Security concepts

This book contains a number of security, compliance and encryption topics that might not be second nature to the reader. This section will provide an overview of concepts and methods discussed in the book along with references for further information.

Data classifications

Data classifications are used to assign data at the right level of protection and security based on the content type and sensitivity required. Personally Identifiable Information (PII) and Protected Health Information (PHI) are two of the classifications referenced.

• PII: Information that can uniquely identify an entity is considered PII. An example includes Social Security Number (SSN), home address, birthdate, e-mail address, and application login information.
• PHI: Information created or derived from a hospital, physician, and healthcare providers specific to an individual's past, present and future medical condition. There is also a growing concern over the activity information recorded by wearable devices by privacy experts.

Cryptography

Symmetric Encryption: This utilizes a shared secret key to encrypt and decrypt messages. Both the sender and recipient utilized the same key to encrypt and decrypt information passed between them. The key can take the form of a complex string, for example. The encryption algorithm along with its key length determine the relative strength of the key. The strongest current block cipher is Advanced Encryption Standard (AES).

Asymmetric Encryption: This utilizes a public key and a private key. A message encrypted by the private key can only be decrypted by the public key and vice versa. The public key is available to anyone, while the private key is kept secret. Public key certificates utilize asymmetric encryption and provide information about the organization to which the certificate was issued.

Certificates

Certificates provide digital identification and a mechanism to establish trust. We can think of a certificate as a driver's license or government issued ID card. The trusted root authority can be thought of as the government in this example. The license or ID can be thought of as the certificate. When someone checks our ID to verify our identity, they trust the authority that issued that ID. Likewise, when a certificate is issued from a trusted authority, we can be assured the identity represented by the certificate is genuine.

Also known as digital certificates or X.509 certificates, these certificates are widely used by websites to prove their identity to the web browser. Certificates can also be used for mutual authentication where not only does the web browser trust the website, but also the web site trusts the web browser.

Public Key Infrastructure (PKI) generates certificates in both public and private scenarios. A Certificate Authority (CA) is the mechanism that responds to proper certificate requests and returns certificates to the requesting party. Verisign, Thawte, and Digicert are examples of public CAs, meaning a certificate issued by them is trusted by the majority of commercial web browsers by default. A private CA is usually set up within a corporate network, and the certificates issued are only trusted by machines on the corporate network.

Virtual Private Networks

Virtual Private Networks (VPN) provide a network tunnel between two endpoints through which information is encrypted (protected) from the network traffic outside the VPN tunnel. There are two main types of VPN tunnels in use today: IPSEC and SSL. IPSEC stands for Internet Protocol security, while SSL stands for Secure Sockets Layer.

References

The following references give a background on topics covered in this chapter:

• Malware detecting Virtual Machines: http://www.symantec.com/connect/blogs/does-malware-still-detect-virtual-machines
• IP Spoofing overview: http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_10-4/104_ip-spoofing.html
• Man-in-the-middle attack: https://www.owasp.org/index.php/Man-in-the-middle_attack
• Known vulnerability database resources include the following:
  • National Vulnerability Database: http://nvd.nist.gov
  • Common Vulnerabilities and Exposures: http://cve.mitre.org/cve
  • Latest vulnerability exploit tracking at Internet Storm Center: http://isc.sans.edu
• PII Reference: http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf
• PHI Reference: http://www.hipaa.com/2009/09/hipaa-protected-health-information-what-does-phi-include/
• Encryption Reference: http://support.microsoft.com/kb/246071
• Cipher Reference: http://www.encryptionanddecryption.com/encryption/index.html
• PKI Reference: https://developer.mozilla.org/en-US/docs/Introduction_to_Public-Key_Cryptography
• IPSEC VPN Reference: http://csrc.nist.gov/publications/nistpubs/800-77/sp800-77.pdf
• SSL VPN Reference: http://csrc.nist.gov/publications/nistpubs/800-113/SP800-113.pdf