Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
21
Regardless of the media type, data on the media is stored in blocks
(sectors, clusters, etc.). As you know, there are two main ways to access
CSM data:
1) sequential access, when blocks are written one after another and to
read the next one you need to go through all the previous ones;
2) direct (random) access, characterized in that blocks are written and
read in random order.
For example, disk drives are random access devices, magnetic tape
drives are sequential access devices. In addition, CSM are characterized by:
• various physical principles of implementation;
• a wide range of volumes of stored information — from units to tens
of thousands of megabytes;
• a variety of specific implementations of media by various
manufacturers.
An attacker cannot access information on computer media in two
cases:
1) when the media itself is inaccessible to the attacker;
2) when the attacker has access to the media, but there are no
appropriate means of interaction with the media.
The main objectives of ensuring the information security of the AS
against the threat of disclosure of confidentiality at the CSM level are:
• excluding the passage of carriers through technological areas not
determined by production needs;
• preventing direct access to media by personnel not responsible for
operations with media (minimization of access), preventing loss or theft of
information media.
The first task is solved through the rational organization of the
production process of the movement of information carriers, ensuring the
targeted distribution of media across technological areas, the second —
through clear and justified regulation of the procedure for handling media.
When ensuring the safety of information resources of personal
computers, much depends on the choice of methods for protecting information
on floppy, magnetic disks (floppy disks) from unauthorized copying.
22
In addition to the classic change in the structure of a floppy disk
(binding to the timing parameters of reading and writing, non-standard
marking of tracks and changing the inter-sector distance), it is possible to
propose the use of methods for encoding information stored on a floppy disk
in accordance with a cryptographic conversion algorithm.
The cryptographic conversion algorithm is designed for hardware or
software implementation, satisfies cryptographic requirements, and its
capabilities do not impose restrictions on application. The established
unified cryptographic transformation algorithm for information processing
systems determines the rules for data encryption and the development of
imitation attachments and is recommended for organizations, enterprises
and institutions that use cryptographic protection of information stored and
transmitted in computer networks, in individual computer systems or
individual computers.
Particular attention should be paid to any media that leaves the
company. The most common reasons for this are equipment repairs and the
write-off of technologically outdated equipment. It must be remembered
that on the working surfaces of media, even in remote areas, there is
information that can be either of direct interest or indirectly cause an
intrusion into the system. For example, when using virtual memory, part of
the contents of RAM is written to the hard drive, which theoretically could
even lead to saving the password on permanent media (although this is
unlikely). Repairs performed on site by third parties must be supervised by
a cybersecurity engineer. It must be remembered that with the current speed
of the computer, files are copied at a speed exceeding megabytes per second,
and installing a second hard drive for copying at the time of repair without
the supervision of a specialist can be almost unnoticeable. All storage media
leaving the company must be securely cleaned or destroyed mechanically
(depending on the further purposes of their use).
And a few more words about the security of the storage media
themselves. Today, there are no storage media that are reasonable in terms
of price/reliability and are not hackable. The file structure, headers and
location can be read on any operating system using the appropriate software.
23
Only non-volatile media can be practically unopened; it automatically
destroys information when an unauthorized connection is attempted to any
points other than authorized connectors; preferably, it self-destructs when
depressurized, and has a microprocessor inside that analyzes the password
according to a scheme without open transmission. However, all this comes
from the area of “crazy” prices and military technologies.
For business class and private correspondence, this problem is solved
much easier and cheaper — with the help of cryptography. Any amount of
information from a byte to a gigabyte, being encrypted using a more or less
strong cryptosystem, is inaccessible for reading without knowing the key.
And it doesn’t matter at all whether it is stored on a hard drive, on a floppy
disk or a CD, no matter what operating system it is running. Mathematics
stands against the latest technologies and millions of expenses, and this
barrier is still impossible to overcome. That is why law enforcement
agencies of almost all countries, being unable to resist the laws of
mathematics, use administrative measures against the so-called strong
cryptography.
1.5. MAIN TYPES OF ATTACKS ON DCS
An attack on a computer system is an action taken by an attacker,
which consists of searching for and exploiting a particular vulnerability [1].
Main types of attacks:
1. Human intervention in the operation of the AS. This type includes
organizational means of violating the security of the AS (theft of storage
media, unauthorized access (UA) to information storage and processing
devices, damage to equipment, etc.) and the implementation by the violator
of unauthorized access to the software components of the AS (all methods
of access control in the AS, and also methods for the violator to obtain illegal
access rights to the components of the system). Measures to counter such
attacks are of an organizational nature (security, access mode to the AS),
and also include improving systems for detecting attempted attacks
(attempts to guess passwords).
24
2. Hardware and technical interference in the operation of the AS, i.e.
violation of the security and integrity of information in the AS using
technical means, for example, obtaining information on the electromagnetic
radiation of the AS devices. Protection against such threats, in addition to
organizational measures, provides for appropriate hardware (shielding of
equipment emissions) and software measures (encryption).
3. Destructive impact on the software components of the system using
software tools (destructive software tools (DST)). These include computer
viruses, Trojan horses, bookmarks, logic bombs, and time bombs. Means of
combating such attacks are software-implemented security tools.
The latter type of attack is developing more dynamically, using all the
latest advances in information technology. Let us dwell on it in more detail
and give a brief description of some DST.
“Logic bombs” and “time mines” are DST that do not perform any
functions until a certain event occurs in the system, after which they are
“triggered,” which, as a rule, involves serious disruption of the system and
the destruction of information.
A “Trojan horse” is a program that contains some destructive function
that is activated when a certain conditional trigger occurs. Typically, such
programs are disguised as some useful utilities, game programs, pictures or
music.
Bookmarks also contain some function that damages the AS, but this
function, on the contrary, tries to be as inconspicuous as possible, since the
longer the program does not arouse suspicion, the longer the bookmark can
work.
As an example, here are some functions implemented by Trojan
horses and bookmarks:
1. Destruction of information. The specific choice of objects and
methods of destruction depends on the imagination of the author of such a
program and the capabilities of the OS.
2. Interception and transmission of information.
3. Purposeful modification of the program code that is of interest to
the offender. Typically these are programs that implement security and
protection functions.
25
A computer virus is a program that can infect other programs by
modifying them by adding a possibly modified copy of itself. Capable of
self-reproduction, while “copies” of the virus can differ structurally and
functionally from each other.
Currently, there are more than 40 thousand registered computer
viruses in the world. All computer viruses can be classified according to the
following criteria:
1) by habitat;
2) by method of infection;
3) according to the degree of danger of destructive (harmful)
influences;
4) according to the operating algorithm.
Based on their habitat, viruses are also divided into:
• network;
• file;
• boot;
• combined.
The habitat of network viruses is elements of computer networks. File
viruses are located in executable files. Boot viruses are located in the boot
sectors (areas) of external storage devices (boot sectors). Combination
viruses reside in multiple habitats. An example of such viruses are boot file
viruses. These viruses can be located both in the boot sectors of magnetic
disk drives and in the body of boot files.
Based on the method of infecting the environment, computer viruses
are divided into:
• resident;
• non-resident.
Resident viruses, after their activation, move completely or partially
from their habitat (network, boot sector, file) to the computer’s RAM. These
viruses, using privileged operating modes allowed only to the operating
system, infect the environment and, when certain conditions are met,
implement a destructive function. Non-resident viruses enter the computer's
RAM only for the duration of their activity, during which they perform a
26
pest and infection function. Then the viruses completely leave the RAM,
remaining in their habitat. If a virus places a program in RAM that does not
infect its environment, then such a virus is considered non-resident.
The arsenal of malicious capabilities of viruses is very extensive. The
destructive capabilities of viruses depend on the goals and qualifications of
their creator, as well as on the characteristics of computer systems.
According to the degree of danger to the user’s information resources,
computer viruses are divided into:
• harmless viruses;
• dangerous viruses;
• very dangerous viruses.
Harmless viruses are created by authors who do not set themselves the
goal of causing any damage to the resources of a computer system (AS).
The destructive impact of such viruses comes down to displaying innocent
pictures on the monitor screen and playing musical fragments. But for all
their harmlessness, they consume system resources, to some extent reducing
the efficiency of operation, and may contain errors that lead to disruption of
the system’s operation algorithm.
Dangerous viruses include viruses that cause a significant decrease in
the efficiency of the system, but do not lead to a violation of the integrity
and confidentiality of information stored in storage devices. An example is
viruses that cause the need to re-execute programs and reboot the operating
system.
Viruses that cause violation of confidentiality, destruction, irreversible
modification of information, as well as viruses that block access to
information and lead to hardware failure should be considered very
dangerous.
One of the main conditions for the safe operation of the DCS is
compliance with a number of rules [1].
Rule 1: Update your antivirus program periodically.
Anti-virus scanners can only protect against those computer viruses
whose data is contained in the anti-virus database. Of course, there are
mechanisms for searching for unknown viruses (that is, those for which
27
there are no descriptions in the anti-virus database). However, this is still
too little to be considered absolute protection.
In this regard, the need to regularly update anti-virus databases
becomes of paramount importance. The more often this is done, the more
secure the workplace will be. The best solution is to download updates daily,
although there are times when several updates appear at once per day. In this
regard, it is recommended to configure the internal scheduler, present in
most modern antivirus programs, to automatically download updates 2 or
3 times a day: in the morning, afternoon and evening.
Rule 2: Be careful with files in emails.
It is hardly worth emphasizing that under no circumstances should you
run programs sent by an unknown person. This rule is well known and does
not need explanation.
Another thing is files received from acquaintances, colleagues,
friends. Firstly, the programs they send can be infected. Secondly, friends
may not even know that unauthorized letters are being sent from their
computer: a virus can do this on someone else’s behalf, unnoticed by the
computer owner! It was in this way, for example, that such well-known
viruses as LoveLetter, Melissa and many others were spread. They quietly
gained access to the address book of the Outlook email program and sent
copies of themselves to the found email addresses, accompanying the
messages with enticing comments urging them to launch the attached file.
An equally important point is the apparent security of attached files of
a certain format. Do you think files with the extension PIF, GIF, TXT cannot
contain malware? Even such “harmless” programs can contain hidden
viruses.
Rule 3: Limit the circle of computer users.
The ideal option is a situation where no one except the owner himself
has access to the computer. However, if this is not possible, then it is
necessary to clearly delineate access rights and determine the range of
permitted actions for other persons. First of all, this applies to working with
mobile media, the Internet and e-mail. In this case, it is important to control
all sources of viral danger and cut off other users from them.
28
Rule 4: install patches to installed software in a timely manner.
Many viruses exploit holes in the security systems of operating
systems and applications. Antivirus programs can protect against this type
of malware, even if the corresponding “patch” is not installed on the
computer to close the “hole”. Despite this, it is recommended to regularly
check the websites of the manufacturers of the installed software and
monitor the release of new patches. First of all, this rule applies to the
Windows operating system and other Microsoft programs. Not because this
company has the worst products, but because they are the most common
and, accordingly, receive the most attention from virus creators.
Rule 5: be sure to check mobile storage media.
Despite the fact that about 85 % of all registered cases of computer
virus infection occur through email and the Internet, one should not forget
about such a traditional method of transporting malicious code as mobile
media (floppy disks, CDs, etc.). Before you start using them on your
computer, you need to carefully scan them with an antivirus program. The
only exception may be disks intended for formatting.
Pirated CDs, which are so widespread in Russia, also pose a great
danger. For example, an audit conducted by Kaspersky Lab in 1999 revealed
the presence of viruses on 23 % of purchased media. The conclusion is
simple: carefully check even purchased CDs.
Rule 6: Be wary of trustworthy sources.
Just as all ages are subject to love, no one is immune from computer
viruses. This applies equally to large software and hardware companies. It
often happens that visitors to their sites are offered infected programs. An
indicative case is when, for several weeks, a Word document infected with
the Concept macro virus was on the Microsoft website.
No less rare are cases of the presence of viruses on floppy disks with
hardware drivers and licensed software. It often happens that a computer
sent to a repair shop for maintenance is returned not entirely clean. It’s not
that there is a thick layer of dust on the monitor, or cobwebs on the keyboard
(although this also happens), but that viruses are just getting on the disk.
Typically, this occurs because repairmen use the same CDs to load programs
29
to test various parts of the computer. Thus, they very quickly transfer
computer “infection” from one computer to another. The bottom line is that
when you receive your computer from repair, be sure to thoroughly scan it
for viruses.
All this makes it necessary to verify even data obtained from
trustworthy sources. In this case, it is hardly worth blaming the
manufacturers themselves for allegedly deliberately trying to infect the
computer: in every work there are misfires. It’s just that sometimes they also
concern anti-virus security.
Rule 7: Combine different antivirus technologies.
You should not limit yourself to a classic antivirus scanner, launched
at the user’s request or using the built-in event scheduler. There are a
number of other, often more effective technologies, the combined use of
which can practically guarantee safe operation. These technologies include:
firstly, an antivirus monitor, which is constantly present in the computer’s
memory and scans all used files in real time, at the time of access to them;
secondly, a change auditor, which monitors all changes on the disk and
immediately reports if a virus has settled in any of the files; thirdly, a
behavioral blocker that detects viruses not by their unique code, but by the
sequence of their actions. The combination of the described methods of
fighting viruses is the key to successful protection against malicious
programs.
Rule 8: Always have a blank boot disk with you.
It often happens that viruses make it impossible for computers to boot
for the first time. In other words, the information on the disk remains safe
and sound, but the operating system loses its ability to boot. To successfully
resolve such problems, you must have a special blank CD with an anti-virus
program installed. With its help you can boot and restore the system.
Rule 9: Regular backups.
This rule will help save data not only if the computer is infected by
some kind of virus, but also if the computer has a serious hardware failure.
It’s unlikely that anyone wants to lose the results of many years of work due
to a system failure, regardless of whether it is caused by viruses or not. That
30
is why it is recommended to regularly copy the most valuable information
onto independent media: floppy disks, magneto-optical disks, magnetic
tapes, CDs.
Rule 10: Don’t panic!
Viruses are the same programs as a Windows calculator or notebook.
Their distinctive feature is that viruses are able to reproduce (that is, create
copies of themselves), integrate into other files or boot sectors, and perform
other unauthorized actions. Viruses are created by the most ordinary people,
and there is nothing otherworldly about them. You can do much more harm
if you get scared and take rash actions aimed at neutralizing the virus. If you
are working on a corporate network, call your system administrator
immediately. If you are just a home user, then contact the company from
which you purchased the antivirus program. Let the professionals take care
of your safety. After all, they get money for it [1].
There is another type of attack found in the literature called a “social
psychology attack”. Let us give a brief overview of several fairly common
methods [13].
Calling the administrator — the attacker selects from the list of
employees someone who has not used a password to log in for several days
(vacation, time off, business trip) and whom the administrator does not
recognize by voice. This is followed by a call explaining the situation about
the forgotten password, a sincere apology, and a request to read out the
password or change it to a new one. In more than half of the cases, the
request will be granted, and the fact of substitution will be noticed either
with the first unsuccessful attempt to register the real employee, or by the
damage caused by the attacker.
Almost the same scheme, but in the opposite direction, can be played
by an attacker against a company employee — a call from the administrator.
In this case, he introduces himself as an employee of the information
security service and asks for a password either due to a failure in the
database, or supposedly to confirm the identity of the employee himself for
some reason (distribution of particularly important news), or regarding the
employee’s last connection to any information server within the company.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]