TCOM Information Assurance Management Casing the Establishment

TCOM Target Acquisition Systematic Footprinting -building a profile of your security posture Focused on information relating to Internet, intranet, remote access and extranet…of your system

TCOM Internet Footprinting Determine the Scope of Your Activities –Open Source –SEC EDGAR DB –Countermeasure: Public Database Security...

TCOM Internet Footprinting Network Enumeration –InterNIC DB –Organizational Query -”Whois” All information related to a particular organization May be hundreds or thousands of entries

TCOM Internet Footprinting –Domain Query The registrant The domain name The admin contact When the record was created and updated The DNS servers

TCOM Internet Footprinting –Network Query American Registry of Internet Numbers Other Domains the DNS server is authoritative Backbone provider, network class Confirm network belongs to target

TCOM Internet Footprinting –POC Query All addresses of POCs Complete help reference

TCOM Internet Footprinting Countermeasure: Public Database Security –Update admin, tech, and billing information –Fictitious contact as tripwire

TCOM Internet Footprinting DNS Interrogation –Serious misconfiguration –Internet Zone Transfers –Can provide a complete roadmap of an organizations internal network

TCOM Internet Footprinting Countermeasure: DNS Security –Reduce the available information –External servers must never be configured to reveal internal network information

TCOM Internet Footprinting Network Reconnaissance –Tracerouting –Build an access path diagram Countermeasure: IDS –RotoRouter - logs traceroute requests and generates false responses