Cybersecurity for Everyone

David B. Skillicorn

• Éditeur: CRC Press
• Année: 2020
• ISBN:
  9781000298673
• Édition: 1
• Sujet: Informatique
• Sous-sujet: Programmation de jeux

Cyberspace is a critical part of our lives. Although we all use cyberspace for work, entertainment, and social life, much of its infrastructure and operation is invisible to us. We spend a big part of our lives in an environment that is almost an essential service but is full of potential dangers: a place where criminals can commit new kinds of crimes, where governments can exert political pressure, and where we can be hurt by the unthinking actions of the bored and careless.

Making cyberspace more secure is one of the challenges of our times. This is not only (or perhaps even primarily) a technical challenge. It requires actions by governments and businesses to encourage security whenever possible, and to make sure that their own actions do not undermine it. Unfortunately, many of those in a position to do something about cybersecurity do not have the background to understand the issues fully. Cybersecurity for Everyone will help by describing the issues in a way that is accessible to anyone, but especially those from non-technical backgrounds.

Chapter 1

Introduction

Cyberspace, the combination of computer systems, devices, and the networks that connect them, is pervasive. The most obvious part of cyberspace, and the one that most people have encountered, is the Internet, but there are many other components to cyberspace: automated production lines, separate military networks, and dark corners that are technically part of the Internet, but difficult for ordinary users to access. We as individuals use cyberspace visibly for work, for shopping, and for entertainment; but it is used less visibly, but more importantly, for keeping our societies running, in manufacturing, services, financial markets, and government.

Although cyberspace is pervasive, most of its structures are invisible to us even when we are using them. We interact with it via phones or computers, but the servers that power web sites and allow us to manage our bank accounts, to book travel and hotels, and communicate using email or social media are not easily appreciated. The “plumbing” that connects our interface devices and these services is also almost entirely hidden. Making this huge, complex system so unobtrusive and seamless from a user perspective is a major success.

However, from a security perspective, the invisible nature of cyberspace creates an issue—people have no intuition about how it works, and so cannot easily judge which actions are potentially dangerous. It's a bit like visiting a tourist-focused city and accidentally straying into a bad neighborhood simply by not realizing that such neighborhoods exist. It's hard to assess the risk of any particular action in cyberspace, and many of the “rules” come without explanation, or ar least without meaningful explanation, that would enable users to understand when rules have reasonable exceptions. For example, a common rule is “don't open email attachments from people you don't know” but this is often unworkable in practice. If you don't know that From: email addresses can be spoofed then the apparent converse “it's ok to open attachments from people that you do know” will sometimes lead to unfortunate actions.

Younger people, who have grown up with the Internet, are in some ways savvier about the dangers, but even they can easily be blind to risks and taken in by those who exploit cyberspace for their own purposes. Education about cyberspace can help, and that's the purpose of this book, but a little learning is a dangerous thing (Alexander Pope).

The problems of cybersecurity can be traced back to the early days of what became the Internet: Arpanet, a network that connected government and university computers, and which assumed that all of the participants were trustworthy and accountable. As a consequence, security issues were not considered seriously in the design of Arpanet's basic working—and many of those designs are with us still. The fundamental problem is backwards compatibility: each new development had to continue to allow existing computers, networks and systems to work together, even as the size and scope of the overall system exploded. Arpanet was also designed to survive a nuclear attack, and so was designed in a distributed way. This design lives on in cyberspace today. There is no overall management of cyberspace and decisions are made by a messy collaboration of stakeholders.

In many ways, the Internet is a victim of its own success. From that initial small set of connected computers, it grew to include more government and university computers, including internationally. In the early 1980s telephone companies got into the act, allowing dedicated connections between computers that were in different cities, and then allowing computers to connect by dialing one another and communicating data over phone lines that had been designed for voice.

The introduction of the World Wide Web in 1995 marked another shift in connectivity. Suddenly individuals had a “killer app” for getting information from businesses and governments, including those far away; and these businesses and governments needed large computers to serve these web pages to those who wanted them. At about the same time, email, previously limited to academics, became a pervasive way of communicating for ordinary people.

Browsers and servers developed new functionality, Servers no longer simply provided content, but enabled interaction with users, including allowing users to upload content. Once again, a mechanism designed for one use was adapted to do things for which it had not been designed, and the new uses have overwhelmed the old.

In another dimension, what changed was the scale of cyberspace as billions of people, more than half the world's population, acquired devices that enabled them to participate; and as servers became bigger and faster in response.

Cyberspace just grew. There was no central planning; interesting people came up with new ways to use the existing infrastructure and systems and they mostly didn't think much about the security issues they were creating in their hurry to create the new great thing. As a result, cybersecurity must work in a world where security was never designed in, and so must be retrofitted with as much effectiveness as possible. Unfortunately security isn't the kind of property that can be added in—to be really effective it must be thought about at every stage of the design and implementation. As we shall see, attempts to design countermeasures to address the security weaknesses of many parts of cyberspace are necessarily contrived and so relatively ineffective.

This is, of course, a bonanza for criminals and some national governments who are able to exploit the security weaknesses for their own purposes. There is an arms race between those who want to exploit security weaknesses and those who are trying to make cyberspace more secure. The efforts to improve security are often sabotaged by users who prefer convenience to security. A number of actors, while giving lip service to security, actually prefer considerable leakiness Many Internet businesses (and some governments) use security weaknesses to collect data about Internet users that would be more difficult to collect if cyberspace were more secure. For example, many Internet businesses try to collect phone numbers from their users, under the guise of making authentication more secure, but their real motive is that knowing someone's phone number allows access to another large trove of data about them.

One of the reasons that improvements in cybersecurity have been weak and piecemeal is that there is no central governance. Control of cyberspace is split between international bodies that manage some aspects but have no real power; the owners of the infrastructure, such as the pipes that connect countries and across countries; the (quondam) telephone companies that provide phone connectivity and also tend to own large communications infrastructure; the businesses that provide large servers (for web sites and computation) such as Apple, Amazon, and Google; and national governments. All of these stakeholders have different incentives, sometimes very different, and so developments are the result of a tug of war between competing interests. Most would claim vigorously that security is important, but this tends to translate into action only weakly if at all as other interests compete with or outweigh it. Even with the best will in the world, retrofitting security is difficult so it is not surprising that there is overall little appetite for it.

International cooperation about cyberspace is difficult. In some ways it's the first post-Westphalian¹ system. Although the Internet stretches into every country on earth, national governments have little control over it. They would like to have more, but their citizens demand access to apps and capabilities that are incompatible with national control.

A number of countries have tried to (re)construct national borders in cyberspace. The effort to control traffic that passes across such borders has had only limited success, and not for want of trying. Even if traffic could be controlled, every country still ends up using the same hardware, systems, apps², and ways to move traffic and so faces all of the same security issues that result. All of these pieces can become vehicles for covert activities. No country is a cyberspace island, entire of itself.

Chapter 2 provides an introduction to what is happening under the covers in cyberspace, that is, how the interfaces we use to browse the web or send email or otherwise act in cyberspace actually work. Chapter 3 discusses how content is protected by encrypting it, both in flight (as it moves from one place to another), and at rest (when it is stored somewhere). Chapter 4 describes the security issues for the nodes that make up cyberspace, the edge devices such as phones and personal computers that we all use, and also the more-powerful computers—called servers—that provide web pages and web-based services and the ability to carry out large computations. Chapter 5 describes the security issues for the pipes that move data around the world, from the intercontinental undersea cables to the Bluetooth connection between your phone and your earbuds. Chapter 6 describes the security issues associated with setting up and managing the configurations of nodes and pipes so that they can work together as they should, even when something goes wrong. Chapter 7 describes the security issues associated with higher-level activities, the ones that we as users interact with directly. This includes email and the use of the World Wide Web (henceforth, the Web). Since blockchains are a hot topic, and one with substantial, complex security issues, we also discuss it.

¹The Peace of Westphalia, in 1648, ended the Thirty Years War, establishing the idea that states did not interfere in the domestic affairs of other states—in that case their religious beliefs. The problem with cyberspace is that its structure crosscuts national borders and a framework for thinking about this intersectionality has not yet been established

²China has successfully developed its own version of platforms that are used in the rest of the world, but they have a large domestic population, and there are signs that their citizens use the international apps when they can, to evade the state surveillance built into the local apps.

Chapter 2

How cyberspace works

2.1Encounters with cyberspace

Almost everyone is familiar with cyberspace in some form, but the interfaces through which we use various online systems do not necessarily reveal very much about what is behind the scenes. The three most popular interfaces are web browsing, social media, and email, and these are accessed, by most people, using phones. However, personal computers are still used for access, especially for tasks that are computational, data intensive, or require visualization.

Web browsing is the most intuitive. Web content is stored on large computer systems, called web servers. Whenever someone opens a browser and enters a URL (or clicks a link), a request is sent to the corresponding server and a web page is sent back to the browser. Although the interface creates the impression that we visit a web site, the reality is that pages from the web site visit us. Web server

In the early days of the Web, web servers provided prebuilt web pages to browsers which were then responsible for displaying them on whatever device the user was using. The Hypertext Markup Language (HTML) describes what kind of thing each piece of the web page is (a heading, a paragraph) which enables the web browser to display the page in whatever way produced the best effect on the particular device that the user is using. For example, the browser can fit the displayed page to the available screen size, HTML

More interesting possibilities arose when web servers were given the ability to create pages dynamically as they were requested. Now the web page that a particular user sees can be customized for that user—perhaps different for users in different countries or regions.

This ability becomes even more powerful when the user's browser can communicate individualized information to the server. The obvious use of this is search—a user inputs search terms and the search engine (a specialized kind of web server) sends back a customized page of results that match the uploaded search terms. A user can communicate with a bank web server and be presented with a page containing their own individual account balances.

The next stage happened when browsers became capable of downloading small pieces of software, along with page content. A web server, using this mechanism, can have a browser do something on its behalf. This is the key to online banking, online shopping, and all of the other interactions that are two-way, with users entering information as well as viewing content.

These mechanisms also have a negative side—they can and are used to store information in the browser (cookies) that can identify when the same user revisits the same web server and, increasingly, other servers as well. In other words, this rich channel of communication becomes the conduit for tracking user behavior.

In some interactions, the emphasis is more on the flow of information from the user to the site rather than the other way around; for example, uploading videos to Youtube. The mechanism is the same—th...