????? security and trusted ????? vs. ????? Vulnerability vs. Structure ??????????????????? Space in the structural environment

1
?????security and trusted????? vs.
?????Vulnerability vs. Structure????????????????
???Space in the structural environment

• ???(??) Jordan Pan
• http//blog.jordanpan.cn
• mailtojordan_at_venustech.com.cn

2
??Summary

• ?????Vulnerability-oriented security
• ?????Structural security
• ??????????
• Vulnerabilities in structures
• ?????Structural threats

3
?????Vulnerability-oriented security
4
???Vulnerabilities

• ??? simple password
• ?? virus
• ?????? OS flaw
• ???? protocol flaw
• ?????????????
• performance limitation
• ??????? bad configuration of firewalls

5
????????Vulnerability-oriented security

• ????? anti-virus system
• ?????? vulnerability scanner
• ?????? patch management system
• ?????? IDS
• ????????? anti-DoS
• ??? Firewall
• ??????? UTM

6
PSPC?????? Requirement Driven BaCaMeth
???? Req.BCM. ???? From Internal ???? From External
???? Active ??? Systematic ??? Policy
???? Passive ??? Problem ??? Compliance
7
??????????Vulnerability-oriented risk management
8
?????????????Risk management elements in Chinese
standard
9
????????3????3-element risk management model
10
2006 SC Awards

• Best anti-malware solution
• Best Anti-spyware
• Best Anti-trojan
• Best Anti-virus
• Best Anti-worm
• Best Content Security Solution
• Best Anti-spam
• Best Email Content Filtering
• Best Email Security
• Best IM security
• Best Intellectual Property Protection
• Best Network Security Solution
• Best Wireless Security
• Best Enterprise Firewall
• Best Intrusion Detection
• Best Intrusion Prevention
• Best Desktop Firewall
• Best Remote Access
• Best VPN - SSL

• Best Identity Management Solution
• Best Password Management
• Best Authentication
• Best Single Sign-on
• Best Two-Factor Solution
• Best Unified Threat Solution
• Best Integrated Security Software
• Best Integrated Security Appliance
• Best Managed Security Service
• Best Email Managed Service
• Best Network Security Management
• Best Event Management
• Best Computer Forensics
• Best Policy Management
• Best Security Audit
• Best Security Management Tool
• Best Vulnerability Assessment and Remediation
• Best Patch Management
• Best Vulnerability Assessment

Source from http//www.scmagazine.com/uk/awards/
previous/26104/year/2006/
11
??????????Vulnerability-oriented security
industrial environment
?? User
??? Threat agents
?? Provider
12
???????Misleading of Cask Rule

• ??
• ??????????????
• ?????????
• ??????????
• ??????
• Misleading
• Only consider prevention structure
• Not consider deep prevention
• Only consider static state
• Not consider cost-effective

13
?????Structural security

• ????basic structure
• ???? tight structure
• ????loose structure

14
?????RM??Reference monitor of access control

• ?????RM????????????
• Reference monitor of access control is a very
  basic security structure

15
RM??????????Structural conditions of valid RM
mechanism

• ????
• ?????
• ????
• ???,?????

• 3 conditions of VRM
• Can not be bypass
• Can not be tampered
• Be small enough, can be proved

16
??????Key Exchange Process
Alice
Public key
Private key
Randomly Generated Symmetric Key (seed PRNG)
Bob
Public key
Private key
17
?????????????Tight security structure
Trusted Computing

• http//www.trustedcomputinggroup.org

• ????? Definition of trust
• ????,???????????????????????
• Trust is the expectation that a device will
  behave in a particular manner for a specific
  purpose.
• ??????????????????????????????????
• A trusted platform should provide at least three
  basic features protected capabilities, integrity
  measurement and integrity reporting.
• (From section 4.1, TCG Architecture Overview 1.0)

18
TCG??????Fundamental rule of TCG

• ?????????,????????PC???,??????????
• Roots of trust
• In TCG systems roots of trust are components that
  must be trusted because misbehavior might not be
  detected.

• ??????????????????????
• Chains of trust
• Transitive trust also known as Inductive Trust,
  is a process where the Root of Trust gives a
  trustworthy description of a second group of
  functions.

19
????TPM?PCReference PC platform containing a TCG
TPM
20
TCG ??????TCG Trusted Platform Module (TPM)

• ???????????????
• There are commonly three Roots of Trust in a
  trusted platform
• ????? root of trust for measurement (RTM)
• ????? root of trust for storage (RTS)
• ????? root of trust for reporting (RTR)

21
?????????Attestation protocol and message
exchange
22
TPM ??????????TPM Root of Trust for Storage
(RTS)
23
TPM ??????TPM component architecture
24
TCG ????TCG software layering
25
?????????The trusted platform lifecycle
26
??????????User authentication using trusted
platforms
27
??????????User authentication using trusted
platforms
28
???????The classical four corners model
29
???????????Detailed TP deployment architecture
30
TCG???????????8 categories of Trusted platform
????Mobile
???PC Client
???Server
????Architecture
TPM
??? Software Stack
?????? Trusted Network Connect
??Storage
31
TCG?IWG?TNC?????the IWG and TNC architecture
32
TNC????TNC architecture
33
TNC?????????Message flow between components
34
??TPM?TNC????The TNC architecture with the TPM
35
??????????Ciscos self-defending network
36
??????????Ciscos self-defending network
37
??????????????Loose security structure
Framework

• ??????????????,??????????
• The connection among the components of loose
  structure is always integrated by human.
• ???????????Framework
• ????Technology framework
• ????Management system
• ISO27001, ISO20000, etc.

38
(No Transcript)
39
?????PDR???PDR can express technology framework
40
????????????????Detection make the loose
structure tight

• ?????????????
• Attackers have to face more
• ???? IDS
• ???? scanner
• ?????? Application auditing system
• ???? log system
• ?? honey pot
• ???? forensic system
• ???? monitoring platform
• ?? etc.

41
?????????????Structure of a ISMS (modified
ISO27001)
42
??????????Vulnerabilities in structures
43
??????????????????Whats your feeling about
structural security?

• ?? complex
• ?????? concern about the completion
• ?? cost
• ????? stupid guys are there

44
????????????!Do not be misled by structural
security

• ????????????!?????????????????,????????????????
  ??,???????????
• Do not be misled by structural security
• Vulnerability-oriented security also has
  structure
• Structural security also has vulnerabilities

45
??????????????Find vulnerabilities from
non-technology parts
Alice
Public key
Private key
Randomly Generated Symmetric Key (seed PRNG)
Bob
Public key
Private key
46
??????????????Find vulnerabilities from
non-technology parts
Alice
Public key
Private key
Public key
Randomly Generated Symmetric Key (seed PRNG)
Carl
Bob
Private key
Public key
Private key
???????,???????????????
47
??????????????Find vulnerabilities from
non-technology parts
Alice
Public key
Private key
Public key
Randomly Generated Symmetric Key (seed PRNG)
Carl
Bob
Private key
Public key
Private key
48
?????????Limitation of structural security

• ?????????????
• environment and boundary

49
?????????? Find vulnerabilities along the
lifecycle

• ??????????????
• back doors embedded during manufacturing
• ??????????
• No perfect system

50
???????????Find vulnerabilities through time
sequence

• ?????????
• Sample Document protection system
• ??????????????
• Vulnerabilities during creating documentation

51
?????????Limitation of structural security

• ?????????????
• environment and boundary
• ??????????????????
• different phases and organizations

52
????????Find vulnerabilities from human behavior

• ??????Social Engineering
• ????Privacy protection
• ????Anti-DRM
• ??Lazy

53
?????????Limitation of structural security

• ?????????????
• environment and boundary
• ??????????????????
• different phases and organizations
• ?????????
• Human transform science to art

54
??????????Find vulnerabilities from structure
itself
55
??????????Find vulnerabilities from structure
itself

• ??AR/PEP/PDP???,????????
• every role may be spoofed
• ?????????,????????????????,????????????
• Most beautiful structures have performance and
  availability problems and may be easy to be kick
  down by DoS.
• ?????????,???????
• Some traditional attacks are still effective

56
???????????We are still in the game

• ?????
• How to Play the game?
• ??????????
• Do you know the structure of all players?
• ????????????????
• Do you know how much have the other player
  known about your structure ?

57
?????Structural threats

• ????????
• Knowledge, Resources and Principles

58
??Knowledge

• ?????????????????
• Who know lower?
• ?????????????
• Who know the macro-structure better?
• ?????????????
• How many details do you know?

59
??Resources

• ???????????????,?????????????
• Botnet is a sample of structural software
  organization for attacking
• ????????,???????
• Time sequence spreading is a good thinking of
  structural attack

60
????????Key words of structure

• Business
• Distribution
• Hierarchy
• Time sequence
• Life-cycle
• Management
• Organization
• Regular
• Process Control
• Value

• ??
• ???
• ??
• ??
• ????
• ??
• ??
• ??
• ????
• ??

61
????????Process-oriented structure
Process owner
Process improving
operator
process
input
output
Infra- structure
Knowledge base
LOG Archive
Monitor
62
??Principles

• ???????? No 100 Security
• ?????????? 3 security relativity rule
• ???? survival rule
• ???? Risk rule
• ???? bodyguard rule

??????? Perfective requirement
63
?? Conclusion

• ?????Vulnerability-oriented security
• ?????Structural security
• ??????????
• Vulnerabilities in structures
• ?????Structural threats

64
???????????????Conclusion A good problem to
keep approaching
????? defend vs. attack
??????? Vulnerability-oriented vs. structural
65
??Thanks

• ?? Jordan Pan