Online Social Network Security

Security is an important issue for the widespread application of social network. It is generally agreed that without the proper countermeasures in place, use of social network will be severely impeded and insecure.

Security Objectives

When developing an application, it is best to define security objectives and requirements early in the process. Security objectives are goals and constraints that affect the confidentiality, integrity, and availability of your data and application.

Identification of security objectives is the first step you can take to help ensure the security of your application, and it is also one of the most important steps. The objectives, once created, can be used to direct all the subsequent security activities that you perform. Security objectives do not remain static, but are influenced by later design and implementation activities.

Security objectives should be identified as early in the development process as possible, ideally in the requirements and analysis phase. The objectives, once created, can be used to direct all the subsequent security activities that you perform. Security objectives do not remain static, but are influenced by later design and implementation activities.

Identifying security objectives is an iterative process that is initially driven by an examination of the application’s requirements and usage scenarios. By the end of the requirements and analysis phase, you should have a first set of objectives that are not yet tied to design or implementation details. During the design phase, additional objectives will surface that are specific to the application architecture and design. During the implementation phase, you may discover a few additional objectives based upon specific technology or implementation choices that have an impact on overall application security.

Each evolution of the security objectives will affect other security activities. You should review the threat model, architecture and design review guidelines, and general code review guidelines when your security objectives change.

OSI (Open Systems Interconnection) Security Services

With regard to the framework of the OSI Reference Model, the authentication services require authentication information comprising locally stored information and data that is transferred to facilitate the authentication:

Authentication

These services provide for the authentication of a communicating peer entity and the source of data.

Access control

This service provides protection against unauthorized use of resources accessible via OSI.

Data confidentiality

These services provide for the protection of data from unauthorized disclosure.

Data integrity

These services counter active threats and may take one of the forms.

Non-repudiation

This service may take one or both of two forms: proof of origin or delivery.

Social Network Security Objectives

As mentioned in week 10, we know there are three main security objectives identified in the context of OSNs:

Privacy

Integrity

Availability

Privacy in OSNs encompasses user profile privacy, communication privacy, message confidentiality, and Information disclosure.

To be integrity, the user’s identity and data must be protected against unauthorized modification and tampering.

Availability of user profiles is consequently required as a basic feature. Besides availability of data access, message exchange among members should also be taken into consideration.

Differences between the social network security objectives and conventional online networks

1.    Confidentiality

In conventional online networks, privacy calls for data confidentiality, including connection confidentiality, connectionless confidentiality, selective field confidentiality, and traffic flow confidentiality.

However, in the OSN (Online Social Network), privacy means the possibility to hide any information about any user, even to the extent of hiding their participation in the OSN in the first place, requiring explicit disclosure leads to the need for access control.

2.    Integrity

Data integrity, in OSI, refers to five facets: connection integrity with recovery, connection integrity without recovery, selective field connection integrity, connectionless integrity, and selective field connectionless integrity.

In traditional social networks, the creation of personae, such as bogus accounts, cloned accounts, or other types of impersonation, is easy to achieve. Therefore integrity in the context of OSNs has to be extended to ensure the existence of real persons behind registered OSN members.

3.    Availability

Data access provides protection against unauthorized use of resources accessible via OSI. In OSNs, availability of user profiles is required as a basic feature, even though considering recreational use, including robustness against censorship, and the seizure or hijacking of names and other key words. Besides data access, availability, while message is exchanging among members, should be ensured as well.

References:

1.     http://security-objectives.com/

2.     http://en.wikipedia.org/wiki/Security_service_%28telecommunication%29

3.     lecture 10 (page 6 -10)