{"id":2087,"date":"2009-04-23T03:07:11","date_gmt":"2009-04-23T10:07:11","guid":{"rendered":"https:\/\/svapm.org\/?p=2087"},"modified":"2019-08-07T14:31:46","modified_gmt":"2019-08-07T21:31:46","slug":"technical-security-controls","status":"publish","type":"post","link":"https:\/\/svapm.org\/?p=2087","title":{"rendered":"Technical Security Controls"},"content":{"rendered":"
\"Secure<\/a>
Secure via Flickr by kreg.steppe<\/figcaption><\/figure>\n

There is a lot to talk about with regard to technical security controls, aka the \u201csexy stuff\u201d like firewalls and IDS.\u00a0 So rather than bore you with technobabble (in Scrappy Information Security<\/em>, I start boring you with packets, headers, ports & MACs as a way of introducing how the Internet works), I will instead focus on an explanation of encryption.<\/p>\n

Why encryption?\u00a0 Because it is no exaggeration to say that secure online anything that involves money or personal information could not happen without encryption.\u00a0 Further, secure remote access\u2014used by corporate road warriors\u2014would not be possible without encryption.\u00a0 And increasingly, encryption is being used to keep private data private when \u201cat rest,\u201d that is, when sitting in a file on a database somewhere.\u00a0 So there is a good chance that your project may rely on it.<\/p>\n

Technology aside, encryption is really nothing more than the use of a secret code to hide information from the people to whom you wish to keep it secret.\u00a0 In this case, though, it is an example of hiding something \u201cin plain sight.\u201d\u00a0 The bad guys can see it.\u00a0 They can hold it in their hands.\u00a0 They just can\u2019t read it.\u00a0 One of the first documented proponents of encryption was Julius Caesar.\u00a0 According to legend, he employed what has come to be known as the \u201cCaesar shift.\u201d\u00a0 When he needed to send a secret message to one of his field generals, he would shift the letters in the message three places to the right.\u00a0 So \u201cfight now\u201d became \u201ccfdeq klt.\u201d\u00a0 Though simplistic by today\u2019s standards, the Caesar shift worked, ostensibly because there were no web-based articles on \u201cBreaking Caesar\u2019s Code,\u201d and also because many people of the time were illiterate.<\/p>\n

Although the creation of a good cryptosystem quickly becomes very complicated, the above historical anecdote references the two components needed: the algorithm and the variable.\u00a0 The algorithm is a formula\u2014a series of steps\u2014that must be followed to turn the plain text into cipher text, and vice versa.\u00a0 The variable is the secret key to the formula.<\/p>\n

In the Caesar example, the algorithm is to simply put two alphabet strings on top of each other:<\/p>\n

a b c d e f\u00a0 g h i\u00a0 j k\u00a0 l\u00a0 m\u00a0 n o p q r s\u00a0 t\u00a0 u\u00a0 v w x\u00a0 y z
\nA B C D E F G H I J K L M N O P Q R S T U V W X Y Z<\/p>\n

Without a mono-spaced font, it’s hard to get them to line up.\u00a0 But you get the idea.<\/p>\n

The key is to shift the lower alphabet three places to the right:<\/p>\n

a\u00a0 b c d e f\u00a0 g\u00a0 h i\u00a0 j\u00a0 k\u00a0 l m n o p q r\u00a0 s t\u00a0 u v w x y\u00a0 z
\nX Y Z A B C D E F G H I J K L M N O P Q R S T U V W<\/p>\n

This method of encryption is called symmetric encryption, since the same key encrypts and (when applied in reverse) decrypts.\u00a0 Symmetric encryption is used today, though, not surprisingly, the algorithm is much more complex and the key is longer.<\/p>\n

Symmetric encryption is used because it is quicker.\u00a0 Unfortunately, symmetric encryption suffers from three primary drawbacks:<\/p>\n

1. Key exchange can be problematic.\u00a0 In short, you and I have agreed to use the alphabet-shift method to encrypt our communications.\u00a0 Before I send you a message, I decide that the letters should be shifted eight places to the right.\u00a0 How exactly do I get this information to you?
\n2. Key management becomes difficult as the system grows.\u00a0 Let us say I have a lot of friends I want to exchange information with.\u00a0 Not only do I want to keep the information safe from the outside world, I also don\u2019t want the other members of my circle to eavesdrop on my communications with any one of them.\u00a0 So when I communicate with Bob, we agree to shift the alphabet one place to the left.\u00a0 With Mary, it is two.\u00a0 (We have to assume that no one in the group is smart enough to try various shifts on any intercepted messages not bound for them.)\u00a0 Remembering \u201cBob \/ one,\u201d \u201cMary \/ two\u201d is easy enough.\u00a0 But managing the various keys grows more complex as my circle of correspondence grows.
\n3. It cannot be used for other important facets of secure communications, such as authentication (I am who I say I am) and non-repudiation (I cannot tell a lie; it was me who sent that email).<\/p>\n

Recognizing these limitations, two really smart guys\u2014Whitfield Diffie and Martin Hellman, to give credit where it is due\u2014developed a new system called asymmetric encryption.\u00a0 Asymmetric encryption uses very high-level math, involving prime numbers on the order of 100 to 200 digits, raised to powers and run through other mathematical blenders.\u00a0 What comes out of these calculations are two related numbers.\u00a0 One of the numbers easily can be derived if you know the other.\u00a0 But trying to reverse the calculation is for all intents and purposes mathematically impossible.<\/p>\n

A commonly offered analogy is the dropping of a glass.\u00a0 Dropping a glass very easily creates thousands of small pieces.\u00a0 Recreating the glass from those scattered pieces, while theoretically possible, is extremely difficult and ultimately probably is not worth the effort.\u00a0 I would offer the following as another real-world example.\u00a0 With a recipe in your hand, you ostensibly could whip up a batch of Coca Cola in your kitchen.\u00a0 But try starting with the bottle of Coke, and determining all of the ingredients.\u00a0 Pepsi certainly has not been able to do it yet.<\/p>\n

So what is the significance of these two numbers?\u00a0 They are used to create a pair of keys: One public and one private.\u00a0 I place my public key literally \u201cout there,\u201d for anyone and everyone to use to send me a message.\u00a0 Actually, anyone who wishes to exchange confidential information puts their public key out there in a centrally-located place, called a certificate authority, or CA.\u00a0 When someone uses my key to encrypt a message to me, it is dropping the glass.\u00a0 When I receive the message, I use my private key\u2014a glass-restoring magic spell, if you will\u2014to decrypt it.\u00a0 If someone intercepts the message and does not have my private key, he must reassemble the glass with tweezers and glue.<\/p>\n

As you probably can extrapolate, this system is called public key cryptography.\u00a0 In contrast, the use of a symmetric key sometimes is called private key cryptography.<\/p>\n

So if asymmetric cryptography is so good, why would anyone use symmetric cryptography?<\/p>\n

As touched on earlier, longer keys lead to messages which are \u201cbetter\u201d encrypted, that is, harder to break.\u00a0 With asymmetric encryption, because there exists a mathematical relation between the two numbers, they must be very large in order to result in a sufficiently strong key.\u00a0 Longer keys require more time to encrypt and decrypt.\u00a0 If you are sending an encrypted email to someone, a few extra seconds probably will not concern you.\u00a0 But if you are using encryption to secure an ongoing communication\u2014such as an online banking session or an online purchase\u2014the latency period can become troublesome.\u00a0 As such, a common trick is to use public key cryptography to agree on a symmetric key, and then use that symmetric key for all further conversation in that session.<\/p>\n

As a way of conclusion, I would say that cryptography is perhaps the most challenging concepts in information security.\u00a0 But it is everywhere, and in the future will only be more everywhere.\u00a0 As such, an understanding of the basic principles is important.<\/p>\n","protected":false},"excerpt":{"rendered":"

There is a lot to talk about with regard to technical security controls, aka the \u201csexy stuff\u201d like firewalls and IDS. So rather than bore you with technobabble (in Scrappy Information Security<\/i><\/a>, I start with packets, headers, ports & MACs as a way of introducing how the Internet works), I will instead focus on an explanation of encryption. <\/p>\n","protected":false},"author":1483,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"give_campaign_id":0,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[2,20,9,1],"tags":[581,579,578,572,571,582,261,570,580],"class_list":["post-2087","post","type-post","status-publish","format-standard","hentry","category-leadership","category-quality","category-risk-management","category-miscellaneous","tag-asymmetric-cryptography","tag-caesar-shift","tag-encryption","tag-infosec","tag-michael-seese","tag-public-key","tag-scrappy","tag-scrappy-information-security","tag-symmetric-encryption"],"aioseo_notices":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/svapm.org\/index.php?rest_route=\/wp\/v2\/posts\/2087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/svapm.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/svapm.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/svapm.org\/index.php?rest_route=\/wp\/v2\/users\/1483"}],"replies":[{"embeddable":true,"href":"https:\/\/svapm.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2087"}],"version-history":[{"count":1,"href":"https:\/\/svapm.org\/index.php?rest_route=\/wp\/v2\/posts\/2087\/revisions"}],"predecessor-version":[{"id":14208,"href":"https:\/\/svapm.org\/index.php?rest_route=\/wp\/v2\/posts\/2087\/revisions\/14208"}],"wp:attachment":[{"href":"https:\/\/svapm.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/svapm.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/svapm.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}