Security Engineering

Security engineering is all about building systems to remain dependable particularly in the face of error, malice or mischance. It is a discipline that puts its focus on the tools, methods that are needed to design, processes, implementation and tests of complete systems and also the adaptation of existing systems as the environment evolves (Anderson, 2008, p. 15-37)

Security engineering obvious requirements are cross-disciplinary systems, which range from cryptography and computer security that is supposed to be through hardware temper-resistance and simple formal method to knowledge of applied psychology, the law, economics and organizations. If security engineering has a very deep unifying theme, it is referred to as the study of security protocols. Typical security systems entail a number of principals like peoples, magnetic card readers, computers and companies, which convey messages using a variety of channels like phones, radios, emails, infrared and by carrying their data on physical devices for example, transport ticket and bank cards. This entire process means that a lot of security is necessary and the reason for using timestamp in the Kerberos protocol (Clifford, 1994, p. 34)

First of all, Kerberos protocol is an authentication service, which is developed at Massachusetts Institute of Technology (MIT) and uses key distribution centers and symmetric key encryption techniques. It provides a reliable means of verifying the identities of principals on an unprotected network. This is achieved without basing trust on the host address, without relying on the authentication by the initial host operating system, without requiring the physical security of all hosts on network and without assumptions that packets that travels along the network can be simply modified, read or inserted at will (Clifford, 1994, p. 34).

Kerberos protocol, timestamp is important in authentication protocols that give support to multiple authentications without any multiple requests to a particular authentication server. This means that Kerberos relies on the actual use of timestamps to assure freshness of initial previous pieces of information as session keys. In addition to this, Kerberos checks Alice’ identity twice before she can be authorized to get access to the actual network resource Bob. First, is by means of Kerberos Authentication Server and secondly is by means of Ticket Granting Server (Needham, 1978, 993-999).

The communication between Alice and the CEO is securing the reason being the massage that is being communicated is encrypted. On the other hand, Kerberos authentication usually proves that the client is actually running on  behalf of a particular user (Bellovin & Merrit,  1990, p. 126). Simply put, the client has the knowledge of encryption key that is known by authentication server and the user only. In this essence, the user’s encryption key is used as the password. The application server shares this encryption key with authentication server and this key is known as the server key.  Encryption in recent implementation of Kerberos, makes use of Data Encryption Standards (DES) and it is property of DES, such  that when it is cipher text, it is decrypted using the same key that was used to encrypt it and then the plain text or original data appears (Bella & Riccobene, 1997, p. 8-9).

In this case, if different keys are used for the encryption and decryption or incase the cipher text is modified in any case, then the result will be unintelligible. This means that the checksun in the Kerberos message will not in any way match the data, thus the combination of checksun and encryption provides confidentiality and integrity for the encrypted Kerberos message (Burrows & Abadi, 1989, p. 237). This gives the guarantee that the communication between Alice and the CEO was properly secured because security is determined by confidentiality and integrity, which is really demonstrated by Kerberos encryption.