IS Network and Telecommunications Risks Chapter Six

Network Components Computers and terminals Computers processed data in a networked telecommunication system Networked computers send and receive data from terminals Telecommunications channels – physical and wireless Telecommunications processors Routers and switching devices

Network Types Local versus wide area networks Internet, intranet, extranet Virtual private networks (VPN) Client/server networks

Network Configuration Types Star-shaped – centralized Ring – decentralized Bus - decentralized

Network Protocols and Software Open Systems Interconnect (OSI) model – a standard architecture for networking that allows different computers to communicate across networks Network and telecommuncations software – network OS, networks management software, middleware, web browsers, software

IS Network and Telecommunications Risks Social Engineering Physical Infrastructure Threats – the elements, natural disasters, power supply, intentional human attacks Programmed Threats – viruses, worms, Trojan horses, hoaxes, blended threats Denial of Service Attacks Software Vulnerabilities

Social Engineering Techniques Familiarity exploit Gathering and using information Phishing Tailgating Quid pro quo

Sample Scenario In one penetration test, Nickerson used current events, public information available on social network sites, and a $4 Cisco shirt he purchased at a thrift store to prepare for his illegal entry. The shirt helped him convince building reception and other employees that he was a Cisco employee on a technical support visit. Once inside, he was able to give his other team members illegal entry as well. He also managed to drop several malware-laden USBs and hack into the company's network, all within sight of other employees. Source: basics

Countermeasures Personnel training Awareness program Establish security protocols

IS Network and Telecommunications Security Network security administration Authentication Encryption – secret key and public key Firewalls – packet filtering and stateful inspection Intrusion Detection Systems Penetration Testing – war dialing, port scanning, sniffers, password crackers

Auditing Network Security Risk assessment and best practices Benchmark tools IT audit programs for network security

Security Service Comparison Evaluation against policy and security baseline Regulatory / industry compliance, e.g. SOX Evaluation against standards such as NIST800/ISO27002 Governance Framework – COBIT/COSO

Testing Security Controls Risk assessment Policy assessment Social Engineering Security Design review Security process review Document review Technology review