B030710154

Cyberlaw

Cyber law is rules in cyber world or internet. Cyber law created to prevent internet or cyber world from computer crime. Reason why computer crime hard to define are because creating and changing laws are slow processes, which is very much out of pace with a technology that is progressing as fast as computing. Then a computer can perform many roles in a crime, particular computer can be the subject, object or a medium of a crime. Which is means computer can act as an attacker, or as a victim, or as a medium use to attack the victim which means use to hack, phishing and so on. Based on this problem cyber law exists.

Cyber Law in Malaysia

DIGITAL SIGNATURE ACT 1997 it provides for the regulation of the public key infrastructure. The Act makes a digital signature as legally valid and enforceable as a traditional signature.

COPY RIGHT ACT 1997 Copyright serves to protect the expression of thoughts and ideas from unauthorized copying and/or alteration. With convergence of Information and Communication Technology (ICT), creative expression is now being captured and communicated in new forms (example: multimedia products, broadcast of movies over the Internet and cable TV). These new forms need protection. Copy right act rules the new and converged multimedia environment.

TELEMEDICINE ACT 1997 Healthcare systems and providers around the world are becoming interconnected. People and local healthcare providers can thus source quality healthcare advice and consultation from specialists from around the world, independent of geographical location. This act provide any registered doctor may practice telemedicine but healthcare providers must obtains the license to do so.

COMPUTERS CRIME ACT 1997 As computing becomes more central to people’s life and work, computers become both targets and tools of crime. This Act offense everything that would harm the computer system.

COMMUNICATION AND MULTIMEDIA ACT 1998 Convergence of technologies is driving convergence of telecommunications, broadcasting, computing and content. This Act creates a new system of licenses and defines the roles and responsibilities of those providing communication and multimedia services and provides for the existence of the Communication and Multimedia Commission, the new regulatory authority

Legal and Ethical Issues in Computer Security

Law is a rule of conduct or action prescribed or formally recognized as binding or enforced by a controlling authority. Ethics is a set of moral principles or values or the principles of conduct governing an individual or a group.

Differences between law and ethic:

LAW

· Formal, documented

· Interpreted by courts

· Established by legislature representing everyone

· Applicable to everyone

· Priority determined by courts if two laws conflict

· Enforceable by police and courts

ETHIC

· Described by unwritten principles

· Interpreted by individuals

· Presented by philosophers, religions, professional group

· Personal choice

· Priority determined by individual if two principles conflict

The key difference between laws and ethics is that laws carry the sanction of a governing authority and ethics do not. Organizations formalize desired behaviors in documents called policies. Policies must be read and agreed to before they are binding. Civil law represents a wide variety of laws that are used to govern a nation or state. Criminal law addresses violations that harm society and are enforced by agents of the state or nation. Tort law is conducted by means of individual lawsuits rather than criminal prosecution by the state.

Three general categories of unethical and illegal behavior:

o Ignorance

§ ignorance of the law is no excuse, however ignorance of policy and procedures is

o Accident

§ Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage by accident

o Intent

§ Intent is often the cornerstone of legal defense, when it becomes necessary to determine whether or not the offender acted out of ignorance, by accident, or with specific intent to cause harm or damage

Ethic Concepts

Deterrence is the best method for preventing an illegal or unethical activity. Deterrence can prevent an illegal or unethical activity from occurring. Deterrence requires significant penalties, a high probability of apprehension, and an expectation of enforcement of penalties.

Wireless Security

Wireless LAN is a connection to network without using a cable. Connection in wireless LAN usually at 1Mbps and 2 Mbps. Wireless LAN use radio frequency to transmit the data, and it can go through the building. Signals of wireless LAN weakened by wall, floor and interference. Wireless LAN 802.11 focus on physical layer and data link layer.

802.11 Physical layer

• Originally three alternative physical layers

o Two incompatible spread-spectrum radio in 2.4Ghz ISM band

§ Frequency Hopping Spread Spectrum (FHSS)

· 75 channels

§ Direct Sequence Spread Spectrum (DSSS)

· 14 channels (11 channels in US)

• One diffuse infrared layer
• 802.11 speed

o 1 Mbps or 2 Mbps

802.11 Data link layer

• — Layer 2 split into:

o Logical Link Control (LLC).

o Media Access Control (MAC).

• — LLC - same 48-bit addresses as 802.3.
• — 802.11 always slower than equivalent 802.
• — MAC - CSMA/CD not possible.

o Can’t listen for collision while transmitting.

• — CSMA/CA – Collision Avoidance.

o Sender waits for clear air, waits random time, then sends data.

o Receiver sends explicit ACK when data arrives intact.

o Also handles interference.

o But adds overhead.

Wireless 802.11 has two modes, instructure and ad-hoc mode. Instructure mode can have one access point or basic service set(BSS) and also can have two or more BSS perform as single subnet, most corporate LAN use in this mode. Ad-hoc or peer to peer is useful for easy and quick wireless network.

802.11 can be divided into:

1. 802.11a

• — 802.11a ratified in 2001
• — Supports up to 54Mbps in 5 Ghz range.

o Higher frequency limits the range

o Regulated frequency reduces interference from other devices

• — 12 non-overlapping channels
• — Usable range of 30 metres
• — Average throughput of 30 Mbps
• — Not backwards compatible

2. 802.11g

• — 802.11g ratified in 2002
• — Supports up to 54Mbps in 2.4Ghz range.

o Backwards compatible with 802.11b

• — 3 non-overlapping channels
• — Range similar to 802.11b
• — Average throughput of 30 Mbps
• — 802.11n due for November 2006

o Aiming for maximum 200Mbps with average 100Mbps

Three basic security services defined by IEEE for the WLAN environment

o Authentication

§ provide a security service to verify the identity of communicating client stations

o Integrity

§ to ensure that messages are not modified in transit between the wireless clients and the access point in an active attack

o Confidentiality

§ to provide “privacy achieved by a wired network”

Security in Application

Email is an electronic application, it’s a message made of string ASCII characters. Email has two part, header and body. Header part used to state the sender and email recipient. Body part is content of the message or email.

Security in email:

· Confidentiality

· Data origin authentication

· Message integrity

· Non-repudiation of origin

· Key management

MIME. Short for Multipurpose Internet Mail Extensions, a specification for formatting non-ASCII messages so that they can be sent over the Internet. Many e-mail clients now support MIME, which enables them to send and receive graphics, audio, and video files via the Internet mail system. In addition, MIME supports messages in character sets other than ASCII.

Email Security Threads.

• Two main group:

o Threats to the security of e-mail itself

o Threats to an organisation that are enabled by the use of e-mail.

• Loss of confidentiality.

o E-mails are sent in clear over open networks.

o E-mails stored on potentially insecure clients and mail servers.

o Ensuring confidentiality may be important for e-mails sent within an organisation.

• Loss of integrity.

o No integrity protection on e-mails; body can be altered in transit or on mail server.

• Lack of data origin authentication.

o Is this e-mail really from the person named in the From: field?

o How many Kenny.Paterson’s are there?

o Recall SMTP directly over telnet allows forgery of all e-mail fields!

o E-mail could also be altered in transit.

o Even if the From: field looks fine, who was logged in as Kenny.Paterson when the e-mail was composed?

o Sharing of e-mail passwords common.

• Lack of non-repudiation.

o Can I rely and act on the content? (integrity)

o If so, can the sender later deny having sent it? Who is liable if I have acted?

o Example of stock-trading via e-mail.

• Lack of notification of receipt.

o Has the intended recipient received my e-mail and acted on it?

o A message locally marked as ‘sent’ may not have been delivered.

SSH or Secure Shell is initially designed to replace insecure rsh, telnet utilities, seecure remote administration (mostly of Unix systems), and Extended to support secure file transfer and e-mail. SSH provides security at Application layer, only covers traffic explicitly protected. Applications need modification, but port-forwarding eases some of this.

Application in SSH:

• Anonymous ftp for software updates, patches...

o No client authentication needed, but clients want to be sure of origin and integrity of software.

• Secure ftp.

o E.g.upload of webpages to webserver using sftp.

o Server now needs to authenticate clients.

o Username and password may be sufficient, transmitted over secure SSH transport layer protocol.

• Secure remote administration.

o SysAdmin (client) sets up terminal on remote machine.

o SysAdmin password protected by SSH transport layer protocol.

o SysAdmin commands protected by SSH connection protocol.

• Guerilla Virtual Private Network.

o E.g. use SSH + port forwarding to secure e-mail communications.

Security in Network

A computing network is a computing environment with more than one independent processor and maybe multiple users per system and the distance between computers is not considered. Computers and user terminals which are connected to the network are known as network node. I n network user can send and receive message, executing program and obtaining status.

Basic terminology in network

É Node is single computing system in a network.

É Host is a single computing system's processor.

É Link is a connection between two hosts.

É Topology is the pattern of links in a network

Network topologies

1. Bus Topology

To provide a single communication network on which any node can place information and from which any code can retrieve information. One attachment in bus terminology not impacts the other nodes.

2. Star topology

Has switch as a central. The central switch receives all messages, identifies the addresses, selects the link appropriate for that addresses and forwards the messages.

3. Ring Topology

To connect a sequence of nodes in a loop or ring. Can be implemented with minimum cabling.

4. Mesh Topology

Each node can conceptually be connected directly to each other node and routing logic can be used to select the most efficient route through multiple nodes.

Advantages in network computing

· Resource sharing is used to reduce maintenance and storage costs.

· Increased reliability means if one system fails users can shift to another.

· Distributing the workload means workload can be shifted from a heavily loaded system to an underutilized one.

· Expandability is system is easily expanded by adding new nodes.

Disadvantages in network computing

· Sharing, access controls for a single system may be inadequate.

· Complexity, a network may combine two or more systems with dissimilar operating systems with different mechanisms for interhost connection. Complexity of this nature makes the certification process extremely difficult.

· Unknown perimeter is one host may be a node on two or more different networks.

· Many points of attack, access controls on one machine preserves the secrecy of data on that processor. However, files stored in a remote network host may pass through many host machines to get to the user.

· Unknown path may be many paths from one host to another and users generally do not have control of how their messages are routed.

· Label formats differences is a problem which may occur in multilevel systems is that the access labels may have different formats since there is no standard

· Anonymity is attack can passed through many other hosts in an effort to disguise from where the attack originated

Network Security problem area:

Authentication

Deals with determining whom you are talking to before entering into a business deal or before revealing sensitive information

Secrecy

What usually comes to mind when people think about network security

Non-repudiation

Deals with signature

Integrity control

Keeping information is not modified, add or delete by unauthorized user

Web Application

Web application is an application that can be accessed using a web browser over a network. It is developed using browser-supported language such as HTML, JavaScript, PHP, ASP and etc. We also can use software such as dreamweaver to create a web application. The script produced is then rendered by common web browser. User can access web application anywhere and at any time, but user need to connect to a network connection and there is a web browser installed on the machine. This ease of usage makes web application popular among

internet user. Moreover the ability to update and maintain web applications without distributing and installing software on potentially thousands of client computers contribute to the popularity of the webapp. Nowadays webapp is used for accessing mail, online banking, online shopping, online reservation, wikis and many other functions.

The Open Web Application Security Project (OWASP) is an open community that focuses on improving the security of application software. Anyone can join this community and contribute an idea for developing secure software. OWASP provide free material such as article on secure programming, security testing guide and much more but all of the material is under free software license.

WebGoat

WebGoat is simulation toolkit used to demonstrate how we can exploit the vulnerabilities of a poorly design web application. WebGoat provide hints and code to fexploit the vulnerabilities. WebGoat will keep track on the progress of the user on every lesson they completed, user can see their level of competence in trying to solve every problem given in the lesson.The primary goal of the WebGoat project is simple, to create a de-facto interactive teaching environment for web application security.

WebScarab

WebScarab is another tool to expose the working of an HTTP(S) based application, whether to allow the developer to debug otherwise difficult problems, or to allow a security specialist to identify vulnerabilities in the way that application has been designed or implemented. WebScarab can use in any platform because it developed use JAVA programming language. WebScarab can intercept HTTP and HTTPS communication.

Database Security

Database security is a protection located in database to protect from unauthorized access. Database security become important because information is critical resource in enterprise, securing become billion dollar industry, and people want to protect their confidential information.

Characteristic of good database security:

• Data independence
• Shared access
• Minimal redundancy
• Data consistency
• Data integrity

In database there are four levels of security:

• Physical security (such as medium safekeeping and fire protection or fire wall)
• Operating system security ( use of an access control matrix)
• DBMS security (protection and query mechanism)
• Data encryption (standard data encryption and using RSA Method)

The first three levels in database security cannot provide a totally satisfactory solution because it’s hard to control disclosure of raw data and confidential data in distributed database, invalid to control sensitive data. To solve the problem, used encryption method, data is encrypted into cipher text and only be decrypted using decryption key.

Privacy mean unauthorized user cannot disclose data inside database.

Integrity mean unauthorized user cannot modify data inside database.

Availablelity mean authorized user can access database unfailingly.

Reliability and integrity:

• Database integrity is concern to protect whole database from damage.
• Element integrity is concern specific values of element only can be changed by authorized person.
• Element accuracy is concern correct values are written in database.

Sensitive data is data that should not be made public. There are many factor can make data become sensitive; data is inherently sensitive, declared sensitive, from sensitive source, or sensitive in relation to previously disclosed information.