* An early story of identity theft
In the Jewish tradition, we read the Torah (the Pentateuch, or the first five books of the Bible) every year, so it is a pretty familiar story for me. I often arrive at shul (synagogue, temple) early on Saturday mornings simply to read the pareshah (lesson) through again before the service begins. I was recently struck by how we can use a familiar story from the Bible in teaching information assurance.
One of the early stories from Bereishit (Genesis) is Toledot (Genesis 27:1-28:9), in which we continue the story of Isaac, who had settled in Beer-sheba and was now an old man. He called his older son Esau to him and asked him to prepare a dish of wild game for him, at which time he would give him his final blessing – the equivalent of a last will and testament.
However, the matriarch Rebekah overheard her husband Isaac and resolved to ensure that her favorite son, Jacob, would receive the special blessing instead of the more unruly Esau. She arranged to cook a kid (that’s a baby goat, for those now far removed from the rural world) and told Jacob to bring the food to his nearly blind father.
Jacob protested, “But my brother Esau is a hairy man and I am smooth-skinned. If my father touches me, I shall appear to him as a trickster and bring upon myself a curse, not a blessing.”
So Rebekah made Jacob dress in some of Esau’s clothes and she put skin from the kids on his arms and his neck. When Isaac heard Jacob offering him food, he asked which of his sons he was and Jacob said he was Esau. Isaac wondered, because the voice was that of Jacob, but he felt Jacob’s hands and the furry texture reassured him that it was Esau. He also brought Jacob close to him to smell his clothes and blessed him, saying, “Ah, the smell of my son is like the smell of the fields that the Lord has blessed.”
Well, you can read the rest yourselves. Esau returns and is horrified that he has been cheated of his paternal blessing (“he burst into wild and bitter sobbing”) and swears vengeance against his scheming brother.
So how can this tale be used in a course? I think there are several lessons for information assurance students:
* Rebekah’s overhearing the conversation between Isaac and Esau illustrates HUMINT (human intelligence or espionage).
* Isaac’s question, “Which of my sons are you?” illustrates the concept of identification.
* Jacob’s false self-identification illustrates identity theft or spoofing and the breach of authenticity.
* We see the principle of biometric authentication in action: Isaac depends on known biological attributes of his sons to distinguish between them.
* The concept of false positives is illustrated: Isaac incorrectly identifies an imposter as an authorized person.
* Stealing authentication tokens is illustrated by the use of stolen clothing (and thus the creation of a misleading fragrance as a false input to the authentication scheme).
* Using forged or fabricated inputs (e.g., gummy-bears with fingerprints) is illustrated by the use of baby-goat skin to simulate hairy hands and neck.
* Isaac’s blessing illustrates the concept of authorization following upon authentication (albeit incorrect in this case) and thus brings home the practical importance of identification and authentication.
* The story can be used to prompt discussions of moral questions in class about the illicit use of improperly acquired information and unauthorized access.
Using familiar and archetypal stories may make it easier for beginners to grasp basic concepts in our field. I am sure that there are many other stories from the Bible and from other sources that can serve the same purpose in IA lectures and courses.
