1 00:00:00,490 --> 00:00:02,900 Hello and welcome to our security lecture. 2 00:00:02,900 --> 00:00:07,523 I'm Charles Severance and I encourage you to grab the power points and remix them 3 00:00:07,523 --> 00:00:12,352 and use them in your own courses. Use the videos, use everything in your 4 00:00:12,352 --> 00:00:15,653 own courses. you don't have to teach this whole course 5 00:00:15,653 --> 00:00:20,731 it's quite a bit. So so let's start out by meeting some 6 00:00:20,731 --> 00:00:25,583 nice people. These people are Alice and Bob and they 7 00:00:25,583 --> 00:00:30,067 simply want to communicate some information you know, left to their own 8 00:00:30,067 --> 00:00:34,072 devices. And they don't want the rest of the world 9 00:00:34,072 --> 00:00:37,528 to know about what they're communicating and so they want to encrypt it in some 10 00:00:37,528 --> 00:00:42,072 way. Now, in the cryptograph, cryptography 11 00:00:42,072 --> 00:00:48,399 world, they all I'll call these two people the good people Alice and Bob. 12 00:00:48,399 --> 00:00:53,439 And they simply are A and B, kind of, very computerask variable names, A and B, 13 00:00:53,439 --> 00:00:57,630 Alice and Bob. And then there are some bad guys. 14 00:00:57,630 --> 00:01:02,322 Right, there's the bad guys and, and often they are called C, like, Carol or 15 00:01:02,322 --> 00:01:06,730 Carlos or Charlie, or, or something like that. 16 00:01:06,730 --> 00:01:09,400 And they're even Chuck. Even Chuck is a bad guy. 17 00:01:09,400 --> 00:01:13,250 Or they are Eve, Eve for the eavesdropper. 18 00:01:13,250 --> 00:01:17,000 And the idea is somewhere in the middle here. 19 00:01:17,000 --> 00:01:21,270 Somewhere in the middle, you have some person with bad intent. 20 00:01:21,270 --> 00:01:25,164 Here we have Trinity from The Matrix, and she looks as, she looks as bad as you can 21 00:01:25,164 --> 00:01:27,380 look. Right? 22 00:01:27,380 --> 00:01:30,550 so Alice and Bob seem to be real happy people. 23 00:01:30,550 --> 00:01:34,255 They're just trying to get you know, get things done and send some information 24 00:01:34,255 --> 00:01:38,170 without being bothered. And then, and then Trinity's there 25 00:01:38,170 --> 00:01:40,460 eavesdropping. And, but there's other things. 26 00:01:40,460 --> 00:01:44,410 You can eavesdrop, you can sort of redirect the message and change it. 27 00:01:44,410 --> 00:01:47,330 There's all kinds of things that the bad guy in the middle is going to do. 28 00:01:47,330 --> 00:01:51,425 And so Alice and Bob are far away from each other and they have to communicate 29 00:01:51,425 --> 00:01:55,109 securely. And they, it's a, it's a, it's literal 30 00:01:55,109 --> 00:01:58,466 gantlet of problems that they have to face. 31 00:01:58,466 --> 00:02:02,886 And various people with bad intent, with bad purposes, sometimes just wanting to 32 00:02:02,886 --> 00:02:07,768 see what's going on versus wanting to change what's going on. 33 00:02:07,768 --> 00:02:12,683 Versus completely redirect communication. So Alice, Bob and then a whole series of 34 00:02:12,683 --> 00:02:17,790 bad guys with various bad guys and girls with various evil intent. 35 00:02:19,530 --> 00:02:23,094 So it's always fun to talk about security because the question is, you, and what 36 00:02:23,094 --> 00:02:26,950 does security mean to you and what does it mean to me. 37 00:02:29,420 --> 00:02:33,353 And whenever you're thinking about security, you gotta figure out sort of, 38 00:02:33,353 --> 00:02:37,351 who is out to get you and why are they out to get you. 39 00:02:37,351 --> 00:02:40,828 And for us average people, we are so boring that literally pretty much the 40 00:02:40,828 --> 00:02:45,550 only thing the world wants from us. Is they want to steal our, you know, they 41 00:02:45,550 --> 00:02:50,258 want to steal our credit card numbers. And and then buy stuff with them for just 42 00:02:50,258 --> 00:02:55,350 a couple of days before the credit card company shuts them down. 43 00:02:55,350 --> 00:02:58,920 Now, if you're running for public office there's a whole bunch of your opponents 44 00:02:58,920 --> 00:03:02,030 that are going to want to break into your email. 45 00:03:02,030 --> 00:03:05,270 And and, and that happens right. Those kinds of shenanigans happen. 46 00:03:05,270 --> 00:03:07,800 So, if you're interesting, or influential, or running for public 47 00:03:07,800 --> 00:03:10,836 office, you have a different problem than if you're just kind of a mere civilian 48 00:03:10,836 --> 00:03:14,579 like us. And so, at the end of the day, you can 49 00:03:14,579 --> 00:03:20,823 worry about security, and you can kind of wear tinfoil clothing or something. 50 00:03:20,823 --> 00:03:26,405 But at the end of the day, you and I are so boring that nobody really cares. 51 00:03:26,405 --> 00:03:29,650 But it's good to assume that they're out to get you, right. 52 00:03:29,650 --> 00:03:33,106 That, that, you try to be as secure as you can, and be aware of your environment 53 00:03:33,106 --> 00:03:37,375 and be as secure as you possibly can with your information. 54 00:03:37,375 --> 00:03:43,412 And, with your communications. So who is out to get us? 55 00:03:43,412 --> 00:03:47,652 Well, the government. So now we're going to actually turn the 56 00:03:47,652 --> 00:03:50,323 tables, right? In the very first lecture, we were the 57 00:03:50,323 --> 00:03:53,100 good guys. The good guys were the ones that were 58 00:03:53,100 --> 00:03:57,204 trying to break the cryptography. And the bad guys were the ones that were 59 00:03:57,204 --> 00:03:59,640 trying to hide their, their, their bad messages. 60 00:03:59,640 --> 00:04:02,700 And the government were the good guy. And Bletchley Park. 61 00:04:02,700 --> 00:04:06,875 And they, they broke the codes, and they, they saved Western civilization. 62 00:04:06,875 --> 00:04:12,820 Yay, good guys! Well, now, we're the Germans. 63 00:04:12,820 --> 00:04:16,200 We're the Japanese. We're tryin' to communicate. 64 00:04:16,200 --> 00:04:18,820 People're watchin'. And guess what? 65 00:04:18,820 --> 00:04:21,698 It's the same people. The government, the government's most 66 00:04:21,698 --> 00:04:25,535 likely interested in what you're doing. again most of us are so boring the 67 00:04:25,535 --> 00:04:30,086 government really doesn't care at all. But the government probably has the best 68 00:04:30,086 --> 00:04:34,928 security breaking equipment on the planet right now, better than the criminals. 69 00:04:34,928 --> 00:04:38,551 And so, it's, it's just an interesting flip of the model, right? 70 00:04:38,551 --> 00:04:42,711 Where now, we are trying to communicate, and the government with all of their 71 00:04:42,711 --> 00:04:48,209 bombas and little rotating devices. Sitting in some warehouse somewhere that 72 00:04:48,209 --> 00:04:52,174 we don't know is taking our private communications and they're trying to 73 00:04:52,174 --> 00:04:56,849 break them. And we're in a war trying to make our 74 00:04:56,849 --> 00:05:00,875 communications more and more secure while the government says woah, we have to 75 00:05:00,875 --> 00:05:08,460 invent, like, electronic computers. Because we have to have bigger computers, 76 00:05:08,460 --> 00:05:12,138 because the people at, us good guys who are doing the encrypting. 77 00:05:12,138 --> 00:05:15,138 We're trying to come up with more and more clever ways to encrypt, and the 78 00:05:15,138 --> 00:05:18,710 government has to keep coming up with ways to decrypt. 79 00:05:18,710 --> 00:05:22,261 And you could cast this as criminals versus good folks. 80 00:05:22,261 --> 00:05:25,618 You could cast it as governments versus governments. 81 00:05:25,618 --> 00:05:29,650 At the end of the day, it's an arms race, and it's, it's rather symmetric as to 82 00:05:29,650 --> 00:05:34,109 which side you're on, right? I mean, we started out with the people 83 00:05:34,109 --> 00:05:38,360 trying to hide the information were the bad guys, and now we're the good guys. 84 00:05:38,360 --> 00:05:40,620 Why are we the good guys? because it's us. 85 00:05:40,620 --> 00:05:44,330 As soon as we decide it's us, we're the good guys. 86 00:05:44,330 --> 00:05:47,807 Here's a little, here's a little picture I took a couple of years ago when I 87 00:05:47,807 --> 00:05:53,875 visited Bletchley park this actually lead to the video a year and a half later. 88 00:05:53,875 --> 00:05:59,342 and in this my friend who works at the open university, who also does massively 89 00:05:59,342 --> 00:06:04,490 open online courses that's Joel he's now retired. 90 00:06:04,490 --> 00:06:08,680 He's the tour guide there and, and a dear and personal friend. 91 00:06:08,680 --> 00:06:12,544 And and another of my dear and personal friends whose face you can't see is right 92 00:06:12,544 --> 00:06:15,570 here. His name is Chuck. 93 00:06:15,570 --> 00:06:19,971 He currently works at Shazam in London. And, and he and I just got away for the 94 00:06:19,971 --> 00:06:24,130 weekend and went up to Bletchley Park and took a tour. 95 00:06:24,130 --> 00:06:27,485 Now, just, just a little interesting connection: I sort of mentioned in a 96 00:06:27,485 --> 00:06:31,957 previous lecture about the Matrix. So you notice that Chuck here is wearing 97 00:06:31,957 --> 00:06:36,691 a jacket from the movie Matrix. I mentioned he was the one that wrote the 98 00:06:36,691 --> 00:06:40,690 hacking scene with Trinity. So here we all are together. 99 00:06:40,690 --> 00:06:43,618 We're at Bletchley Park. Alan Turing had an office in this, this 100 00:06:43,618 --> 00:06:46,920 is one of Alan Turing's offices at Bletchley Park. 101 00:06:46,920 --> 00:06:49,440 Here's Joel, open, open teaching and learning. 102 00:06:49,440 --> 00:06:55,130 Here is Chuck worked on the Matrix. And here's Trinity, right? 103 00:06:55,130 --> 00:06:57,920 Except that now Trinity's our enemy instead of our friend, although in the 104 00:06:57,920 --> 00:07:02,308 movie, we were rooting for Trinity. But, we're the one's trying to protect 105 00:07:02,308 --> 00:07:06,220 what we're doing from the Trinity's of the world. 106 00:07:06,220 --> 00:07:08,950 We're the good guys now, and Trinity is the bad girl. 107 00:07:08,950 --> 00:07:12,112 Okay she's the bad lady trying to break into our stuff and we're protecting 108 00:07:12,112 --> 00:07:17,312 ourselves against Trinity. So tables have completely turned okay. 109 00:07:17,312 --> 00:07:22,512 So before we go too far you know you'll run into your organizations with lots of 110 00:07:22,512 --> 00:07:29,420 people who are like security experts. And I find security experts generally 111 00:07:29,420 --> 00:07:33,630 very annoying. because they, like, think they're smarter 112 00:07:33,630 --> 00:07:38,894 than they are. Security experts have this theory that 113 00:07:38,894 --> 00:07:43,002 more security is better. And the reality is, is that perfect serv, 114 00:07:43,002 --> 00:07:47,394 security is unachievable. If you want perfect security, like, lock 115 00:07:47,394 --> 00:07:50,980 yourself in a room and whisper to somebody. 116 00:07:50,980 --> 00:07:53,274 Oh wait a sec. And then the guard will come in and hear 117 00:07:53,274 --> 00:07:55,280 you, or whatever. There'll be a microphone. 118 00:07:56,550 --> 00:07:59,900 So the notion that perfect security and that you, your company can spend more and 119 00:07:59,900 --> 00:08:03,016 more and more money of its budget on security. 120 00:08:03,016 --> 00:08:06,116 just because the security expert thinks that you should Is really kind of a 121 00:08:06,116 --> 00:08:09,427 fallacy. Security is a cost benefit analysis, and 122 00:08:09,427 --> 00:08:13,207 so, if you think of credit card companies, you know, what's the security 123 00:08:13,207 --> 00:08:16,900 of this number. I won't show you the number. 124 00:08:16,900 --> 00:08:20,400 But, what if I lose this number? What's the consequences? 125 00:08:20,400 --> 00:08:22,823 I've had many credit cards that got compromised. 126 00:08:22,823 --> 00:08:25,535 I don't exactly know how. They've got software inside of the 127 00:08:25,535 --> 00:08:28,867 computer companies that captures. Like when all of a sudden I live in 128 00:08:28,867 --> 00:08:32,017 Michigan and a bunch of charges at the New Jersey Walmart are showing up and I 129 00:08:32,017 --> 00:08:37,100 never got on a plane. I'm amazed at how rare it is that your 130 00:08:37,100 --> 00:08:41,990 identity actually gets lost permanently. So I'm really impressed with how the 131 00:08:41,990 --> 00:08:45,830 banks are capable. And so they have this number that makes 132 00:08:45,830 --> 00:08:49,349 it real convenient for us to buy. We can type it into a web form, we can do 133 00:08:49,349 --> 00:08:53,790 all these things, and one in zillion times it gets compromised. 134 00:08:53,790 --> 00:08:58,020 And, so, they lose 50 bucks. But billions of dollars of commerce 135 00:08:58,020 --> 00:09:00,783 happens. So, there is always a security versus 136 00:09:00,783 --> 00:09:03,575 cost. If basically for me to use this credit 137 00:09:03,575 --> 00:09:07,735 card, I'd had to have sort of a, a personal guard from the, the company with 138 00:09:07,735 --> 00:09:11,967 me all the time. It'd be very expensive for me to buy 139 00:09:11,967 --> 00:09:14,960 stuff on Amazon and have it shipped to my house. 140 00:09:14,960 --> 00:09:20,864 And so, understand that when you start getting into conversations with security, 141 00:09:20,864 --> 00:09:25,593 you, professionals. Sometimes they're the kind that 142 00:09:25,593 --> 00:09:28,190 understand that security is naturally imperfect. 143 00:09:28,190 --> 00:09:31,430 And everything is a cost benefit analysis, rather than more security is 144 00:09:31,430 --> 00:09:34,780 always better. So more is not always better. 145 00:09:34,780 --> 00:09:37,858 That's just my little speech about security in case you get stuck in a 146 00:09:37,858 --> 00:09:41,780 conversation with some pompous security expert. 147 00:09:41,780 --> 00:09:45,742 They're mostly pompous. So database administrators are pompous 148 00:09:45,742 --> 00:09:47,620 too. But I hop you're not, not, you're not a 149 00:09:47,620 --> 00:09:51,821 database administrator security expert. But um, [COUGH] the best security experts 150 00:09:51,821 --> 00:09:55,665 that I've ever met are the ones that understand this. 151 00:09:55,665 --> 00:09:59,377 And they can, they can, they can characterize every issue in terms of a 152 00:09:59,377 --> 00:10:03,310 cost benefit analysis. And then you'd know, you'd know, you'd 153 00:10:03,310 --> 00:10:05,950 know, know that you've one into one that is really smart and bright. 154 00:10:05,950 --> 00:10:09,850 So, the terminology that we're going to use for the rest of the segments of this 155 00:10:09,850 --> 00:10:14,123 lecture, we're going to be solving two basic problems. 156 00:10:14,123 --> 00:10:20,001 One is confidenti, confidentiality. And confidentiality is the, the, the 157 00:10:20,001 --> 00:10:24,886 leakage of information. So, if I was to want to send this credit 158 00:10:24,886 --> 00:10:29,674 card number to one of you watching right now without the rest of you seeing my 159 00:10:29,674 --> 00:10:35,100 credit card number. The, the mere revealing of that 160 00:10:35,100 --> 00:10:39,368 information is the problem. So I want to come up with a way to send 161 00:10:39,368 --> 00:10:42,816 it to you. So that no one except the one person that 162 00:10:42,816 --> 00:10:47,200 I want to see it gets it. That's confidentiality. 163 00:10:47,200 --> 00:10:52,436 The other problem is one of integrity. And that is, in a sense, knowing that A, 164 00:10:52,436 --> 00:10:59,990 that the information that you got comes from who you thought it came from. 165 00:10:59,990 --> 00:11:05,558 And B that it wasn't modified on the way. So there are things like digital 166 00:11:05,558 --> 00:11:09,338 signatures that sort of fall into this category and other mechanisms that we'll 167 00:11:09,338 --> 00:11:12,602 talk about. So these, these two things of 168 00:11:12,602 --> 00:11:16,886 confidentiality and integrity, will run through the rest of the lectures that we 169 00:11:16,886 --> 00:11:20,110 have on security. Okay. 170 00:11:20,110 --> 00:11:23,340 So, coming up next, we're just, we're going to start diving right in.