University of Wolverhampton School of Technology
Total Page:16
File Type:pdf, Size:1020Kb
University of Wolverhampton School of Technology Developing a Concept for Handling IT Se‐ curity with Secured and Trusted Electronic Connections Volker Hockmann, Dipl.W.‐Inf. (FH), M.Sc. A thesis submitted in partial fulfilment of the requirements of the University of Wolverhampton for the degree of Doctor of Philosophy This work or any part thereof has not previously been presented in any form to the University or to any other body whether for the purposes of assessment, publica‐ tion or for any other purpose (unless otherwise indicated). Save for any express ac‐ knowledgements, references and/or bibliographies cited in the work, I confirm that the intellectual content of the work is the result of my own efforts and of no other person. The right of Volker Hockmann to be identified as author of the work is asserted in accordance with ss.77 and 78 of the Copyright, Designs and Patents Act 1988. At this date copyright is owned by the author. 17.06.2014 Signature: Date 2 Abstract In this day and age, the Internet provides the biggest linkage of information, per‐ sonal data and information, social contact facilities, entertainment and electronic repository for all things including software downloads and tools, online books and technical descriptions, music and movies – both legal and illegal [Clarke, 1994]. With the increasing bandwidth in the last few years worldwide, it is possible to ac‐ cess the so‐called “Triple‐Play‐Solutions” – Voice over IP, High‐Speed‐Internet and Video on Demand. More than 100 million subscribers have signed on across Asia, Europe, and the Americas in 2007, and growth is likely to continue steadily in all three. As broadband moves into the mainstream, it is reshaping the telecommuni‐ cations, cable and Internet access industrie [Beardsley, Scott and Doman, Andrew, and EdinMC Kinsey, Pär, 2003]. Cisco [Cisco, 2012], one of the biggest network companies, will expect more than 966 exabytes (nearly 1 zettabyte) per year or 80.5 exabytes per month in 2015 and the “Global IP traffic has increased eightfold over the past 5 years, and will increase fourfold over the next 5 years. Overall, IP traffic will grow at a compound annual growth rate (CAGR) of 32 percent from 2010 to 2015”. More and more types of sensible data flow between different recipients. News from around the world are transferred within seconds from the one end to the other end of the world, and affect the financial market, stock exchange [Reuters, 2012] and also bring down whole governments. For instance, worldwide turmoil might ensue if a hacker broke into the web‐server of an international newspaper or news channel like N‐TV in Germany or BBC in England and displayed messages of a political revolution in Dubai or the death of the CEO from Microsoft or IBM. A very significant percentage of the population in developed and developing countries is using wired and wireless connections for reading e‐mails, accessing news‐groups or using Internet banking. All these services run on a web‐server. Most web‐servers run the Apache or the Microsoft Internet Information Server (IIS). All versions of both of these servers (Apache 1.3.x/2.x and IIS 3‐7.5) [Netcraft, 2006] are particularly vulnerable against a variety of attacks [SANS, 2006]. An attacker is, with little effort, in a position to break into many web‐servers in‐ cluding the Internet Information Server, and Apache server, the most popular web‐ servers [Netcraft, 2012]. Ellison and Schneier [2000, p. 6] note that “Certificates must be used properly if you want security. Are these practices designed with solid security reasons, or are they just rituals or imitations of the behavior of someone else? Many such practices and even parts of 3 some standards are just imitations which, when carefully traced back, started out as arbi‐ trary choices by people who didn’t try to get a real answer.” However, the web‐servers and services are vulnerable against attacks and data spoofing and manipulating. Companies, government and private households are dependent on the broadband connections. Companies offer or use services for broadband connections like video on demand (e.g. Maxdome, Videoload or iTunes) and VoIP (e.g. easybell, Sipgate or Bellshare) for conferencing (e.g. Skype) or private consumers (movies and online games), or they offer services which are essential for other companies and people. For exam‐ ple online banking, stock exchange or medical equipment like one of the biggest and most expensive projects in Germany; the implementation of the health insur‐ ance card for all people who are required to join a health insurance scheme. All these different services have a common feature – they all work with a very high data volume, and the companies need to have faith in the incoming information. The aim of this thesis is to identify how data connections can be secured and sys‐ tem validity guaranteed. One of the most important questions is whether the man‐ agement of German companies (small‐sized, medium‐sized to major enterprise) understand the importance of IT security and whether the technical staff (e.g. ad‐ ministrator) as well as the person responsible for the implemented business proc‐ esses (e.g. IT security manager) got the appropriate background, rather than only a technical view. Kevin Mitnick [Barnes, 2004], one of the most well‐known hackers, pointed out that “Security is always going to be a cat and mouse game because thereʹll be people out there that are hunting for the zero day award, you have people that donʹt have configura‐ tion management, donʹt have vulnerability management, donʹt have patch management...”. The second part of this thesis discusses the hardening and securing of services and systems. In the third part, a case study illustrates the issues. The main focus is on the Ger‐ man health card and the security mechanisms in this project. This part should make clear why it is so important to secure the data connection and to guarantee that the incoming data really comes from the sender and the receiver. How is it possible to establish a data connection between two or more machines or services? In a high security environment like the Telematik1 infrastructure or a Stock Ex‐ 1 See also: http://www.gematik.de/cms/de/egk_2/telematikinfrastruktur/telematikinfrastruktur_1.j sp 4 change, it is essential to ensure and verify the data. It may be the worst case sce‐ nario if a hacker was in a position to manipulate data in that network, with the re‐ sult that the trust of the population might be irretrievably lost. 5 Contents Part 1 – The Beginning of IT Security and Securing Web Services and Web-Servers ................... 16 1 Introduction ........................................ 17 1.1 Research Questions ............................. 18 1.2 Aims and Objectives of the Study ............... 19 1.3 Research Contribution .......................... 21 1.4 Summary of Research Approach and Methodology ... 21 1.5 Thesis Structure ............................... 23 2 Literature Review of IT Security and Cryptography and its Role in Companies and Network Connections............... 24 2.1 The Fundamental Definition of Security: The History 25 2.2 First Attacks against Services into the ARPA and the Internet .............................................. 27 2.2.1 The Kevin Mitnick - Tsutomu Shimomura Affair 27 2.2.2 The Morris Worm Attack ...................... 28 2.3 Hacker, Cracker and Attacker ................... 28 2.4 Social Engineering: Human Factor – Human Failure 30 2.5 Web Service – Server Security: An Introduction . 31 2.5.1 Definition of Web Service ................... 31 2.5.2 Definition of Web-Server/Application Server . 32 2.5.3 The Fundamental Identification Problem ...... 34 2.5.4 First Results of the Beginning of IT Security 35 2.5.4.1 Stateful Inspection....................... 35 2.5.4.2 Stateful Packet Inspection (SPI).......... 36 2.5.4.3 Application-Gateways...................... 36 2.5.4.4 Secure Socket Layer SSL and TLS........... 36 2.6 Security Approaches: Their Potential Effectiveness and Applicability for this Research ................... 38 2.7 Cryptography and Network Security .............. 39 2.7.1 Definition Public Key Infrastructure PKIX X.509 (PKIX) 40 7 2.7.2 Problem Definition of a PKI Environment – Validation of a Certificate ......................... 41 2.8 Similar Techniques comparable to OCSP .......... 42 2.8.1 The RosettaNet and EDIFACT/EDIFICE I ........ 42 2.8.2 One-Time-Password ........................... 42 2.8.3 Microsoft Passport-Netzwerk ................. 43 2.9 The German Health Card Project ................. 43 2.10 Triple Play Solutions .......................... 44 2.10.1 Triple Play Services ........................ 44 2.10.2 The Fundamental 3PS Problems ................ 46 2.11 Final Consideration and Outcome of this Thesis . 46 Part 2 – Research Details ...................... 48 3 Research Strategy ................................... 49 3.1 Philosophical Worldviews or the Research Paradigm49 3.1.1 Ontology Aspect ............................. 50 3.1.1.1 View on Information and Data.............. 51 3.1.1.2 View on Information System................ 52 3.1.1.3 View of Human Beings...................... 52 3.1.1.4 View on Technology........................ 52 3.1.1.5 View on Organisations and Society......... 52 3.1.2 The Epistemological Aspect .................. 53 3.1.3 Ethics – The Human Nature Aspect ............ 53 3.1.4 Research Methodology Aspect ................. 54 3.2 Research Methods ............................... 54 3.2.1 Survey Research ............................. 56 3.2.2 Laboratory Experiment ....................... 56 3.2.3 Action Research ............................. 56 3.2.4 Triangulation or Multi-Trait and Multi-Method 57 3.2.5 Case Study .................................. 58 3.3 Research Conclusion and the Chosen Research Method for this Thesis ....................................... 59 4 Survey Research ..................................... 64 4.1 Research Questions ............................. 64 4.2 Survey Research Methodology .................... 66 8 4.3 The Design of the Questionnaire ................ 67 4.4 Aims, Assumptions and Target Group ............. 68 4.5 Survey Statistics and Execution ...............