CIT 380: Securing Computer SystemsSlide #1 CIT 380 Securing Computer Systems Threats

Vocabulary CIA Triad –Confidentiality –Integrity –Availability States of Information –Storage –Processing –Transmission CIT 380: Securing Computer SystemsSlide #2

Vocabulary Security Measures –Technology –Policies and practices –Education, Training, and awareness Threats, Attacks, Assets Prevention, Detection, Recovery, Survivability CIT 380: Securing Computer SystemsSlide #3

Vocabulary Risk Security trade-offs Cost-Benefit Analysis Script Kiddies Security Researchers Hacker, Cracker, Attacker Black Hat, White Hat CIT 380: Securing Computer SystemsSlide #4

CIT 380: Securing Computer SystemsSlide #5 What are threats? What threats can you think of to your home? To your money (including bank accounts, checks, credit and debit cards)? To your home computer?

CIT 380: Securing Computer SystemsSlide #6 Digital Threats: More of the Same Theft Vandalism Extortion Con Games Fraud Stalking

CIT 380: Securing Computer SystemsSlide #7 Digital Threats: What’s Different Automation –Salami Attack from Office Space. Action at a Distance –Volodya Levin, from St. Petersburg, Russia, stole over $10million from US Citibank. Arrested in London. –Operators of CA BBS tried and convicted in TN court because TN had d/led pornography f/ CA.

Digital Threats: What’s Different Technique Propagation –Criminals share techniques rapidly and globally. CIT 380: Securing Computer SystemsSlide #8

Next Slide The percentage of respondents answering that their organization experienced unauthorized use of computer systems in the last 12 months CIT 380: Securing Computer SystemsSlide #9

CIT 380: Securing Computer SystemsSlide #10

CIT 380: Securing Computer SystemsSlide #11 Survival Time

The main issue here is of course that the time to download critical patches will exceed this survival time. CIT 380: Securing Computer SystemsSlide #12

CIT 380: Securing Computer SystemsSlide #13 Current Threat Information SANS Internet Storm Center – Bugtraq – – CERT –

Current Threat Information Packet Storm – CIT 380: Securing Computer SystemsSlide #14

CIT 380: Securing Computer SystemsSlide #15 Who are the Attackers? Hackers vs Crackers Levels of attackers –Developer Finds new security vulnerabilities Writes tools and exploits –User Understands tools; modifies tools/exploits –Script Kiddie

CIT 380: Securing Computer SystemsSlide #16 Who are the Attackers? Criminals. –1993: Thieves installed bogus ATM at Manchester Mall. Saved account#s + PINs. Organized crime. –2000: Mafia-led organization members arrested for attempt to steal $680million from Bank of Sicily. Malicious insiders. –2001: Mike Ventimiglia deletes files of his employer, GTE. $200,000 damage. Industrial espionage. –2001: Verdicts in Cadence Design Systems vs. Avant against 7 employees incl CEO. 5 sentenced to jail.

CIT 380: Securing Computer SystemsSlide #17 Who are the Attackers? Press. –1998: Cincinnati Enquirer reporter Michael Gallagher breaks into Chiquita Fruits voic to expose illegal activities. Police. –1997: LAPD illegal wiretapping scandal. Terrorists. –1999: DOS attacks and web defacements against NATO country computers during Kosovo bombings. National Intelligence. –2000: Former CIA Directory Woolsey admitted to using ECHELON information to help US companies win foreign contracts.

Scary Internet Stuff: Underground __Dxk&feature=relatedhttp:// __Dxk&feature=related CIT 380: Securing Computer SystemsSlide #18

CIT 380: Securing Computer SystemsSlide #19 What Are Our Defenses? Firewalls Virus Scanners Spyware Scanners Intrusion Detection Systems (IDS/IPS) Patches Backups Prevent Detect Respond Recover

CIT 380: Securing Computer SystemsSlide #20 What Are The Attacks? Phishing Malware Ransomware Spyware Botnets

CIT 380: Securing Computer SystemsSlide #21 Phishing

CIT 380: Securing Computer SystemsSlide #22 Phishing Site

Scary Internet Stuff: Phishing 3x3I&feature=relatedhttp:// 3x3I&feature=related CIT 380: Securing Computer SystemsSlide #23

Amazon.com - Your Cancellation ( ) Dear Customer, Your order has been successfully canceled. For your reference, here`s a summary of your order: You just canceled order # Status: CANCELED _____________________________________________________________________ ORDER DETAILS Sold by: Amazon.com, LLC _____________________________________________________________________ Because you only pay for items when we ship them to you, you won`t be charged for any items that you cancel. Thank you for visiting Amazon.com! Amazon.com Earth`s Biggest Selection ORDER DETAILS CIT 380: Securing Computer SystemsSlide #24

CIT 380: Securing Computer SystemsSlide #25 Malware Trojan Horses Viruses Worms

CIT 380: Securing Computer SystemsSlide #26 Ransomware

CIT 380: Securing Computer SystemsSlide #27 Spyware and Adware Most Trojan Horses, some infect directly. –Browser hijacking –Pop-up advertisements –Keystroke and network logging –Steal confidential data from and files

Spyware and Adware 89% of PCs are infected with spyware (2006Q2 Webroot.) – re/excerpt.htmlhttp:// re/excerpt.html CIT 380: Securing Computer SystemsSlide #28

CIT 380: Securing Computer SystemsSlide #29 Rootkits Execution Redirection File Hiding Process Hiding Network Hiding User Program Rootkit OS

Rootkits Video NkZ4http:// NkZ4 CIT 380: Securing Computer SystemsSlide #30

CIT 380: Securing Computer SystemsSlide #31 Botnets Worm or direct attack usurps control of PC, then installs control software to listen for instructions. Instructions can include: Attempt to infect other PCs Send spam message Launch DOS attack Upgrade attack and control software Virus writers sell botnets to spammers for $0.10/compromised PC

Scary Internet Stuff: Botnets pNSshttp:// pNSs CIT 380: Securing Computer SystemsSlide #32

Wikipedia: Botnet –Historical list of botnets Kraken botnet – CIT 380: Securing Computer SystemsSlide #33

CIT 380: Securing Computer SystemsSlide #34 Key Points Computer crimes same as pre-computer crimes. Differences in digital threats –Automation –Action at a distance –Technique propagation Digital threats –Phishing –Malware –Ransomware –Spyware –Botnets

CIT 380: Securing Computer SystemsSlide #35 References 1.Alexander Gostev et. al., “Malware Evolution: January – March 2006,” Virus List, April 12, The Honeynet Project, Know Your Enemy, 2nd edition, Addison-Wesley, John Leyden, "The illicit trade in compromised PCs," The Register, Apr Stuart McClure, Joel Scambray, and George Kurtz, Hacking Exposed, 5th edition, McGraw-Hill, Rachna Dhamija and J. D. Tygar, "The Battle Against Phishing: Dynamic Security Skins," Proceedings of the Symposium on Usable Privacy and Security (SOUPS), July SANS Internet Storm Center, 7.Schneier, Bruce, Beyond Fear, Copernicus Books, Ed Skoudis, Counter Hack Reloaded, Prentice Hall, Stuart Staniford, Vern Paxson, and Nicholas Weaver, "How to 0wn the Internet in Your Spare Time," Proceedings of the 11th USENIX Security Symposium, Richard Stiennon, "Spyware: 2004 Was Only the Beginning," CIO Update, Jan Thompson, Ken, “Reflections on Trusting Trust”, Communication of the ACM, Vol. 27, No. 8, August 1984, pp (