1 NES554: Computer Networks Defense Course Overview

Instructor’s Information Dr. Basheer Al-Duwairi Location: E1L3 Office Hours: SUN, TUE, THU (10:15 – 11:15) or by appointment Webpage:

Resources Lecture notes and research papers Textbook: Guide to Network Defense and Countermeasures, 3 rd edition, by Randy Weaver, Dawn Weaver, Dean Farwood, Cengage Learning, 2013, ISBN- 10: , ISBN-13: Secondary/References: Computer Security: Principles and Practice, 2/E, William Stallings, Lawrence Brown ISBN-10: , ISBN-13: , Publisher: Prentice Hall, Copyright: 2012

Course Objectives Identify, investigate and analyze threats to network security. Identify the fundamental concepts and practices in network defense. Design, implement and operate effective network defense measures to protect the networks from intrusions. Describe router security controls and create access control lists. Describe the concepts of signature analysis and detect normal and suspicious traffic signatures Identify the components of an intrusion detection and prevention system

Course Objectives (Contd.) Describe options for implementing intrusion detection and prevention systems Describe common approaches to packet filtering design packet filtering and firewall rule sets Design and deploy and operate appropriate firewalls. Describe Virtual Private Network (VPN) Concepts. Understand the process involved in IT security management. Outline the process of selecting suitable controls to address risks

Topics to be covered Introduction Attacks and Hacker Tools Botnets Network Traffic Signatures Router Security IP Traceback

Topics to be covered (Contd.) Intrusion Detection and Prevention Systems Firewalls Virtual Private Networks Security Management and Risk Assessment Security Controls, Plans and Procedures

Introduction-Security review Basic security concepts Information Security vs. Infrastructure Security Emerging Security Threats

Introduction-Attackers Motivation for us Identification of Them – Skills - Hierarchy – Motives – Notable Individuals and Groups - History Impact of Them on us Resources

Attacks and Hacker Tools Reconnaissance Network mapping Port scanning Sniffing IP address spoofing Session hijacking

Botnets Botnet formation Botnet Life Time IRC-Based Botnets P2P- Botnets New Trends in Botnet Design Botnet-Based Attacks DDoS Attacks Spam Identity Theft Phishing Click Fraud

Network Traffic Signatures Describe the concepts of signature analysis Detect normal and suspicious traffic signatures Identify suspicious events Explain the Common Vulnerabilities and Exposures (CVE) standard

Router Security Creating and Using Access Control Lists Use and Rules Standard ACLs Extended ACLs Named ACLs Examining Cisco Router Logging Cisco Authentication and Authorization

IP Traceback Probabilistic packet marking Hash-based IP traceback

Intrusion Detection & Prevention Goals of an IDPS Common Detection Methodologies Examining IDPS Components Options for IDPSs Securing IDPS Components Developing IDPS Filter Rules Examining Intrusion Detection Step by Step

Firewalls Overview of Firewalls Packet Filtering and Firewall Rule Sets Designing Firewall Configurations Examining Proxy Servers Choosing a Bastion Host Network Address Translation

VPNs VPN Components Types of VPNs Evaluating Business Needs for VPNs Advantages and Disadvantages of VPNs Examining VPN Design and Architecture

Security Management and Risk Assessment IT Security Management Organizational Context and Security Policy Security Risk Assessment Detailed Security Risk Analysis Case Study: Silver Star Mines

Security Controls, Plans and Procedures IT Security Management Implementation Security Controls or Safeguards IT Security Plan Implementation of Controls Implementation Follow-up Case Study: Silver Star Mines

Grading Policy Two midterm exams 20% each HW assignments 20 % Final exam 40 %