Abstract
Numerous vulnerabilities have a tendency to taint modern real-world web applications, allowing attackers in retrieving sensitive information and exploiting genuine web applications as a platform for malware activities. Moreover, computing techniques are evolved from the large desktop computer systems to the devices like smartphones, smart watches and goggles. This needs to be ensure that these devices improve their usability and will not be utilized for attacking the personal credentilas (such as credit card numbers, transaction passwords, etc.) of the users. Therefore, there is a need of security architecture over the user's credentials so that no unauthorized user can access it. This chapter summarizes various security models and techniques that are being discovered, studied and utilized extensively in order to ensure computer security. It also discusses numerous security principles and presents the models that ensure these security principles. Security models (such as access control models, information flow models, protection ring, etc.) form the basis of various higher level and complex models. Therefore, learning such security models is very much essential for ensuring the security of the computer and cyber world.
Top1. Introduction
In the contemporary era of World Wide Web (WWW), online Internet facilities are easily being accessible by every single human belonging to different community. A continued boom of social networking sites, online shopping sites, Internet banking and all other widespread modern web applications provide dynamic access of contents to the users and this has increased utilization of user generated HTML contents. Top vulnerabilities like Cross-Site Scripting (XSS) attacks (Gupta, 2015a; Gupta, 2015b; Gupta, 2015c; Gupta, 2015d) have turned out to be a plague for the modern web 2.0 applications. The exploitation of XSS attack is done by injecting the malicious JavaScript code (Gupta, 2016) on the injection points of vulnerable web applications (Gupta, 2012a; Gupta, 2012b; Gupta, 2014).
1. Need of Security
In initial computers, the need of security was limited to the data that is stored in the central computer servers. With the advancements in Internet and communication systems the need of security of messages has been becoming difficult and complicated. Today’s computer systems must not be only preserve privacy of the data or messages but also the other factors like availability, integrity, non-repudiation etc. Basic security mechanism includes providing username and password to the authorized user; and using that information to authenticate the user. Another common method used is to encrypt the critical database and allow access to decrypt is only them who have the secret key. Organizations require more sophisticated and highly secure mechanisms that can successfully prevent the possible attacks.
Since the attackers are becoming more and more sophisticated, they do not need to go even outside to perform damage on their rivalry. In 1982 during the cold war, CIA injected the code into Siberian gas pipeline software system in Russia to allow it to malfunction which caused it to explode (French, 2004). In the world of Internet no one is secure, not even president of USA. In 2008 during presidency run, suspected hackers from China and Russia, attacked on computers used in campaigning of both Barack Obama and John McCain, which includes sensitive information such as emails and campaign data (Larson, 2013). Despite the fact that India is emerging as one of the biggest IT service providers, it hasn’t escaped from cyber attacks. On July 12, 2012, emails of more than 10,000 people including government officials such as Prime minister’s office, Defense ministers, external affairs, finance ministries and Intelligence agencies were hacked (Selvan, 2012). Big, famous companies are also not far away from these attacks. In 2014, eBay experienced very large attacks as attacker managed to steal personal records such as password, email address, physical address, phone numbers etc (McGregor, 2014). There are many incidents happening every day all over the world. According to the report generated by Kaspersky antivirus company (Funk, 2013), in the year of 2013 they managed to neutralize 5,188,740,554 number of cyber attacks on user computers and mobile devices. Therefore, it is stringent need of cyber security against these attacks.
Key Terms in this Chapter
Remote Procedure Protocol (RPC): It is also named as function call or subroutine call in which a computer system can request the resources or service provided by the remote machine connected in a network with any prior information of networking protocol.
Keystroke Logging: It is a process to securely record the keys pressed by the user on the keyboard. In this process user is unaware of this activity. It is used to monitor the user’s activity. It is also named as keyboard capturing.
Location Leakage: Many users reveal their location details on the OSN sites which may be used by the stalkers to harm to the user.
Security Model: A security model is a computer model which is used to identify and impose security policies. It does not require any prior formation it may be founded on the access right model or distributing computing model or computation model.
Passwords: It is used for user authentication. It is a string used to have an access on the resource. It must be kept secret from other to restrict the access to the resource.
Lattice: It is a partially ordered set in which every two pair of elements in the set has only one least upper bound and only one greatest lower bound.
Sensitive Information: It is the type of information that must be protected from the attacker so that security and privacy remain intact. Such information may include login details, session tokens, etc.
JavaScript: It is a scripting language used to develop the dynamic Web applications.
Security Policies: These are the standard protocols imposed by the organization on its members or any adversary. These basically define the operations a person is authorized to perform and considered as secure (i.e. do not breach any law or security) in front of the system’s eye.
World Wide Web (WWW): It is space in which Web pages are identified by the URLs and contain hyperlinks to other Web pages.
Access Matrix: It is used to specify access rights of every user in relation to every other object. It is solely a security model of computer system.
Availability: It is one of the main aspects of the information security. It means data should be available to its legitimate user all the time whenever it is requested by them. To guarantee availability data is replicated at various nodes in the network. Data must be reliably available.
Social engineering: It is the art of manipulating the mental state of the people in an attempt of divulging the sensitive information. It is the most dangerous danger that today’s enterprises are facing.
Confidentiality: Confidentiality is the most important characteristic of the information security which means that only authorized person is able to access the resource. It imposed some constraints over the sharing of resources with users.
SQL Injection: It is a code injection vulnerability in which attacker injects some malicious SQL commands in to the execution field of the database.
Router: It is a traffic forwarding network device. It is used to forward the data packet on the basis of the destination host. All the routers traversed by the data packet constitute its networking path.
Finite State Machine (FSM): It is a mathematical model that can present in the one of its finite states. It is used to solve programs and sequential circuits.
Insufficient Authorization: It occurs due to improper authorization of user to ensure that user is performing the actions according to the defined policies.
Identity theft: It is a type of cyber-attack in which attacker uses the identity of the legitimate user over the network especially social networking sites. It is done for the purpose of gaining the access to user’s account login credentials and performs some malicious activity involving user and his friends.
Server: Any machine which can serve to the client request by providing the requested resource.
Cyber-Attack: Cyber-attack is a crime performed over the Internet. It may involve an individual or a group to perform malicious activity targeting a person or an organization. Its main aim is to gain access to the personal information to breach the security boundaries. It may include various types of attack like phishing, malware, spamming, XSS, botnets, Socialbots etc.
Cross Site Scripting (XSS): It is a code injection vulnerability found in many Web applications to inject malicious scripting code to steal the user’s sensitive information like session cookie and token.
Trojan Horse: Trojan is a kind of malware that pretends itself to do some useful work in to the benign user but in the background it performs some malicious activity like steal the sensitive information, corruption of the important data etc.
Spyware: It is a type of malicious software that attempt to capture the information related to any person or organization without their knowledge. It then sends this information to some other adversary who may use it for its own benefits.
Watermarking: It is a method which is used for checking signal’s authentication and integrity. It achieves its goal by covering the digital information behind the carrier signal.
Spybot: It is a security tool used to defend against spyware and adware. Platform for this is Windows 95 and onwards. For this, it scans computer hard disk and RAM (Random Access Memory).
Firewall: In network security, firewall is a system used to keep surveillance over the traffic passing through it in and out on the basis of some prior defined security protocols. It basically protects the trusted network from the untrusted one like Internet.
Hyperlink: It is a technique to refer to the data on the Web page on clicking the link on the currently displayed Web page.
Information privacy: It is also called as data privacy. It is an aspect of information technology that describe the capability of an enterprise to identify what type of information should be kept private or what type of information is publically available.
Integrity: It is one of the building blocks of the information security which assures that data should not be altered, by any adversary in the network, during data transfer from source to destination.
File Transfer Protocol (FTP): It is a standard network protocol based on the client-server framework which allows a machine to transmit files to other machine on the Internet. It utilizes different control and data links between client and server.