Lesson Objectives Aims You should be able to: Describe methods of identifying and preventing attacks, including: Penetration Testing Network Forensics Network Policies Anti-Malware Software Firewalls User Access Levels/Rights User accounts and Passwords Encryption

We discussed common threats to network security Last time… We discussed common threats to network security Now we need to look at what we do to: Prevent attacks Find out what happened Protect users and systems

Penetration testing Penetration testing is quite simply the best job ever. Penetration testing is where a company pays someone to: Deliberately break in to their systems In any way possible Without warning Steal as much as possible (both data and physical objects!) Produce a report afterwards

Penetration Testing It usually involves: Lots of social engineering Lots of observation about working practises, habits of employees and potential targets Collecting data from employees Creating fake credentials Finding a way in to a building or system Running amok.

Penetration Testing Read this: https://www.theregister.co.uk/2016/12/08/inside_hacking_a_business_feature/ If you can handle books, read this:

Penetration Testing The outcome of this is: Real world testing Finding vulnerabilities not only in computer systems but also policies and people! An indication of how secure your data really is

Most forensics involves: Network Forensics If someone breaks your system, you might want to find out how it happened Most forensics involves: Reading through log files Investigating suspicious files Tracing network addresses Finding security holes that have been exploited

Network Policy Network policy is designed to protect your systems in the first place It can cover LOTS of things: Usernames and passwords Permissions Who can see what (shares) Who can do what (access rights, install/execute etc) When people can do things Which machines people can use How servers and machines are configured How security updates are applied and when

Firewall/Anti Malware We’ve looked at firewalls before: Hardware or software Inspects packets Blocks packets based on a set of rules On both incoming and outgoing traffic Anti-Malware: Used to scan files, downloads, websites, usb drives etc Looks for malicious software using signatures and heuristics

User Accounts/Passwords Aren’t they obvious? Provides a level of authentication on a system Provides an audit trail (log) of who used what and when (but you can steal credentials, remember!) Used to set access rights, permissions and shares First line of defence on a network – if you shouldn’t be on there, you shouldn’t be able to log in!

Rights/Access Levels Access rights and levels: What can they do: Administrator Power user Standard user Restricted user What can they do: Just read files? Read/Write but to a certain area Install software Change settings and configs

Encryption We did encryption in a previous lesson: Scrambles data So that it cannot be understood even if intercepted Usually using a key Cannot be decrypted without a key Provides protection for data even if stolen/intercepted