security means for us, we can always look at security with the following model.

The CIA Triad
This is the most common security model for information systems. This model is used to develop security policy, identify area of security risk and most of all to deploy measurements to mitigate the identified risk.

CIA stands for:

• Confidentiality
• Integrity 
• Availability

image source: http://securitytoolkit.files.wordpress.com/2012/04/cia3.jpg

I like this diagram because besides showing the 3 elements of the CIA triad, it is showing data in the middle.  Most of the the time security are applied to protect data.  Social Security number is a form of data, bank account is a form of data, and intellectual properties is another form of data.  Conceptually, these 3 elements are applied toward data.  In other word, we should show as:

• Confidentiality of the data
• Integrity of the data
• Availability of the data

Confidentiality
Confidentiality means data can only be accessed by the authorized entity.  The owner of the data decided who can gain access to the data.  Access means to read, to modify or to delete the data.  The most basic form of providing confidentiality will be password protection.  To gain access to a personal computer or device we need to provide the user name and password.  Password can be as simple as a 8 character text string or it can be a X.509 certificate.  Also, there can be multiple level/factor of authentication where besides a password user will have to provide an authorized token.  For multi-level authentication user will have to provide:

• Something you know - password
• Something you have - RSA Token
• Something you are - biometric

Another way to provide confidentiality is encryption.  To be satisfy regulatory requirement some companies will require the company issued personal device to turn on encryption so in case the device is lost, there is one level of safe guarding the data that is in the personal device. For BYOD, come companies can provide the ability to wipe out the data on a device remotely.

Integrity
Integrity means data cannot be modified by unauthorized entity as well as the reliability of the electronic device that is storing the data.  With a flip of a bit in the storage device can make a bank account to reflect the wrong amount of money that is available.  As with object storage Swift, data are by default store in 3 different devices and there is a audit task to make sure the data are in tack.  Data replication technique such as RAID (either software or hardware) is another way to provide a means to ensure the integrity of the data.

One basic form of data integrity check for the integrity of the data is to use of a hashing function.  In networking, an Ethernet frame has a CRC value at the end so that when the frame is received, it can be checked with to see if the frame is altered during transit.  System Administrator are familiar with the MD5 hashing value of an ISO image. 

Password protection and encryption also help to prevent the data to be modified by unauthorized entity.

Availability
Availability means data can be accessed when needed.  Have you ever hit the wrong button on your computer and deleted all the Emails in your inbox?  Or have you accidentally delete the files in a directory?  In these cases backup comes to the rescue.  It is important to test the recovery of the backup data. Very often data is backup but when we have to make sure the backup tape is not empty or being over written by later backups. If you are a System Administrator you must know this famous line "Test your backup regularly!"

Most companies have a disaster recovery plan such that if data is lost due to fire, earth quake or terrorist attack data can be restored according to the expected Recovery Time Objective (RTO) and Recovery Point Objective (RPO).  It is very important to test out the recovery plan just like testing the recovery of the backup data.

Data delete by unauthorized entity is of course the basic form of attack in the area of availability.  Another form will be denial-of-service (DOS) attack.  We can easily imagine what will happen to a company if consumers are not able to access a online shopping website before Christmas because some attacker launched a DOS attack on that website.

Which one is more important?
While all 3 elements of the CIA triad are important, different organization will have different element as the most critical area.  For example, in health care industry confidentiality will be the most important element.  In bank or financial institutions, integrity will be the most important element.  Lastly as stated for online shopping/e-commerce based organization, availability will be the most important element.

Related Post:
Information Security Basics Part 2: Defense in Depth
Information Security Basics Part 3: Cryptography 
Information Security Basics Part 4: Public Key Infrastructure (PKI)