Chapter 6 - Basic Security
Chapter 6 - Basic Security
Chapter 6 - Basic Security
CHAPTER 6 SECURITY
BASIC
NETWORKING THREATS
Intruders who gain access by modifying software or exploiting software vulnerabilities are often called hackers.
NETWORKING THREATS
NETWORKING THREATS
NETWORKING THREATS
NETWORKING THREATS
NETWORKING THREATS
Social Engineering
Refers to the ability of something or someone to influence the behavior of a group of people. Refers to a collection of techniques used to deceive internal users into performing specific actions or revealing confidential information. With these techniques, the attacker takes advantage of unsuspecting legitimate users to gain access to internal resources and private information, such as bank
NETWORKING THREATS
Social Engineering 1) Pretexting
A form of social engineering where an invented scenario (the pretext) is used on a victim in order to get the victim to release information or perform an action. The target is typically contacted over the telephone. For pretexting to be effective, the attacker must be able to establish legitimacy with the intended target, or victim.
NETWORKING THREATS
Social Engineering 2) Phishing
A form of social engineering where the phisher pretends to represent a legitimate outside organization. They typically contact the target individual (the phishee) via email. The phisher might ask for verification of information, such as passwords or usernames in order prevent some terrible consequence from occurring.
NETWORKING THREATS
Social Engineering 3) Vishing/Phone Phishing
A new form of social engineering that uses Voice over IP (VoIP) is known as vishing. With vishing, an unsuspecting user is sent a voice mail instructing them to call a number which appears to be a legitimate telephone-banking service. The call is then intercepted by a thief. Bank account numbers or passwords entered over the phone for verification are
METHODS OF ATTACKS
Viruses
A program that runs and spreads by modifying other programs or files. It cannot start by itself; it needs to be activated. Once activated, a virus may do nothing more than replicate itself and spread. Though simple, even this type of virus is dangerous as it can quickly use all available memory and bring a system to a halt. A more serious virus may be programmed to delete or corrupt specific files before spreading. Viruses can be transmitted via email attachments, downloaded files, instant messages or via diskette, CD
METHODS OF ATTACKS
Worms
Similar to a virus, but unlike a virus does not need to attach itself to an existing program. A worm uses the network to send copies of itself to any connected hosts. Worms can run independently and spread quickly. They do not necessarily require activation or human intervention. Self-spreading network worms can have a much greater impact than a single virus and can infect large parts of the Internet quickly.
METHODS OF ATTACKS
Trojan Horses
Is a non-self replicating program that is written to appear like a legitimate program, when in fact it is an attack tool. It relies upon its legitimate appearance to deceive the victim into initiating the program. It may be relatively harmless or can contain code that can damage the contents of the computer's hard drive. Trojans can also create a back door into a
METHODS OF ATTACKS
METHODS OF ATTACKS
Ping of death
A packet that is greater in size than the maximum allowed by IP (65,535 bytes) is sent to a device. This can cause the receiving system to crash.
METHODS OF ATTACKS
Distributed Denial of Service (DDoS) Is a more sophisticated and potentially damaging form of the DoS attack. It is designed to saturate and overwhelm network links with useless data. DDoS operates on a much larger scale than DoS attacks. Typically hundreds or thousands of attack points attempt to overwhelm a target simultaneously. The attack points may be unsuspecting computers that have been previously infected by the DDoS code. The systems that are infected with the DDoS code
METHODS OF ATTACKS
Brute Force
It is another type of attack that may result in denial of services. With brute force attacks, a fast computer is used to try to guess passwords or to decipher an encryption code. The attacker tries a large number of possibilities in rapid succession to gain access or crack the code. Brute force attacks can cause a denial of service due to excessive traffic to a specific resource or by locking out user accounts.
METHODS OF ATTACKS
Spyware
Spyware is any program that gathers personal information from computer without permission or knowledge. This information is sent to advertisers or others on the Internet and can include passwords and account numbers. Spyware is usually installed unknowingly when downloading a file, installing another program or clicking a popup. It can slow down a computer and make changes to internal settings creating more vulnerabilities for other threats.
METHODS OF ATTACKS
Tracking Cookies
Cookies are a form of spyware but are not always bad. They are used to record information about an Internet user when they visit websites. Cookies may be useful or desirable by allowing personalization and other time saving techniques. Many web sites require that cookies be enabled in order to allow the user to connect.
METHODS OF ATTACKS
Adware
A form of spyware used to collect information about a user based on websites the user visits. That information is then used for targeted advertising. Adware is commonly installed by a user in exchange for a "free" product. When a user opens a browser window, Adware can start new browser instances which attempt to advertize products or services based on a user's surfing practices. The unwanted browser windows can open repeatedly, and can make surfing the Internet very
METHODS OF ATTACKS
METHODS OF ATTACKS
Spam Unwanted bulk email. Merchant want to send their email advertising to as many end users as possible hoping that someone is interested in their product or service. Spam is a serious network threat that can overload ISPs, email servers and individual end-user systems. A person or organization responsible for sending spam is called a spammer. Spammers often make use of unsecured email servers to forward email.
METHODS OF ATTACKS
Spam Spammers can use hacking techniques, such as viruses, worms and Trojan horses to take control of home computers. These computers are then used to send spam without the owner's knowledge. Spam can be sent via email or more recently via Instant messaging software. Spam consumes large amounts of Internet bandwidth and is a serious enough problem that many countries now have laws governing spam use.
SECURITY POLICY
1)
2)
Password Policies
Ensure password meets minimum
SECURITY POLICY
3)
4)
5)
6)
Acceptable Policies Identifies network applications and usages that are acceptable. Remote Access Policies Identify how remote users can access a network and what is accessible via remote connectivity. Network Maintenance Procedures Specifies network device OS and end user application update procedures. Incident Handling Procedures Describe how security incidents will be handled.
SECURITY POLICY
Some of the security tools and applications used in securing a network include:
Software patches and updates Virus protection Spyware protection Spam blockers Pop-up blockers Firewalls
SECURITY POLICY
SECURITY POLICY
SECURITY POLICY
SECURITY POLICY
Anti-virus Software
Can be used as both a preventative tool and as a reactive tool. It prevents infection and detects, and removes, viruses, worms and Trojan horses. Anti-virus software should be installed on all computers connected to the network.
SECURITY POLICY
Anti-virus Software
Some of the features that can be included in Anti-virus programs are:
Email checking - Scans incoming and outgoing emails, and identifies suspicious attachments. Resident dynamic scanning - Checks executable files and documents when they are accessed. Scheduled scans - Virus scans can be scheduled to run at regular intervals and check specific drives or the entire computer. Automatic Updates - Checks for, and downloads, known virus characteristics and
SECURITY POLICY
Anti-Spam
Apply OS and application updates when available. Run an Antivirus program regularly and keep it up to date. Do not forward suspect emails. Do not open email attachments, especially from people you do not know. Set up rules in your email to delete spam that bypass the anti-spam software. Identify sources of spam and report it to a network administrator so it can be blocked. Report incidents to the governmental agency that deals with abuse by spam.
SECURITY POLICY
SECURITY POLICY
Pop-up Blockers
Pop-up stopper software can be installed to prevent pop-ups and pop-unders. Many web browsers include a pop-up blocker feature by default. Note that some programs and web pages create necessary and desirable pop-ups. Most pop-up blockers offer an override feature for this purpose.