Scribd
Upload
102 views28 pages

Hands-On Ethical Hacking and Network Defense

Companies hire ethical hackers to legally perform penetration tests and discover vulnerabilities in a network. Penetration tests are done under various models like white box, black box, and gray box. Security testers can earn certifications like CEH, CISSP, and OPST. They must understand what activities are legally allowed in their state and follow laws, as well as any acceptable use policies of Internet service providers. It is important for security testers to use written contracts approved by an attorney.

Uploaded by

aderhab
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
102 views28 pages

Hands-On Ethical Hacking and Network Defense

Companies hire ethical hackers to legally perform penetration tests and discover vulnerabilities in a network. Penetration tests are done under various models like white box, black box, and gray box. Security testers can earn certifications like CEH, CISSP, and OPST. They must understand what activities are legally allowed in their state and follow laws, as well as any acceptable use policies of Internet service providers. It is important for security testers to use written contracts approved by an attorney.

Uploaded by

aderhab
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 28

Hands-On Ethical Hacking

and Network Defense

Chapter 1
Ethical Hacking Overview
Objectives
• Describe the role of an ethical hacker
• Describe what you can do legally as an ethical
hacker
• Describe what you cannot do as an ethical hacker

Hands-On Ethical Hacking and Network Defense 2


Introduction to Ethical Hacking

• Ethical hackers
– Employed by companies to perform penetration tests
• Penetration test
– Legal attempt to break into a company’s network to
find its weakest link
– Tester only reports findings
• Security test
– More than an attempt to break in; also includes
analyzing company’s security policy and procedures
– Tester offers solutions to secure or protect the
network
Hands-On Ethical Hacking and Network Defense 3
The Role of Security and Penetration
Testers
• Hackers
– Access computer system or network without
authorization
– Breaks the law; can go to prison
• Crackers
– Break into systems to steal or destroy data
– U.S. Department of Justice calls both hackers
• Ethical hacker
– Performs most of the same activities but with owner’s
permission
Hands-On Ethical Hacking and Network Defense 4
The Role of Security and Penetration
Testers (continued)
• Script kiddies or packet monkeys
– Young inexperienced hackers
– Copy codes and techniques from knowledgeable
hackers
• Programming languages used by experienced
penetration testers
– Practical Extraction and Report Language (Perl)
–C
• Script
– Set of instructions that runs in sequence
Hands-On Ethical Hacking and Network Defense 5
The Role of Security and Penetration
Testers (continued)
• Tiger box
– Collection of OSs and hacking tools
– Helps penetration testers and security testers conduct
vulnerabilities assessments and attacks

Hands-On Ethical Hacking and Network Defense 6


Penetration-Testing Methodologies
• White box model
– Tester is told everything about the network topology
and technology
– Tester is authorized to interview IT personnel and
company employees
– Makes tester job a little easier
• Black box model
– Company staff does not know about the test
– Tester is not given details about the network
• Burden is on the tester to find these details
– Tests if security personnel are able to detect an attack

Hands-On Ethical Hacking and Network Defense 7


Hands-On Ethical Hacking and Network Defense 8
Penetration-Testing Methodologies
(continued)
• Gray box model
– Hybrid of the white and black box models
– Company gives tester partial information

Hands-On Ethical Hacking and Network Defense 9


Certification Programs for Network
Security Personnel
• Certification programs available in almost every
area of network security
• Other certifications that help prepare for these
certifications
– CompTIA Security+
– Network+

Hands-On Ethical Hacking and Network Defense 10


Certified Ethical Hacker (CEH)
• Developed by the International Council of Electronic
Commerce Consultants (EC-Council)
• Based on 21 domains (subject areas)
• Web site
– www.eccouncil.org
• Red team
– Conducts penetration tests
– Composed of people with varied skills

Hands-On Ethical Hacking and Network Defense 11


OSSTMM Professional Security Tester
(OPST)
• Designated by the Institute for Security and Open
Methodologies (ISECOM)
• Based on the Open Source Security Testing
Methodology Manual (OSSTMM)
– Written by Peter Herzog
• Consists of 5 domains
• Web site
– www.isecom.org

Hands-On Ethical Hacking and Network Defense 12


Certified Information Systems Security
Professional (CISSP)
• Issued by the International Information Systems
Security Certifications Consortium (ISC2)
• Usually more concerned with policies and procedures
• Consists of 10 domains
• Web site
– www.isc2.org

Hands-On Ethical Hacking and Network Defense 13


SANS Institute
• SysAdmin, Audit, Network, Security (SANS)
• Offers certifications through Global Information
Assurance Certification (GIAC)
• Top 20 list
– One of the most popular SANS Institute documents
– Details the most common network exploits
– Suggests ways of correcting vulnerabilities
• Web site
– www.sans.org

Hands-On Ethical Hacking and Network Defense 14


What You Can Do Legally
• Laws involving technology change as rapidly as
technology itself
• Find what is legal for you locally
– Laws change from place to place
• Be aware of what is allowed and what is not allowed

Hands-On Ethical Hacking and Network Defense 15


Laws of the Land

• Tools on your computer might be illegal to possess


• Contact local law enforcement agencies before
installing hacking tools
• Written words are open to interpretation
• Governments are getting more serious about
punishment for cybercrimes

Hands-On Ethical Hacking and Network Defense 16


Hands-On Ethical Hacking and Network Defense 17
Hands-On Ethical Hacking and Network Defense 18
Is Port Scanning Legal?
• Some states deem it legal
• Not always the case
• Federal Government does not see it as a violation
– Allows each state to address it separately
• Read your ISP’s “Acceptable Use Policy”
• IRC “bot”
– Program that sends automatic responses to users
– Gives the appearance of a person being present

Hands-On Ethical Hacking and Network Defense 19


Hands-On Ethical Hacking and Network Defense 20
Federal Laws
• Federal computer crime laws are getting more
specific
– Cover cybercrimes and intellectual property issues
• Computer Hacking and Intellectual Property (CHIP)
– New government branch to address cybercrimes and
intellectual property issues

Hands-On Ethical Hacking and Network Defense 21


Hands-On Ethical Hacking and Network Defense 22
What You Cannot Do Legally
• Accessing a computer without permission is illegal
• Other illegal actions
– Installing worms or viruses
– Denial of Service attacks
– Denying users access to network resources
• Be careful your actions do not prevent customers from
doing their jobs

Hands-On Ethical Hacking and Network Defense 23


Get It in Writing
• Using a contract is just good business
• Contracts may be useful in court
• Books on working as an independent contractor
– The Computer Consultant’s Guide by Janet Ruhl
– Getting Started in Computer Consulting by Peter Meyer
• Internet can also be a useful resource
• Have an attorney read over your contract before
sending or signing it

Hands-On Ethical Hacking and Network Defense 24


Ethical Hacking in a Nutshell
• What it takes to be a security tester
– Knowledge of network and computer technology
– Ability to communicate with management and IT
personnel
– Understanding of the laws
– Ability to use necessary tools

Hands-On Ethical Hacking and Network Defense 25


Summary
• Companies hire ethical hackers to perform
penetration tests
• Penetration tests discover vulnerabilities in a network
• Security tests are performed by a team of people with
varied skills
• Penetration test models:
– White box model
– Black box model
– Gray box model
• Security testers can earn certifications
Hands-On Ethical Hacking and Network Defense 26
Summary (continued)
• Certifications
– CEH
– CISSP
– OPST
– Sans Institute
• Be aware of what you are legally allowed or not
allowed to do
• Laws change from place to place
• ISPs usually have an “Acceptable Use Policy”

Hands-On Ethical Hacking and Network Defense 27


Summary (continued)
• State and federal laws should be understood
before conducting a security test
• Get it in writing
– Use a contract
– Have an attorney read the contract

Hands-On Ethical Hacking and Network Defense 28

You might also like