Hardware and Data Security: Portable storage devices

Portable storage devices are a threat to data confidentiality and this threat is not recognised in the majority of organisations. Vice president Eric Ouellet of research for security at Gartner Inc. in Stamford said in a recent article that as little as 10% of enterprises have policies that deal with removable storage devices. This low recognition is not due to inabilities of controlling the problem as there are solutions available. (Mearian, March 2006) Data confidentiality can be explained quite simply as the access of data by the predetermined authorized people or systems. Many organisations spend hundreds and sometimes hundreds of thousands of dollars on network and computer security and therefore data confidentiality. Innocently or intentionally guests, employees and visitors who have access to any workstation can breach and hence create a threat to data confidentiality quickly and furtively. Through the use of portable storage devices data confidentiality could be breached in an organisation in a number of ways these include physical theft of a storage device in order to retrieve data i.e. hard drive and copying the data with the aid of various devices such as a flash drive (Pfleeger, 2003)

Physical theft

Hard drives

Physical theft of storage devices would be the most obvious breach in data confidentiality. Since many of today’s systems are backed up onto portable storage devices themselves, physical theft of such as device creates a direct threat to any organisation. Encryption of portable storage devices makes stolen information and the device useless to thieves. This also ensures forensic retrieval is not carried out after a hard drive has been thrown out or lost/stolen.

Forensic retrieval can be used to retrieve data from magnetic media since data can potentially still be retrieved even if it is overwritten or formatted.

Various devices

Flash drives

There are many portable storage devices available, the most popular being USB (Universal Serial Bus) drives or flash drives. Whilst there are different versions of flash drives which use different connection types such as firewire, this report will focus on the more common and universal USB connection. In today’s society increasing demand for ubiquitous computing, is causing devices to become smaller and have more memory capacity. With USB flash drives now around 10cm and smaller and capable of between 8MB (megabytes) and 64GB (gigabytes) storage. Retrieval of sensitive data would be extremely easy, assuming the attacker had unrestricted physical access as well as virtual access such as passwords and USB ports are not disabled. Through USB’s larger memory sizes, compared to older technologies such as floppy drives which only have 1.44MB storage, a potential theft is able to store copious amounts of data on such a device. Large databases of sensitive information such as hospital and government records could be copied on to these devices with ease. USB devices have a limited number of write erase cycles and write operations gradually slow as the device ages. Running applications from a flash drive, although viable, to breach data confidentiality is not the best option since running software or an operating system means undertaking a lot of read write cycles and a better option would be to use a portable hard drive, because of this policies need to be made to restrice the execution of software of external hard drives. (USB Flash Drive, Wikipedia 2006)

Key Logger

Not only could sensitive files be copied (assuming unrestricted access) other devices such as key loggers, which store key strokes inputted on a keyboard. Storage devices like these could be used to gain access to confidential data at a later date through logged passwords and access methods. Furthermore malware such as virus, spyware, adware could be loaded from the portable storage devices, either unintended or intentional which would lead to data attacks.

CD/DVD drives

Other devices include CD/DVD burners and external hard drives. Although these devices are less portable since they are much larger making them harder to hide and a user could easily be caught breaching data confidentiality by a security administrator or staff member.

However one could argue that in order for organisations to go about there daily proceedings they would need CD/DVD burners, thumb drives and external hard drives. In this scenario utilising software such as Device Shield, software developed by Layton technology which allows the administrator to gain full control of every port, drive and individual devices, ensuring efficiency of the organisation is not compromised. Device Shield also captures history of actions attempting to access blocked devices/ports etc creating a tracing route if confidentiality is breached. Device Shield and similar software which is available could be used in conjunction with policies referring to portable storage devices to create a secure working environment. (Device Shield: Protection against the threat from within, 2006)

References

Robb, D. (October, 2006) Backups gone badly retrieved October 16, 2006 from http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=&articleId=266212&taxonomyId=019&intsrc=kc_li_story

Latamore, G. B. (October, 2006) How to Back Up your PDA retrieved October 16, 2006 from http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=&articleId=265905&taxonomyId=019&intsrc=kc_li_story

No author, (2006) Sanctuary device control retrieved October 16, 2006 from http://www.securewave.com/sanctuary_usb_endpoint_security_software.jsp?gclid=CNCKkNPa_4cCFUpkDgodhkDnFw

Bolan C. (2006) Hardware Security and Data Security, Edith Cowan University, retrieved October 15, 2006 from MYECU lecture slides

Mearian, L. (March, 2006) IT Managers See Portable Storage Device Security Risk retrieved October 14, 2006 from http://www.computerworld.com/hardwaretopics/storage/story/0,10801,109680,00.html

Pfleeger. C. P & Pfleeger, S.L. (2003) Security in Computing 3^rd Ed, Upper Saddle River, New Jersey, Prentice Hall Professional Technical

No Author, (2006) Device Shield: Protection Against The Threat From Within retrieved October, 15, 2006 from http://www.deviceshield.com/pages/deviceshield.asp?crtag=google&gclid=CP7jntHa_4cCFUdtDgodTkbyHg

Wikipedia, (2006) USB Flash Drive retrieved October 16, 2006 from http://en.wikipedia.org/wiki/USB_Flash_Drive

Network Security

Packet spoofing or IP spoofing is the act of faking the source of a packet. A security attack like this impedes the network security. Packet spoofing breaks the three qualities that a secure system has; confidentiality, integrity and availability. Confidentiality is keeping information access to authorised parties. Integrity ensures that a system can only be modified by authorised parties and in authorised ways. Availability is ensuring that access to a network is not prevented, authorised parties should are able to access the system at appropriate times. All attacks mentioned breach at least one of these qualities of a secure system. (Pfleeger, 2003) When a file such as a photo is sent over a network, both a home or internet network, the photo is split into small pieces and information of how to handle the files are encapsulated called protocols. The header of the packet amongst other things contains the order value or algorithm in which the packets where sent. Packets will probably arrive out of order and must the packets must be placed back together using the order sent value.

Packet spoofing is possible because of the vulnerabilities in the network protocols. A few examples of network spoofing are masquerade, a smurf and SYN flood which are denial of service attacks, and attacking confidentiality, session hijacking.

Internet Protocol (IP)

Internet protocol is a network protocol from the OSI model, on layer 3. IP has no information, contained in the header of the network packet, regarding its transactions state and whether the packet has properly reached its destination. This vulnerability enables the source and destination IP address to be altered. By forging the source and destination IP address so it contains a different address an attacker can make it appear that a packet was sent by a different machine.

Transmission Control Protocol (TCP)

TCP uses a connected design to send data; and participants build a 3-way handshake.

The TCP header is different to the IP header but can still be manipulated using software. The TCP packet header contains amongst other things the sequence and acknowledgement numbers. The data contained in these ensures packet delivery by determining whether or not a failed packet needs to be resent. This is done by the sequence number which is the number of the first byte in the current packet whereas the acknowledgement number contains the value of the next expected sequence number. This confirms for both the client and server that the proper packets were received.

Connection is established by a client who must find an open port on the server. This is done by sending a SYN (synchronise) this is a synchronisation of sequence numbers on two connecting computers. In response the server replies with a SYN-ACK and the client then sends back an ACK back to the server. This ensures there is acknowledgement of the connection.

Integrity attacks; Masquerade

Masquerade

In a masquerade a host pretends to be another. A common masquerade attacks are having alterations of domain names and websites. For example bank.org and bank.com could be two different and separate websites. Bank.org could be a legitimate bank, but bank.com could be a carbon copy of the original bank.org website and could be used to collect sensitive data and information. By using different links and passing the connection to the original site whilst collecting the victims’ data. Through this technique an attacker could have multiple avenues such as access to computer systems by obtain login names and passwords, alter change, steal money and therefore breach the integrity of the network. (Pfleeger, 2003)

Availability Denial of service attacks; Smurf attack and SYN flood

TCP ensures delivery of packets through a 3 way handshake, availability of a network can not be ensured and there are different types of Denial of service attacks. All of these attacks send a large amount of messages to the system which causes it to not function. And in both Smurf and a SYN flood the original source of the flood can not be traced as the attacker will spoof the messages making them appear from another machine.

Smurf

The smurf attack uses spoofed broadcast ping message to flood at target system. A large amount of Internet control message protocol (ICMP) or traffic ‘ping’ to IP broadcast addresses are sent. Some devices actually multiply the traffic and will send an ICMP echo request replying to the original ping message. “Smurfable” networks have greatly reduced nowadays due to network management although users using old technologies are still capable of being “smurfed’. (Smurf Attack, Wikipedia 2006)

SYN flood

Similar to a smurf attack a SYN flood is when an attacker sends a large amount of SYN requests to a target system. As discussed a TCP connection uses a three-way handshake by sending a succession of acknowledgments and acceptance messages. Sending a large amount of SYN messages the server will not receive its needed ACK acknowledgement message needed to continue the connection. The SYN message floods the network and hence makes it unavailable. (SYN Flooding, Wikipedia 2006)

Confidentiality; Session Hijacking

Session Hijacking

Session Hijacking refers to the exploitation of a valid session key to gain unauthorised access to information or service in a network. Although session keys are normally randomised and encrypted to prevent session hijacking a third party ( the attacker) will intercept traffic between two systems. The attacker then has access to the system, monitoring information and collecting data. A similar attack called man-in-middle attack is when the hijacking usually starts at the start of the session between the two systems. The attack uses the public key and decrypts the data and then encrypts it back to it original form to pass on to the receiver. (Pfleeger, 2003)

Reference

Pfleeger. C. P & Pfleeger, S.L. (2003) Security in Computing 3^rd Ed, Upper Saddle River, New Jersey, Prentice Hall Professional Technical

Tanase, M. (2003) IP Spoofing: An Introduction retrieved October 15, 2006 from http://www.securityfocus.com/infocus/1674

No author, (2006) SYN flood Retrieved October 15 2006 from http://en.wikipedia.org/wiki/SYN_flood

No author, (2006) Smurf Attack Retrieved October 15 2006 from http://en.wikipedia.org/wiki/Smurf_attack

No author, (2006) Transmission Control Protocol: Connection establishment Retrieved October 15 2006 from http://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_establishment

Wide Area Networks and VPN

Virtual Private Network, (VPN), is a private communications network, of two or more computers, which uses encryption, to provide a secure connection through the internet; although sometimes VPN services can be created via third-party vendors who own physical lines and clients pay to use them. Using third-party vendors is not, the majority of the time, very cost effective.

Types of VPN

There are three types of VPNs

Intranet VPN-

Allows connectivity between remote locations of a single company and allows organisations to create LAN to LAN connections

Extranet VPN-

When two close organisations or a business and its customers want to share data and information, which allows all of the connected LANs to work in a shared environment

Remote access VPN-

Is when a user can enter the VPN remotely without using a VPN device but instead goes via his/her own Internet service provider (ISP) and authenticates him/her self as seen in the diagram below.

(Dennis, 2003, pg 207)

How it works:

A VPN connection will be setup containing these qualities;

Connection:

Each user must have some type of connection to the internet whether it is a simple dialup connection or a faster T-Carrier Service such as T4 giving effective speeds of 218mbps (Dennis, 2002)

Authentication:

Since VPNs are placing private data on a public network, the internet, and users are accessing it remotely, authentication measures must be used in-order to combat potential threats to the data, these authentication techniques can be summarised into three categories:

Something you know, eg. a login name

Something you have, eg. a physical card key or

Something you are eg. a fingerprint pattern

Encryption:

VPNs are very similar to private packet switched networks as both try to keep data private. Encrypting data is the only way in ensuring the privacy of the information being sent modern encryption algorithms such as symmetric DES, AES, RC5 Blowfish or asymmetric algorithms such RSA or a more secure combination of both. (Module 4: Crypto 1, 2005)

Tunnels and Encapsulation:

VPNs enable its users to create permanent virtual circuits (PVC) that are called tunnels, these virtual circuits are defined for frequent and consistent use by the network, and do not change unless changed by the network administrator/manager. The VPN devices send and receive packets through internet tunnel. The VPN encapsulates the data with different protocols and frames which provides the information to the receiving VPN on how to process the new packet. These protocols go over the existing protocols that a piece of data would normally need to be transferred over the internet these are as follows Peer-to-Peer (PPP), Internet protocol (IP), Transmission Control Protocol (TCP), and Simple Mail transfer Protocol (SMTP). These protocols act like wrapping paper with written addresses and instructions of how to handle that data. The VPN furthers this encapsulation for sending over a tunnelled network by placing the VPN protocol Layer-2 tunnelling protocol (L2TP). This is then wrapped in another IP address since it is sent to the address of the VPN device. The final protocol is synchronous optical network (SONET) this is because each circuit on the internet, T1 SONET OC-48 etc has its own data link protocol so the VPN device surrounds the OP packet with the appropriate frame for the appropriate circuit that the final packet will be travelling on. On the receivable end the receiving VPN device simply strips off or decrypts the protocols and receives the packet. (Dennis, 2002)

Advantages

Improve productivity for a business or organisation.

Reduce transit time and transportation costs for remote users, such as airplane tickets and petrol costs. Simplify network topology and security in some scenarios.

Low costs comparative to other choices.

Disadvantages

Even though VPNs have dedicated tunnels it doesn’t mean that it is dedicated to an individual user, it simply means that it has a specific address that each packet must follow. This essentially means that if there is a lot users online the network will be become bottlenecked because unlike other networks it can not choose another address or path to follow since it is inside the ‘tunnel’.

(What is a virtual private network, no date)

References

Dennis, A. (2002). Networking In The Internet Age. United States of America: John Wiley and Sons, Inc

Tyson, J. (N.D.) How Virtual Private Networks work. Retrieved October 2, 2006 from http://computer.howstuffworks.com/vpn.htm

Howe, D. (1999) The Free On-line Dictionary of Computing, Retrieved October 3, 2006 from http://dictionary.reference.com/search?q=virtual%20private%20network

Wikipedia (September, 2006) Virtual Private Network, Retrieved October 3, 2006 from http://en.wikipedia.org/wiki/VPN

No author, (No Date) What is a virtual private network?, Retrieved October 3, 2006 from http://www.ciscopress.com/content/images/1587051796/samplechapter/1587051796content.pdf

No author, (2005) Module 4: Crypto 1, Retrieved October 3, 2006, Computer security lecture slides. Edith Cowan University from http://myecu.ecu.edu.au/webapps/portal/frameset.jsp?tab=courses&url=/bin/common/course.pl?course_id=_35490_1

Computer Security Attacking Cryptography Recovering Password

This reports explores the ways an intruder could enter a computer system and violate the confidentiality of files. We know that Alice is using an encryption tool called Truecrypt and Charlie has to find a way of accessing the commercially sensitive files on her hard drive. To do this Charlie needs to learn a number of things firstly how she is encrypting the software, although we know Charlie does not.  Secondly he needs to find a number of passwords to access the encrypted files. The first password is to dismount the virtual drive that the Truecyrpt program has created and maybe a second to access the hidden volume. This is because no one is sure if she has used the second hidden volume feature.Charlie has many viable options available and his best mode of attack would be to use a combination of keyloggers hardware and software, cameras, and password recovery software.

Many people take the computer power for granted and start questioning a computer only when it fails or when there is a security breach. The reality is that violating the confidentiality, integrity or availability of a computer system, ethical or legal obstacles aside, is relatively easy. This report attempts to address the question: Given a particular scenario what are the ways of entering into a computer and retrieving encrypted data. The report explains the different methods of attack that could be used, to increase Charlie’s chances of accessing the files he should use a combination of all these attacks to get through the different security barriers in place. Charlie should also be ready to use all of the attacks encase one of the methods fails.

Assumptions:

• Alice is very careful with the password that she uses for the Truecrypt program.
• Charlie can find details of the Truecrypt program on the WWW.
• Charlie will not be constrained by the legal or ethical implications of his actions.
• Charlie has a high degree of technical literacy and is comfortable with many aspects of computing, including programming.
• Charlie is acting as an individual and has a finite budget.
• The secret communications are time sensitive and therefore Charlie will need to choose an avenue of attack that will work in a reasonable amount of time.
• The Data is time sensitive, we can therefore assume that it is going to be accessed regularly. This brings it forward in the list of last file accessed search.
• Alice has gone to the trouble of securing her file with encryption it is assumed she is going to have a windows logon password.
• Due to the Firewall Spyware and Adware programs Charlie can’t send Alice a virus or malware to violate the system and access to the data.
• Since Alice is using Open Source software it is assumed that she doesn’t have a lot of finances to fund an administrator and have her own system support/help desk.
• Alice’s operating system is Windows XP and is connected to a networked computer with always on internet (broadband)

Obtaining passwords

The following methods can be used as a-go-around for the many barriers that Charlie faces. For example obtain the windows logon password, discover one or two encryption passwords and to see simply see what encryption tool is being used (Truecrypt).

Software key logger

Charlie has 30-minute intervals in which he can access the computer. In this time he would be able to install one of the many different types of software key loggers available.

A software key logger is a program which records all the key strokes of a computer, after installing such a program Charlie would be able to record and retrieve any passwords and the method of accessing the data. Which would explain to Charlie how thesensitive file is encrypted, and where the data is kept ready for him to retrieve.

(Quick_Logs, 2006)

The above picture is and example of a software keylogger called Quick-Keylogger 2.1.

Physical/Hardware key logger

Another variation of the software is a hardware or physical key logger. The hardware key loggers work in a similar way as the software loggers and would be installed in the 30 minute time frame would also retrieve the keystrokes of passwords and method of encryption. The hardware logger has the advantage of not slowing the system down and is less likely to be detected, as there is no software running on the computer that could be stumbled upon. The physical logger has its own separate microchip, which captures the keystrokes and a separate flash memory, which stores them. This sort of attack would obviously only work if Alice’s computer monitor is hidden away for example inside a cabinet as most computer users would notice the new extension of the cord.

The physical key logger looks similar to an extension cable and is placed in-between the keyboard and the monitor obviously it wouldn’t be a viable option if Alice had a laptop or if her keyboard used a connection other than USB or PS/2. (Keyghost, 2006)

Windows XP Administration account

Many people have logon passwords for the Windows XP accounts. What a lot of people do not know is how easy it is to reset the password, change the password or view the files from an administration or guest account. This can be done as follows:

Whilst the computer is loading on windows start up press F8 and force the computer into Safe Mode.

Logon into the Administrator account the default password is blank. Since many people are not even aware of the account the odds are that the password has not been changed.

Through this we can then access all the documents in the Luke account as you can see in the picture above we are logged into the Administrator account and it allows viewing of the other accounts files.

This would provide to Charlie a go around method for the windows login password. Charlie could do a number of things; firstly this would enable him to install a software key logger and secondly it would give him access to the normally restricted access other windows login accounts.

Windows password recovery software or retrieval software

Another method would be to use one of the programs that are available to recover lost or forgotten passwords. Advanced Windows XP Password recovery or AWPR is one of the many programs available on the internet. These programs recover the passwords of forgetful user but could prove useful to Charlie if Alice went on her coffee break/ lunch he could recover the logon password and come back at a later date, although it would be in Charlie’s best interests to try the methods mentioned above first. As Charlie needs to make his visits to Alice’s computer as least frequent as possible.

Active Password Changer V3.0 is a program, which does not need to be logged on to recover the password; the user creates a bootable disk from the programs installation package. This program however only allows you to reset the password and not recover it. Charlie would then be leaving too many tracks. This could make it difficult hiding the fact that he has entered here system

Observing using surveillance

Another way to obtain the passwords as well as the method of encryption is visual surveillance there are many wireless cameras available that could record on screen information and keyboard keys. A simple search in e-bay and many different surveillance options become available

New Awesome SupaTiny Wireless Spy Camera, (2006)

Other options include hidden cameras in smoke detectors and other office friendly devices. To use these options Charlie would have to thoroughly assess the situation. As leaving a physical device makes it obvious and leaves damaging evidence.

Social Engineering

Dating Alice

Given the correct circumstances Charlie could try and date Alice. It is well known that individuals who work for the company do the majority of computer fraud. As it means they are already inside the computer network and know the in’s and outs of the system. We could now make a further assumption that Charlie and Alice are work associates. This would make it much easier for Charlie to “seduce” Alice. Of course the correct circumstances would come about but this option is viable.

Security Officer or other important personnel

Charlie could impersonate an IT officer fixing the computer and doing “routine checkups” and ask Alice for her passwords and her methods of hiding files to retrieve the files.

Hoax email

Although there are many warning about hoax emails asking for passwords (especially banks) this option is also viable. Sending out an email asking a user to logon and check or validate their passwords giving access to the information.

Back Orifice/ Subseven

These programs create a back door entry into a computer allowing the attack to control the computer remotely, browse files on the system, take screen shots, open and close programs, remotely restart a computer and edit registry information. To do this though Charlie would have to install a small executable file on to Alice’s computer he could do this in a number of ways physically installing it himself in the 30 minute interval in this time he would also have to open up the ports of the computer through the virus software. Or through social engineering such as impersonating an IT security officer or computer advisor or sending out a hoax email that tricks the user into installing the package. Once the program has been installed Charlie would be able to access the files (assuming he already has the passwords) and breach the confidentiality of the files. (Backdoor.Subseven, 2006)

Physical written down password

This is probably the simplest and least plausible of all the methods but is viable. It is important for users to create complicated passwords but this leads users too needing to write down there password as a way of remembering it. Charlie could search the surrounding areas before attempting any other methods as a way of gaining access to the system and files.

Searching and obtaining files

Another method of obtaining the files is using the windows last file accessed search. Since the data is time sensitive, Alice is going to access the file to update it. Charlie could do a file search and see the last files accessed. And then use the passwords obtained through other methods to breach the confidentiality of the file.

This report contains the most viable ways that Charlie could breach the confidentiality of Alice’s files. With both hardware, such as physical keyloggers, mini video cameras and software, password recovery applications and back entry programs as an aid. Charlie could assess the situation and have multiple backup plans if the original plan fails.

References

Keyghost, (2006), Keyghost, Retrieved August 27, 2006, from http://www.keyghost.com/hardware-keylogger.htm

Koris, G. (2004), Backdoor.SubSeven Summary, Retrieved September 5, 2006 from http://www.symantec.com/security_response/writeup.jsp?docid=2001-020114-5445-99&tabid=2

Koris, G. (2004), Backdoor.SubSeven Technical details Retrieved September 5, 2006, from http://www.symantec.com/security_response/writeup.jsp?docid=2001-020114-5445-99&tabid=3

Lost Password Recovery for Windows XP 2003 2000 NT, (2006) Retrieved, September 5, 2006, from http://www.password-changer.com/

New Awesome SupaTiny Wireless Spy Camera, (2006), Retrieved, September 5, 2006 from http://cgi.ebay.com.au/New-Awesome-SupaTiny-Wireless-Spy-Camera-Top-Quality_W0QQitemZ150029230414QQihZ005QQcategoryZ14957QQrdZ1QQcmdZViewItem

Pfleeger. C. P & Pfleeger, S.L. (2003) Security in Computing 3^rd Ed, Upper Saddle River, New Jersey, Prentice Hall Professional Technical

Quick_Logs, (2006) Retrieved, August 27, 2006, from http://www.quick-keylogger.com/images/screens/quick_logs.jpg

WideStep, (2006), Retrieved September 5^th, 2006 from http://www.quick-keylogger.com/

Wikipedia (2006), Back Orifice 2000, Retrieved September 5, 2006, from http://en.wikipedia.org/wiki/Back_Orifice_2000

Operating Systems: Mandatory and Discretionary Access Control

Operating Systems must be guarded from unintentional and malicious use of computer resources. Security measures must be created to protect these unwanted actions of operating systems.

Access Rights and control mechanisms

One of the most important defences in operating system security is to control access to internal data and resources. Access rights define how various users, software or hardware can access various objects. The different types f access rights are reading, writing and printing these are called different privileges.

A collection of access rights is called a protection domain. No one processes or objects on the computer should be aloud to access every resource on a system as this could compromise security. In the majority of computing systems the administrator possesses all access rights and is responsible for managing other user’s rights. (Deitel, 2004)

Authorisation

Access control must not be confused with authorisation, assuming a user has properly authorised him/herself with passwords etc. Authorisation is the act of checking to see if a user has the proper permission to access a file or perform an action. Authorisation checks typically mean querying the access control list

Access control mechanisms

There are a wide variety of access control mechanisms and usually the best is a combination of them all. They should control restrictions on what users can do, which resources they have access to, and what functions they are allowed to perform on one another ie data. Access control mechanism assign security labels in different ways and the mechanism should cover the protection of data as a whole that is unauthorised viewing, modification, or copying of data. Furthermore a good access control mechanism will help limit malicious code execution or unauthorised actions.

Mandatory Access Controls (MAC)

Mandatory Access Control ensures the enforcement of a security policy predefined by which all subjects and objects are controlled. MAC focuses on giving rights to administrators. MAC secures information by assigning sensitivity labels on information and comparing this to the level of sensitivity a user is operating at. Generally MAC access control mechanisms are more secure than DAC, although at times MAC can be too restrictive for some circumstances. MAC mechanisms assign a security level to all information, a security clearance to each user, and ensure that all users only have access to that data for which they have clearance. MAC is usually appropriate for extremely secure systems such as multilevel secure military application.  MAC access control usually has the following attributes:

Administrators, not data owners make changes to a resource’s security label

A security label on the data is on a level which reflects its sensitivity, confidentiality and protection value. ie no use assigning high security to a program such as Microsoft Word which everyone has access to.

There is a hierarchy in the classification of protection level, a high level classification can read lower level secured data.

All users can write to a higher classification but users can only have read/write access to objects of the same classification.

A schedule or time of day restriction can be placed upon objects. (Chapter 8.  Access Control and Authorization, 2006)

Discretionary Access Controls (DAC)

Discretionary Access Control is a way of restricting access to information depending on the identity of users and/or membership in certain groups. Access is granted upon the credentials he/she presents at the time of authentication, such as usernames passwords. In the majority of DAC models the owner of the information or data is able to change its permissions at his/her own judgment. DAC has the disadvantage of not be able to centrally manage a system. A DAC system usually has the following attributes

Data Owners can transfer ownership of information to other users.

Data Owners can determine the type of access given to other users (read, write, copy, etc.) such as in a home network.

Repetitive authorization failures to access the same resource or object generates an alarm and/or restricts the user's access

Users who do not have access to information should not be able to determine its characteristics (file size, file name, directory path, etc.)

Access to information is determined based on authorizations to access control lists based on user identifier and group membership.

References

Deitel, H.M., Deitel, P.J., & Choffnes, D.R. (2004). Operating systems. (3th ed.). Englewood Cliffs, New Jersey: Prentice-Hall.

No author( 2006) Chapter 8.  Access Control and Authorization retrieved Sepember 29, 2006 from http://www.cgisecurity.com/owasp/html/ch08.html

What is Mobile Computing?

Mobile computing is becoming an increasingly important in daily life whether personal or business, but what is it? Furthermore why do people want it and what are its benefits? It shapes millions of lives everyday, opening the door to Communication, Information and Productivity which is no longer restricted to the home or office. In today’s society it is already a prominent factor but what does the future hold? Major businesses are gearing towards better efficiency and performance, longer power life and true-mobility. What is mobile computing? Mobile computing is an industry that touches millions of people everyday, whether its business solutions such as access to a company’s database wherever their employees are, or for personal use like browsing the internet whilst dining out. It has a wide range of applications that help people organise their lives, work whilst on the move and communicate wherever they are. Typical mobile computing devices range from Laptop computers with wireless local area networks (WLAN), mobile phones and personal digital assistants (PDA’s) which incorporate Bluetooth technology. Mobile computing is the ability to access information resources whilst away from the home or office desk.

What does mobile computing encompass? As stated previously mobile computing incorporates many devices including laptop computers, PDA’s, mobile phones and pagers. Essentially a mobile computing device is any device which is able to be transported with relative ease and uses a computer to carry out its tasks. However this is not the only thing which makes them a ‘mobile’ computing device. In order for a device to be a truly useful mobile tool it was found by Caldwell and Koch (p. 6) that they needed to be supplemented with other technology which allows them to be used in a mobile context: It became evident that high speed networks and information storage systems are important complementary technologies. In fact, it is the ability of organizations to connect portable PC’s to reliable high speed networks and access to corporate databases from remote locations that has made mobile computing the valuable tool that it is. Without these technologies supporting mobile devices, the devices themselves would be little better then their more fixed counterparts such as PC’s. In fact they would be less useful due to their lesser power capability.

Why mobile computing? The reasons for society’s desire for mobile computing are diverse. All the reasons end up boiling down to making life easier and more efficient; the main difference is what aspect of life is being made easier.

Mobile Computing Accompanying Technology

Accompanying technology? Mobile computing encompasses not only the devices but also the accompanying technology which allows them to function efficiently. A few examples of such technology are WLAN’s and Bluetooth technology. WLAN (wireless local area network) A WLAN is the same as a LAN (local area network) as such that it allows users access to the internet and communicate with others in the Network. WLAN is a replacement for office cabling which introduces numerous benefits over traditional LAN’s. Schiller (2003, p. 201) points out these benefits as being: • Flexibility whilst within the WLAN coverage. Traditional wired LAN’s still restrict where you can connect to the network and also firewalls (real firewalls such as brick walls not routers) can cause problems. With a WLAN you can connect to the network anywhere within their coverage, be that building or campus or single rooms. • No required planning, wired LAN’s need wiring plans, additional cabling with the correct plugs and switches whilst WLAN’s are able to by pass these and allow for communication without previous planning. They can be set up easily after the building is finished and do not need to be installed in the very beginning, or be installed later at major costs. • WLAN’s can survive disasters such as cabling being broken or an earthquake. If the wireless devices survive then people can still communicate. In a wired system, if part of the cabling fails for any reason it can cripple all communication. • The cost is much lower then wiring in a network as additional users to the network can be added easily without major costs involved. Adding to an existing wired network can have huge costs due to having to run new wires through existing walls and installing the plugs and switches associated.

WLAN is one of the most efficient and flexible mobile computing solutions around. However it does have disadvantages from LAN’s. These points have been identified by Schiller (2003, p. 202) as: • Lower quality, due to the lower bandwidth available with radio transmissions compared to wired transmissions. The bandwidth is 1-10Mbit/s user data rate compared to 100-1000Mbit/s in wired networks. As well as higher error rates due to interference which then incorporates higher delay because of the error detection mechanisms. • Standards are still being worked out and differ in different areas around the world causing problems. It is hard to establish global solutions due to these inconsistencies. • Security is a big disadvantage as radio waves for data transmission are able to get interfered with easily by other high-tech equipment. It is also much easier to eavesdrop in on a WLAN system, and all standards must offer encryption, privacy and anonymity mechanisms.

Bluetooth Bluetooth technology was introduced into the mainstream market a few years ago to deal with the interconnection between smaller mobile computing devices such as mobile phones. An article published by Phillips Business Information's Communications Standards News (1999) stated The Bluetooth technology is a specification covering small form factor, low-cost, wireless communication for networking between PCs, mobile phones and other portable devices. It is claimed that the Bluetooth technology will at re-define the personal communications market by expanding the capabilities of mobile devices and making these devices work better together. According to market research firm Cahners In-Stat Group, there will be over 670 million Bluetooth enabled devices worldwide by 2005. Bluetooth enabled devices are able to connect together and work in union. An example of Bluetooth technology is in Car kits. Bringing a Bluetooth enabled phone within the car will make it automatically connect with the Car kit and when a call is received it will allow hands free communication. The network or area under Bluetooth is relatively small and designed for smaller Mobile computing devices.

Mobile Computing: Business Perspective

From a business perspective the main goals of incorporating mobile computing into the company are

1. Improving customer service
2. Reducing cycle time and speeding decision making
3. Attracting and maintaining a high quality workforce
4. Knowledge management and exchanging best practices.

In business a major factor is giving employees flexibility in how and when they work. Improving customer service relates to communicating faster and more clearly with clients, being able to go to clients and complete the work with direct contact and also being able to build a team who are in different locations but are still able to work effectively together.

Mobile computing reduces cycle time and speeds decision making by allowing employees to access information and business services more frequently and away from the desk. There is no longer any delay by having to wait until your employees are back in the office before they can get required information or start on a project. Mobile computing allows them to access online resources, company databases and communication lines with ease away from the office PC.

It has been found that some businesses used mobile computing as a tool for attracting high level and professional employees stated that from their study: A number of companies reported that they used mobile computing as a tool for attracting workers. The three companies designed around mobile computing were most explicit in this. In these firms individuals were hired with the assumption that part or all of their work would be done either in their homes or in clients' facilities. This highlights how people value being able to work with more flexibility and how potential employees prefer to have the option mobile computing provides. Companies are keying into this and are offering mobile computing as an incentive to get highly skilled workers.

Knowledge management has been cited as a reason company’s are moving towards mobile computing. The argument is that it makes it easier for workers to have access to previously done assignments and jobs, these knowledge repositories according to often contain ‘reusable’ pieces of work and the expertise of the company. Another reason was the sharing of information between colleagues, though in practice mobile computing only seems to help with the organization of face to face meetings in which ideas are shared.

Mobile Computing in the Future

Mobile computing is already making a huge impact in society, why? Because as points out “one great thing about mobile devices is how they appeal to both personal and professional users” Microsoft's Bill Mitchell, vice president, mobile platforms division stated “Market research indicates that mobile computing is growing 15 percent more than computing in general.” Big businesses are gearing up to bring mobile computing to a new level. Major computing businesses such as Microsoft, Intel, IBM and telephone companies Nokia, Ericsson and Motorola Inc are not only researching and developing their own devices and improvements in mobile computing but are also joining together to promote it. (Phillips Business Information's Communications Standards News, 1999) stated thatThe five founding companies of the Bluetooth Special Interest Group - Ericsson, IBM Corporation, Intel Corporation, Nokia and Toshiba Corporation - announced on December 1 at their Santa Clara meeting that 3Com Corporation, Lucent Technologies, Microsoft Corporation and Motorola Inc. will join them to form the Promoter group of the Bluetooth SIG. The Bluetooth Special Interest Group (SIG) was formed in 1998 and wishes to revolutionise connectivity for personal and business mobile devices. Goals for the future Intel and Microsoft have firmly expressed their views on where they believe the future of mobile computing is. Microsoft is pushing for ultra mobile computing and according to “Microsoft's newest mission is pushing for a Mobile PC for every person. These are not run-of-the-mill laptops or desktop replacements. Microsoft is aiming for broad, general acceptance of a whole new category of carry-everywhere, always-connected computing devices with batteries that last all day long.” Battery power is a major point for the future of mobile computing. For truly useful mobile devices you need them to last all day and Microsoft and Intel are both putting a lot of effort into achieving this outcome. Intel’s plans for the future include improving four key requirements in their mobile devices. These being: “integrated wireless LAN capability, breakthrough mobile performance, extended battery life and thinner, lighter designs.” (M2 Presswire, 2003) Intel have an agreement with “Matsushita Battery Industrial (MBI) to jointly develop more powerful battery technology to support the vision for "all-day computing" for future Intel Centrino(TM) mobile technology-based platforms.” (M2 Presswire 2005) Intel believe that adoption of wireless broadband services coupled and new energy-efficient and higher- performing developments in mobile devices are signalling the beginning of "mobility ubiquity" according to Intel's top executive responsible for mobile computing. This mobile ubiquity offers the industry substantial new growth opportunities. (M2 Presswire 2005) Microsoft has identified for itself the next 3 factors that it wishes to overcome so they can progress forward into the future, the factors they wish to over come are “form factors, battery life and time to access.” (Techweb, 2005)

From this we can conclude that the mobile computing industry will have an even greater impact on our daily lives. Already presented with so many possibilities, and with more coming every year the industry is booming. Big company’s are putting a lot of time and money into the production and research of mobile computing and for the moment it looks set to carry on sweeping the way with new innovative connect ability and performance. The future of mobile computing looks set upon longer battery life, power efficiency, performance and power innovation. References

• Bayne, K.M. (2002). Marketing Without Wires. New York: John Wiley & Sons, Inc.
• Schiller, J. (2003). Mobile Communications (2nd Ed.) London: Pearson Education Limited
• Caldwell, D. & Koch, J.L. (n.d.) Mobile computing and its impact on the changing nature of work and organizations Retrieved May 15, 2005, from http://sts.scu.edu/research/MobileComputing.pdf
• Microsoft Corp. (2005, April 26). Microsoft pushes ultra mobile computing. TechWeb, 1, Retrieved May 15, 2005, from ProQuest Database
• Maloney, S. (2005). INTEL: Innovation in mobility, ubiquitous wireless broadband to drive opportunity. M2 Presswire, 1, Retrieved May 20, 2006, from ProQuest Database
• Chandrasekher, A, (2003, September 17). INTEL: Innovation in mobility, ubiquitous wireless broadband to drive opportunity. M2 Presswire, 1, Retrieved May 20, 2006, from ProQuest Database
• (1999, December 20) Bluetooth technology set to re-define the personal communications market. Phillips Business Information's Communications Standards News, 1, Retrieved May 20 2006, from ProQuest Database
• No author. (2002). Wireless and mobile computing. Department of Information Resources. Retrieved May 15, 2005 from http://www.dir.state.tx.us/pubs/wireless/wireless.htm