B030710154

Security in Application

Email is an electronic application, it’s a message made of string ASCII characters. Email has two part, header and body. Header part used to state the sender and email recipient. Body part is content of the message or email.

Security in email:

· Confidentiality

· Data origin authentication

· Message integrity

· Non-repudiation of origin

· Key management

MIME. Short for Multipurpose Internet Mail Extensions, a specification for formatting non-ASCII messages so that they can be sent over the Internet. Many e-mail clients now support MIME, which enables them to send and receive graphics, audio, and video files via the Internet mail system. In addition, MIME supports messages in character sets other than ASCII.

Email Security Threads.

• Two main group:

o Threats to the security of e-mail itself

o Threats to an organisation that are enabled by the use of e-mail.

• Loss of confidentiality.

o E-mails are sent in clear over open networks.

o E-mails stored on potentially insecure clients and mail servers.

o Ensuring confidentiality may be important for e-mails sent within an organisation.

• Loss of integrity.

o No integrity protection on e-mails; body can be altered in transit or on mail server.

• Lack of data origin authentication.

o Is this e-mail really from the person named in the From: field?

o How many Kenny.Paterson’s are there?

o Recall SMTP directly over telnet allows forgery of all e-mail fields!

o E-mail could also be altered in transit.

o Even if the From: field looks fine, who was logged in as Kenny.Paterson when the e-mail was composed?

o Sharing of e-mail passwords common.

• Lack of non-repudiation.

o Can I rely and act on the content? (integrity)

o If so, can the sender later deny having sent it? Who is liable if I have acted?

o Example of stock-trading via e-mail.

• Lack of notification of receipt.

o Has the intended recipient received my e-mail and acted on it?

o A message locally marked as ‘sent’ may not have been delivered.

SSH or Secure Shell is initially designed to replace insecure rsh, telnet utilities, seecure remote administration (mostly of Unix systems), and Extended to support secure file transfer and e-mail. SSH provides security at Application layer, only covers traffic explicitly protected. Applications need modification, but port-forwarding eases some of this.

Application in SSH:

• Anonymous ftp for software updates, patches...

o No client authentication needed, but clients want to be sure of origin and integrity of software.

• Secure ftp.

o E.g.upload of webpages to webserver using sftp.

o Server now needs to authenticate clients.

o Username and password may be sufficient, transmitted over secure SSH transport layer protocol.

• Secure remote administration.

o SysAdmin (client) sets up terminal on remote machine.

o SysAdmin password protected by SSH transport layer protocol.

o SysAdmin commands protected by SSH connection protocol.

• Guerilla Virtual Private Network.

o E.g. use SSH + port forwarding to secure e-mail communications.