Security Engineering - Part 1

I recently discussed with my publisher whether we should produce a second edition of my book `Security Engineering' soon (e.g., 2004). We decided not to, as so much is happening at present with issues such as Trusted Computing. It seems best to let things settle before doing a thorough revision.

This page therefore contains new material and links for part 1, whose six chapters cover basic information security technology such as protocols, passwords, access controls, cryptology and distributed system mechanisms. For reference, here are the the foreword, the table of contents, and the bibliography. The errata for the print version are at the end.

New material and links

Social engineering: This subject, which I tackle in chapter 3, has got much more prominent lately. Kevin Mitnick's new book, The Art of Deception, is a tour de force: it describes many ways in which system security can be defeated by people telling lies on the telephone. I learned a lot from it; so did other old lags who've read it. (A word of warning, though: don't believe the countermeasures he suggests in chapter 16. These amount to implementing multilevel security in your company, and that doesn't even work well in the military - see chapter 7 of my book.)

Social engineering has been around for a long time: there is a CERT advisory going back to 1991. I first realised the scale of the problem in 1996 when I was working on medical security. I wrote a policy for the British Medical Association on disclosure of personal health information over the telephone - basically, that if someone pretending to be a doctor calls and asks for someone's medical record, the request should be logged and the called authenticated by calling him back at a number found in an appropriate phone book. When this was implemented in a trial at an English health authority, we found that 20-30 false pretext phone calls were being made each week. At that time, there were about 200 health authorities in the UK; multiply it up, add in the calls made to family medical practices and hospitals, and it's clear that there is a problem. However, we were unable to persuade the National Health Service to do anything about it; they found the result embarrassing and preferred to pursue established civil service security doctrine.

Since then, press interest has grown slowly. Some companies, like IBM, advertise their skills at social engineering as a way of selling consultancy. There are advisory web pages run by organisations like Symantec, as well as `how-to' pages run by the other side. But it's important to remember that social engineering isn't just a hacker pastime, but one of the main investigative tools used by private detectives. The facility they provide can be abused: in one incident, a murderer hired a private eye to locate his victim, and this was done using classic false-pretext phone calls.

Electronic security in cars: this is becoming a serious problem as electronic protection mechanisms proliferate, and their features interact. In chapter 2 I describe remote key entry devices, while in chapter 10 I go into alarm systems and tachographs. A modern car may have several dozen processors, which have an interesting mix of security and safety properties. There has been a report of one driver's key fob activating the alarm on a car belonging to someone else - who didn't even realise he had a car alarm. According to another news report, Thailand's finance minister was trapped in his BMW when its computer crashed, locking the doors and windows; had he not persuaded someone to break the window, he would have suffocated. There are also issues with systems that track hijacked vehicles, with the interaction between security and monitoring systems, and between protection systems and operational systems such as ABS and traction control. A privacy lawsuit was brought in the USA after a rental car company penalised drivers for speeding using GPS data. In Norway, mandatory tracking devices on expensive cars have undermined their sales because drivers don't want speeding tickets. As a result of such problems, the world's first conference on electronic security in cars is being organised in Bochum on the 18-19 November 2003. I expect that in time this will develop into a book chapter on its own.

Authentication protocols: There is more material on how remote garage door openers work in the report of a recent lawsuit in which the maker of compatible door-openers was sued under the DMCA. The transmitter sends an encrypted serial number, which is three times the previous serial number. The anti-replay mechanisms are described, and their design also has to cope with openers that have been pressed a number of times away from the site (e.g., bumped against keys in your pocket).

Windows security: this has developed considerably since the brief account I gave in chapter 4. There are now NSA Guides that explain how to configure various windows products more securely. The next version of Windows should include trusted computing features which are somewhat controversial; they will support stronger digital rights management, and will also make it easier for vendors of Windows applications to lock in their users. The rights management mechanisms (a version of which are already shipping with Windows Server 2003) can be used to lock down application data, with a policy such as `this file may only be decrypted by a genuine, paid-for version of Office'. This may move the PC world towards the games console business model, in which application profits can be used to subsidise platform sales, and rights management mechanisms can be used for accessory control. Whether `trusted computing' works may depend on whether Microsoft's developers can defeat problems such as kernel bloat that I describe in chapter4, and whether it can actually deliver any real benefits to users may depend on the practicalities of using mandatory access control, which I discuss in chapters 7 and 8.

Cryptography: at the time my book went to the printers, the results of the Advanced Encryption Standard competition had just been announced. AES is now a Federal standard - FIPS 197. Since then there has been a burst of secondary standardisation work, leading for example to new recommendations on modes of operation, and a number of proposals that may end up in the next round of recommendations. NIST has already formalised a version of counter mode encryption, which I described in section 5.5.4 but was not at that time standardised. As this is a stream cipher, it is of course vulnerable to attacks in depth, and people are starting to use it with HMAC for integrity assurance.

Venona: This was a project in which US and UK intelligence agencies deciphered Soviet wartime diplomatic traffic, and which is mentioned on p 85, now has a splendid home page. There is also a book, Venona: Decoding Soviet Espionage in America by Harvey Klehr and John Earl Haynes. This provides a good object lesson on what can happen when you don't take care to prevent attacks in depth.

Errata

Return to Ross Anderson's home page