*****  Computer Select, March 1994  : Articles *****

Journal:    Computer Shopper  March 1994 v14 n3 p594(4)
COPYRIGHT Coastal Associates Publishing LP 1994
-------------------------------------------------------------------------
Title:     Digital crime watch.
             (developing an effective security system)(includes related
             article on cryptography)
Author:    Labadie, Horace


Abstract:  A guide to building an effective microcomputer security system
           that will protect a network from unauthorized use and other
           problems is presented. The manager should draw up a security
           plan that considers how sensitive data is and who might want
           to steal it. Good security is usually composed of multiple
           levels. A disk-locking program or screen and keyboard locker
           will keep unexpected visitors from viewing data. Locking
           utilities work by modifying the DOS file allocation table to
           make files invisible to the operating system or moving them to
           a hidden location. Disk locking on networks is more complex
           but equally effective. All security programs provide a
           management tool, usually giving a system administrator power
           to add or delete users, change passwords and set user
           privileges. Shell programs manage access to the operating
           system and simplify microcomputer use; many shells can be
           configured to load at boot time and limit application access.
           Hardware security tools can prevent systems from booting from
           an unauthorized floppy or manage access with small encoded
           cards. Passwords, audit trails and application backdoors are
           discussed.
-------------------------------------------------------------------------
Full Text:

When your computer is out of your sight, it is out of your control. Even
a trip to the repair technician's shop puts your data at risk. Your
computer can contain important information, such as records of your bank,
credit card, or brokerage accounts. Therefore, single users must ensure
that others don't help themselves to private information, and network
administrators must control access for every network user and keep out
unauthorized hackers.

Below you'll find a brief blueprint for an effective security system,
from the standpoint of both the lone user and the network administrator.
While it's true that no security system is perfect, implementing the
suggestions below will at least make unwanted tampering more difficult
than it's worth in most cases.

Security Plans

The first step is to draw up a security plan, even if it's only in your
head. The best security is in-depth, comprised of multiple levels. Never
rely on one means of security alone. Security measures should be varied
and independent of one another.

You can almost view designing your security plan as a game: Your
adversary is trying to trespass into your territory and you must put up
as many obstacles as you can. Good security imposes a substantial penalty
on the adversary, a penalty measured in expended resources. A PC
snooper's most precious resource is time. The longer it takes for the
opponent to outwit security measures, the more likely that system
operators will catch the intruder.

You also must judge the sensitivity of your data. How much trouble would
its disclosure cause? What type of fiend would want to gain access to it?
The answers to those questions determine the level of security. If you're
involved with a network, you also need to figure how much security will
be tolerated by its users. Allow for mistakes. A level of tolerance will
strengthen, not weaken, security. The most appropriate level of security
for any system is not always the highest, but that which balances the
perceived threat against the needs of the legitimate users.

Levels of Security

For the single user, an obvious and effective first step is a
disk-locking program or a screen and keyboard locker that will keep data
safe from unexpected visitors while you're away.

Locking programs make files, directories, or whole disks invisible to the
operating system--and therefore inaccessible to normal OS functions. Each
program uses its own strategy to achieve its ends. The simplest way to
make a file invisible is to use the DOS ATTRIB function to enable the
file's Hidden parameter. This prevents the file from appearing in
response to the ordinary DIR command. However, if the /A switch is added
to the DIR command, the file becomes visible.

Another way is to remove the filename from the File Allocation Table
(FAT), in which the OS stores every file's physical location on the disk.
In essence, this is what is done when a file is erased by the operating
system. Usually, erasing a file only causes its name to be altered in the
FAT. The alteration alerts the OS that the space occupied by the file can
be reused. But until the space is written over, the old information
remains intact. Simple erasure can be repaired by restoration of the
filename in the FAT.

Naturally, when you lock a file, you seek to prevent its deletion, so the
file-locking software also must notify the OS that the space used by the
file is still occupied, and it must keep track of that information in
case of accidents. For users wary of any program that tampers with their
data, this type of protection is preferable to more complex--and possibly
riskier--schemes that actually move or change files in some manner.

Some programs, like the $99.95 Full Armor from Micah Development Corp.
(1-800-653-1783), take the process of FAT alteration one step further by
scrambling the file's entry in the table, preventing easy recovery by
simple filename restoration. The hacker must first reconstitute the
filename, as well as its disk address, to recover the file. Whole disks
can be locked with Full Armor's password protection and directory
encryption.

More sophisticated programs, such as the $99 FolderBolt from Kent Marsh
Ltd. (1-800-325-3587), remove the entire file to a hidden disk location
or encrypt the data as well as its FAT entry. Total encryption is the
most secure of all file- or disk-locking strategies. A quick and dirty
encryption scheme is data compression. Compression software, after all,
renders data unreadable. DOS's DoubleSpace or even PKZIP can be used in
this manner, especially if telltale filename extensions (such as ZIP) are
temporarily al-tered--just be careful to keep track of which files have
been changed in this manner. Other disk-locking programs include DiskLock
from Symantec and WinGuard Plus from Vasco Data Security. WinGuard uses a
hardware key generator to create passwords.

Installation of a file- or disk-locking program will defeat most casual
snoopers. If possible, use one program (Full Armor) to lock the disk and
another (FolderBolt) to lock directories and files. That way, if a
snooper overcomes one set of protections, he won't automatically gain
access to your data.

NETWORK DISK LOCKING

Locking up disk drives in a network environment is just as effective as
doing so in a single-user setup; you've just got to be more organized.
For instance, because the locking programs make data invisible to DOS and
most network operating systems, ordinary backup programs cannot be used
unless the disks are first unlocked. It becomes more important than ever
to make backups: A forgotten password can have the same disastrous effect
as a disk crash.

All security programs provide some means by which the security plan can
be managed. Usually a system administrator has the power to add or delete
users, change passwords, lock or unlock regardless of user privilege, and
so on. These functions are in addition to those inherent to the network
software. Such SuperUser functions are a fail-safe in case a user must be
excluded or data that has been unintentionally protected needs to be
recovered. Because of this system-wide omnipotence, the system
administrator's password becomes a weak link in the security scheme and
must be protected above all else.

FolderBolt, for instance, embeds a unique signature in each of its
software copies. The FolderBolt locking program is separate from the
Administration program, but they share a common signature. If the
signature of the Administration program does not match that of the
FolderBolt utility, then the administrator cannot obtain access to locked
data. A matching signature, however, endows the administrator with total
freedom within the system. The Administration program can be secured by
password.

SAFE IN YOUR SHELL

A shell is a program that manages access to the operating system as well
as your files and applications. Its purpose is to simplify PC use by
bringing the more frequently used operating-system functions and
higher-level programs under a common, typically menu-based, command
environment. Microsoft Windows and Central Point Software's PC Tools are
both examples of shells. Besides potentially simplifying your
operating-system tasks, shells also can provide certain data-security
features. For instance, they can restrict user access to low-level disk
functions or mask certain programs and files. Shells plug holes that
less-secure programs may leave open. Windows for Workgroups or Norton
Desktop for DOS provide both simplification of use and security measures
in the shell environment. Novell NetWare and MS-DOS both have built-in
shells.

If security is your prime concern, then booting into the shell is
preferred. This entails embedding the commands to run the shell in your
CONFIG.SYS and AUTOEXEC.BAT files. These files must then be protected
from alteration to prevent circumvention when booting up. A simple
program like WatchMan, a shareware Windows utility, can alert the user to
changes made to INI and other low-level boot files.

Most security programs demand entry of a password before booting of the
hard drive can proceed. But they also permit booting to take place from
floppy drives. This can allow a knowledgeable intruder to run hard drive
formatters, debugging monitors, or low-level disk editors, any of which
could be used to mount the hard drive and defeat password protections. A
shell can be programmed to redirect all boot attempts to the hard drive,
thereby reducing such risk.

Shells can be invisible as well as visible. A program such as WatchDog,
$295 from Fischer International Systems Corp. (1-800-237-4510), can be
configured as a visible menuing system, through which user access is
directed to selected programs, directories, and functions. It also can be
configured as an invisible sentry system, leaving the user with the
impression of unrestricted access while actually offering only
preapproved options.

Menuing shell programs, like WatchDog, can prevent alteration of
AUTOEXEC.BAT and CONFIG.SYS files. This blocks the possibility of open
holes in the security system after rebooting. It also can prevent
disk-block writes, which disk editors utilize to change data at the bit
level. This way, new software can be installed only by the system
administrator. WatchDog can encrypt files with the Data Encryption
Standard (DES), a highly sophisticated algorithm developed by the U.S.
National Bureau of Standards, or a proprietary algorithm. Naturally,
WatchDog has a backup feature that allows booting from the floppy drive
in the event of hard drive failure. Also, a separate program, KeyMaster,
recovers lost or forgotten system-administrator keys.

HARDWARE ARMOR

Hardware can provide a second barrier to intrusion by enacting controls
over the PC from the outside. If intruders can't even turn the computer
on, they'll probably go skulk elsewhere.

WatchDog can be integrated with a hardware product, WatchDog Armor ($445,
also from Fischer International). This half-length ISA card ensures that
the system cannot be fooled into permitting unauthorized diskette
booting. WatchDog Armor assumes a mediating role between the computer and
the protection software. The board shunts all boot operations to the hard
drive, and therefore cannot be defeated by any software scheme to
overcome the floppy lockout. The WatchDog Armor manual includes
instructions by which the A: drive can be physically disabled.

The board also contains its own clock/calendar, completely independent of
the PC's other hardware or software clocks. The tamper-proof Armor clock
is used to stamp and provide reports on all WatchDog-controlled
activities. This way a reset of the CPU clock cannot be used to make
passwords or SuperUser access retroactive. The board incorporates a
DES-compatible chip that performs data encryption and decryption,
speeding up these processes as compared to WatchDog's software-only
routines.

Kevlar Credit Card

A hardware-only family of security boards is manufactured by Isolation
Systems of Ontario (1-800-387-8706). Called ISAC, the boards offer
complete security-management systems totally independent of the host CPU.
All security parameters are stored in the board's permanent RAM and are
inaccessible to the user through the host CPU. Even after successful
logon, the board controls all disk accesses and provides security
mediation and encryption. Some models also have the capability of
accepting smart-card readers.

The size of a credit card, the smart card contains an integrated silicon
chip capable of intelligent interaction with the host computer system.
Unlike an actual credit card, which holds only a small amount of
information (password, ID, account number) on a magnetic strip, the smart
card can contain large amounts of information and can be programmed to
give lengthy responses to computer interrogation. The combination of the
ISAC boards and smart-card hardware is suitable for use on networks that
require the greatest possible security.

New to the hardware security scene is the SmartDisk, a variant of the
smart card, from SafeBoot. SmartDisk is a 3.5-inch floppy disk package
that integrates smart-card technology. SmartDisk is inserted into the
floppy drive as if it were a real diskette, but the read/write heads
connect to the SmartDisk's circuitry, making them a kind of universal
interface. Once inserted, the SmartDisk is used to encrypt the hard drive
and protect it with a password.

The password and encryption keys are then stored in permanent memory on
the SmartDisk. The disk then can be ejected and normal operations
resumed. On the next bootup, the SmartDisk is inserted, logging the user
onto the computer transparently. Without the SmartDisk, the computer is
just so much metal and plastic. The product is especially aimed at
portable-computer users, who are guaranteed that a stolen computer is
rendered inert.

SECURITY FROM A DISTANCE

Environments using remote access present special security problems. While
on the one hand they must utilize common telephone carrier lines, they
naturally need some means by which unauthorized users can be excluded.

The most common type of protection is the call-back or dial-back system.
Under such a system, the computer keeps a list of authorized telephone
numbers from which a legitimate call can be accepted. The user dials the
remote computer and identification is made through passwords or account
numbers. The remote computer then disconnects the caller and looks up
that caller's telephone number in its internal tables. It then initiates
a remote session with the caller's computer by calling back the approved
site. Other security measures then take effect for logon and
system-access privileges. Farallon Computing's [(510) 814-5000] $199
Timbuktu product for Windows and Macintosh computers includes this
method.

Pitfalls and Precautions

Passwords are virtually useless when used alone. They easily can be
stolen, discovered, or merely guessed by the persistent hacker working
with simple equipment. Your passwords should be longer than four
characters but short enough to be memorable and typed without error.
Concatenated or compound passwords are preferred. To help circumvent
password discovery, limit their duration. Change passwords frequently,
but not so frequently that users become confused.

On networks, use Access Control Lists based on one password instead of
adding passwords to increase user access. Too many passwords increase,
not reduce, the risk of intrusion. Also, audit trails are absolutely
necessary. Audits should show all attempts to log on to the system,
whether they were successful or not, and, if possible, what files were
used or changed.

Avoid the predictable. Programs or devices which use regularized prompts
or error messages can betray themselves to the knowledgeable hacker.
Never run off-the-shelf products as they are installed out of the box.
Alter default passwords and network messages whenever possible. Prompts
that indicate the form of the expected reply (such as User Name, User
Account) make the hacker's job much easier. The inclusion of company name
and other predictable data in messages, prompts, or menus can provide
hackers with specific data on which to base their searches for more
compromising information, such as your company's address, so they can
search through your garbage for discarded printouts and the like.

Look out for backdoors to your applications. A backdoor is an entry point
into a program put there for debugging or other development purposes.
Activated by an unusual keystroke series (one unlikely to occur during
normal operation), they permit invasion with all protections disabled. As
a rule, these ports are closed before the release of a product, but once
in a while such a backdoor is left open (either inadvertently or by
design), and its existence may be revealed only after damage has been
done. Check outside sources for known backdoors in products you intend to
purchase and demand a fix from the software company should you find one.

Make certain that someone with a copy of the security software cannot
gain access to your system by setting up as a new SuperUser. If
reinstallation of the Administration program is permitted, a new
SuperUser account should not be retroactive. Files protected by prior
users must remain protected.

You also should do your best to make security inconspicuous. It is a
paradox that the more security is provided for a system, the more likely
it is that it will come under attack. High-profile security measures
attract some hackers who view them as a challenge, not to mention that
lots of security obviously suggests that something valuable is being
protected.

Finally, accept that no security system is impervious. Disaster recovery
must be part of your security plan.

  Related Article
  ---------------

Crypto Wars

Encryption is the highest form of PC security, converting intelligible
data (called cleartext or plaintext among cryptographers) into an
unintelligible form (dubbed ciphertext). Encryption is accomplished
through Boolean mathematics by merging a random sequence of digital bits
(the key) with sequential portions of the cleartext through logical
(Boolean XOR, the exclusive OR) and arithmetic (bit shifting or rotation)
operations. Cleartext recoverability is a factor of the number of
encryption iterations performed and the length of the key. The longer the
encryption takes, the more secure your data. Two forms of encryption are
popularly used: the private (or secret) key and the public key.

Big Brother's Private Key

Private-key cryptography uses one key for both encryption and decryption.
The method relies on a secure transfer of the key from the sender to the
recipient. Anyone possessing the key can decipher the message. The method
used in almost all commercial instances, including most financial
transactions worldwide, is a private-key process defined by the Data
Encryption Standard (DES). This process was developed by the U.S.
National Bureau of Standards.

DES uses a 64-bit key with eight bits used for error control. The
remaining 56-bit key is used for the encryption and decryption. DES
relies on the sheer number of possible keys (70 quadrillion) to keep
encrypted messages secure. In response to recent allegations that DES may
have become unsafe, the government has proposed a new standard called
Skipjack.

Skipjack is an 80-bit, dual-key algorithm developed by the National
Security Agency (NSA). Since 1985, the NSA has been developing a silicon
chip called the Clipper. The Clipper Chip, housed in a tamper-proof
package, is a self-contained CPU containing the Skipjack algorithm.
Designed for incorporation into all future telephonic devices, it will
encode both voice and digital data. The Clinton administration moved to
make this the new standard by stipulating that all new telephonic devices
purchased by the government must have this technology. Therefore, to
communicate with the government, the person at the other end of the line
would need a similarly equipped device.

In the interests of federal crime bureaus, one of several generic
signatures in the Clipper Chip contains a Law Enforcement Access Field
(LEAF), embedded in any transmission. Presumably, removing or altering
the LEAF would be illegal and detecting such a message would trigger an
investigation. Supposedly, privacy would be assured under normal
conditions, but law-enforcement agencies would not be prevented from
gathering evidence of illegal activities.

To make this standard effective, other means of encryption over telephone
lines would have to be prohibited. Naturally, the developers of competing
encryption algorithms, which may or may not be more secure, object to
this trade restraint. Further, civil libertarians object to the
government having a means by which private communication could be
routinely intercepted. There is no obligation, they point out, that
private citizens communicate in a manner that the government can
understand. To combat what they see as the ultimate Orwellian nightmare,
a growing number of computer-literate citizens are banding together to
promote public-key cryptography.

The Public's Key

Public-key cryptography first became popular in 1975 when the idea was
published by Whitfield Diffie. Diffie's method (developed with a Stanford
computer scientist named Martin Hellman) uses a published key to encrypt
and a private key to decrypt. Thus, anyone who knows your public key can
send you a message, but only you can decipher it with your private key.

In 1977, Diffie's scheme was incorporated into a set of algorithms called
RSA (for their MIT authors, Rivest, Shamir, and Adleman). RSA offers
several advantages over DES, not the least of which is that DES was
limited to 64-bit keys, while RSA keys can be any size.

The RSA algorithms currently can also be found in an Internet-published
program called PGP (Pretty Good Privacy), written by Phil Zimmermann. PGP
is still in version 2.0 and has several legal problems, including
unlicensed use of the RSA algorithms and a federal investigation into how
the program found its way out of the country.

Yet another public-encryption scheme that promises to become popular when
it is published is Privacy Enhanced Mail (PEM). PEM will be used on the
Internet and from there should proliferate to most public PC networks.
-------------------------------------------------------------------------
Type:      Tutorial
Topic:     Data Security
           Security Software
           Security Systems
           Network Management
           Management of EDP
           Access Controls
           Microcomputers


Record#:   15 049 230
                              *** End ***
