Security Evaluation
Matthew Williams
CMGT/441
1/21/2013
Shivie Bhagan

Security Evaluation
My evaluation is of the paper “Why Information Security is Hard” by Ross Anderson. This paper is an evaluation that covers an economic perspective of information security in the financial industry throughout the world. Simply summed up by the statement, “The more people use a typical network, the more valuable it becomes. The more people use the phone system - or the Internet - more people there are to talk to and so the more useful it is to each user.” (Anderson, 2001)
In the first paragraph Denial of Service (DOS) attacks are described as one of the issues presented by the current security incentive structure. “As an example presented the author states, “While individual computer users might be happy to spend $100 on anti-virus software to protect themselves against attack, they are unlikely to spend even $1 on software to prevent their machines being used to attack Amazon or Microsoft.” (Anderson, 2001) The statement accurately describes what I’d like to call a failure to respond to an indirect threat. Simply because a user is not directly being attacked most assume they are safe and that the statistics are in their favor. Unfortunately, this is rarely the case, like the great library in Alexandria which was destroyed and affects us all even today though indirectly.
In a typical connection, the user sends a message asking the server to authenticate it. The server returns the authentication approval to the user. The user acknowledges this approval and then is allowed onto the server.
In a DOS attack, the attacker sends several authentication requests to a server, filling it up. All requests have false return addresses, so the server can't find the user when it tries to send the authentication approval. The server then waits, sometimes more than a minute, before closing the connection. When the connection is rejected, the attacker or pseudo attacker sends a new batch of forged requests, and the process begins again which ends up tying the server up indefinitely.
DOS attacks are simple to recreate and perform as you simply need to have a .bat file introduced to a number of users that spreads in order to do one thing, ping a server with any type of request. After the bandwidth limit is reached the server is forced to shut down and restart or crash completely, at which point a Trojan program can be loaded to steal information, which will likely be from the same users who inadvertently helped bring down a server full of their own personal information. I agree with the disposition of the author to increase user’s awareness to their own additions to attacks like the DOS attack.

Works Cited
Anderson, R. (2001). Why Information Security is Hard. Cambridge: University of Cambridge Computer Laboratory.

CNET News. (2000). How a 'denial of service' attack works. Retrieved from

http://news.cnet.com: http://news.cnet.com/2100-1017-236728.html