Lab 25th August 2009

Through this lab, I can investigate the potential implementation of security mechanism in the database management system and operating system. In these exercises, I was able to define the security issues that are specific to database systems, the problem of protecting information in statistical database. In this lab, I was also examining the potential interactions between security mechanism in the database management system and underlying operating system.

Before I start lab 6.1, I installed the SQL software which get from the shared folder in computer and run it. After finished install, I was fail to create database. So, Mr. Zaki said we must reset the new password in command prmpt. Then, I start to create an accounts database with records which contain CustomerName, Account-Number, Balance, CreditRating. Next, user database with table Customer, Clerk, Manager also created. I was able to define an access structure so that

• Customers can read their own account: The access structure set to read only so customer can only read but could not change the data.

• Clerk can read all fields other than CreditRating and update Balance for all account: The access control is set to user which is read and write only so the clerk read all fields other than CreditRating and update Balance for all account.

• Manager can create new records, read all fields, and update CreaditRating for all accounts: Manager is set the access to administrator so Manager has full control mean that can read and write or modify for all accounts.

Lecture 24th August 2009

Database security is the system, processes, and procedures that protect a database from unintended activity. Databases are often store data which is sensitive in nature. Incorrect data or loss of data could negatively affect business operations. Besides that, databases can be used as bases to attack other systems. A good database security management system should possess the following features:

Ø Sharable among different users and applications.

Ø Valid or correct with respect to the real world entity that they represent.

Ø Protected from unauthorized access and be secure.

Ø Consistency of the data should be maintained.

Ø Should be non- redundant.

Ø Data should be independent of the applications.

There are four levels of enforcing database security which are physical security, operating system security, operating system security, DBMS security, and data encryption. However, the first three levels cannot provide a totally satisfactory solution to the database problems. These 3 levels database security hard to control disclosure of raw data, invalid to control disclosure of sensitive data, hard to control disclosure of confidential data in a distributed database system, and hard to verify that the origin of data item is authentic. To solve these problems is to using encryption methods to enforce database security.

6 basic security requirements are physical database integrity, logical database integrity, element integrity, access control, user authentication, and availability. To protect the database integrity, back up can be used. DBMS maintains element integrity in three ways which are field check, access control, and change log. We need audit record to help to maintain the integrity of database or discover who had affected what values and when. It enables users to build up access to protected data incrementally. For redundancy and internal consistency, there have error detection and correction code, shadow fields, recovery, concurrency/consistency, and monitors.

Sensitive data mean data that should not be made public. Factors that make data sensitive are inherently sensitive, from a sensitive source, declared sensitive, of a sensitive attribute or record, and sensitive in relation to previously disclosed information. The types of disclosure are exact data, bounds, negative result, existence, and probable value. The three basic paths to controlling the inference problem are suppress obviously sensitive information, track what the user knows and disguise the data.

Lab 18th August 2009 (Continue.....)

Lab 5 was continued after Mr. Zaki finished his Lab 4. In Lab 5, Mr Zaki has briefly explained about the web application security. What is web application? In software engineering, a web application or called webapp is an application that is accessed via web browser over a network such as the internet or an intranet. Web applications are popular due to the ubiquity of web browsers and the convenient of using a web browser as a client. The ability to update and maintain web applications without distributing and installing software on potentially thousands of client computers is a key reason for their popularity. An increase in the usage of web applications is directly related to an increase in the number of security incidents for them. The Open Web Application Security Project (OWASP) is an open community that focuses on improving the security of application software.

The top 10 web vulnerabilities based on OWASP top 10 2007 are listed which are cross site scripting, injection flaws, malicious file execution, insecure direct object reference, cross site request forgery, information leakage and improper error handling, broken authentication and session management, insecure crypto storage, insecure comms, and failure to restrict URL access. But in this Lab 5, we are only going to learn 3 vulnerabilities. We performed real attacks against web applications by using WebGoat and Web Scarab in this lab exercise.

Web application security is difficult to learn and practice. Not many people have full blown web applications like online book stores or online banks that can be used to scan for vulnerabilities. So, WebGoat is a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons. Another tool that required doing the exploiting simulation is the WebScarab. WebScarab is a framework for analysing applications that communicate using the HTTP and HTTPS protocols. It is written in Java, and is thus portable to many platforms. WebScarab has several modes of operation that implemented by a number of plugins. In its most common usage, WebScarab operates as an intercepting proxy, allowing the operator to review and modify requests created by the browser before they are sent to the server, and to review and modify responses returned from the server before they are received by the browser. WebScarab is able to intercept both HTTP and HTTPS communication. The operator can also review the conversations of requests and responses that have passed through WebScarab.

At the end of this Lab 5, I have learned how to exploit the web application vulnerabilities. Besides that, I can also list down the prevention method that can be taken to overcome web application vulnerabilities.

Lab 18th August 2009

Mr. Zaki was covered 2 labs on 18^th August which were Lab 4, Cryptography Extended and Lab 5, Web Application Security. In Lab 4 has describes about the Symmetric and Asymmetric cryptography. The basic principle in Symmetric Key Cryptography is the both the parties involved in the communication must agree on the encryption key in advance. This means that both parties use the same key. One of the simplest forms is sometimes known as the Caesar cipher which is used by Julius Caesar to conceal messages. The process is simply one of shifting the alphabet so many places in one direction or another. However, the cipher text encrypted using Caesar cipher method is easily broken by using a brute force attack. In order to improve the deciphering process, we can use the Vigeneré Cipher method. This is a method of encrypting the alphabet text by using a series of different Caesar ciphers based on the letters of a keyword. It is a simple form of polyalphabetic substitution. So, we are going to use simple substitution cipher text method to encrypt or decrypt in task 1 and encrypt and decrypt using Vigeneré Cipher method in the task 2.

The term Asymmetric Cryptography essentially means public key cryptography. The usual way public key cryptography works is that one person has the private key and keeps it safe not letting anyone else to know. Then everyone is told the public key which will enable them to unlock the private key and read the data. RSA algorithm is an asymmetric algorithm and plays a key role in public key cryptography. It is widely used in electronic commerce protocols. The algorithm was described in 1977 by Ron Rivest, Adi Shamir and Len Adleman who were all at MIT at the time. The letters of RSA are the initials of their surnames. In this part, Mr. Zaki has showed us how to calculate the RAS algorithm in order to generate a public key and a private key. I was confused because the calculation is quite complicated. Thus, we need to know the formula to calculate RSA algorithm when doing the task 3.

Lecture 17th August 2009

Lecture 4 was discussed about the operating system security. From the moment you boot your computer mean after BIOS loads, you are interacting with the operating system. For the modern computer system, operating system performs the central roles to support applications. There are some protection requirements of OS which are memory, shareable I/O devices such as disks, serially reusable I/O devices, such as printer and tape driver, sharable programs and sub- procedures and lastly is shareable data. The security method of OS is separation. Separation keeps one user’s object separate from other user. Physical separation is processes use different physical objects. Temporal separation is processes with different security requirements are executed at different times. For logical separation, processes only access objects inside its permitted domain. Next, cryptographic separation mean process data and computations are unintelligible to outsider. Separation may not provide sharing in system, if sharing is required, other methods should be considered such as no protection, isolation, share all or share nothing, share via access limitation, share by capabilities, limit use of an object and granularity of protection.

Method that use for memory protection is Fence. Fence is used to limit user program space. Relocation method is use relative addressing instead of absolute addressing. Base/ Bounds Register method use two registers to limit low and up boundary of a program and tagged architecture method to protect a part of user’s program. Another three methods are segmentation, paging and combined paging with segmentation.

Some protected objects also explained by Mr.Zaki in lecture 4 which are memory, a file or data set on an auxiliary storage device, an executing program in memory and instruments, directories, files, or data structure such as stack, hardware devices, a table of OS, password and the user authentication mechanism, and the protection mechanism itself. Moreover, the protection goals are to check every access. Previously authorized user may not access the object definitely. The second goal is allow least privilege. Least privilege states that a subject should have access to the smallest number of objects necessary to perform some task. Verify acceptable usage is also protection goals that ability to access is a yes-no decision.

All-None Protection is one of the file protection mechanisms. In this mechanism, any user can read, write and modify any files. It based on the trust between users. The password is used to protect from operations. But it has several disadvantages such as lack of trust, all or nothing, rise of timesharing, complexity and file listing. The second file protection mechanism is group protection. The world is divided into three classes: the user, a trusted working group and the rest of users. All authorized users are separated into groups, in which users have a common relationship. When creating a file, the user defines the rights for each class.

Authentication is a process used to verify transmitted data in a computing environment. Password is a character of strings that used to authenticate an identity or a user. Password selection criteria are use characters other than A until Z, choose long passwords, avoid actual names or words, choose a unlikely password, change the password regularly, do not write it down, and do not tell anyone else the password.

As a conclusion, operating system basic security is closely integrated to general OS design.