Attacks Framework Attacks Physical Access Attacks -- Wiretapping Server Hacking Vandalism Dialog Attacks -- Eavesdropping Impersonation Message Alteration Penetration Attacks Social Engineering -- Opening Attachments Password Theft Information Theft Scanning (Probing) Break-in Denial of Service Malware -- Viruses Worms

Social Engineering Attacks and Defenses Social Engineering  Tricking an employee into giving out information or taking an action that reduces security or harms a system  Opening an attachment that may contain a virus  Asking for a password claiming to be someone with rights to know it  Asking for a file to be sent to you

Social Engineering Attacks and Defenses Social Engineering Defenses  Training  Enforcement through sanctions (punishment)

Eavesdropping on a Dialog Client PC Bob Server Alice Dialog Attacker (Eve) intercepts and reads messages Hello

Impersonation and Authentication Client PC Bob Server Alice Attacker (Eve) I’m Bob Prove it! (Authenticate Yourself)

Message Alteration Client PC Bob Server Alice Dialog Attacker (Eve) intercepts and alters messages Balance = $1 Balance = $1 Balance = $1,000,000 Balance = $1,000,000

Scanning (Probing) Attacks Probe Packets to , , etc. Internet Attacker Corporate Network Host No Host No Reply Reply from Results is reachable is not reachable …

Denial-of-Service (DoS) Flooding Attack Message Flood Server Overloaded By Message Flood Attacker

Network Penetration Attacks and Firewalls Attack Packet Internet Attacker Hardened Client PC Hardened Server Internal Corporate Network Passed Packet Dropped Packet Internet Firewall Log File