Intro to Network Security

Vocabulary Vulnerability Weakness that can be compromised Threat A method to exploit a vulnerability Attack Use of one or more threats Countermeasure Action taken to protect from vulnerabilities

Threats to System Security Viruses Technically a malicious program which must run to spread itself General use: any malicious program Worm Once started, spreads itself through network Trojan Horse Something that looks good to begin with, but beats you up later Logic Bomb Waits for a trigger and then detonates. Trigger could be date, data, and/or combination of events.

Threats to Internet Security System Vulnerabilities A trusted Computer is compromised. Holy Grail is to get the administrative account Application Vulnerabilities Network services User applications Network Vulnerabilities Denial of Service Packet Sniffing Brute Force Attack Brute Force

System Countermeasures OS updates particularly Microsoft Antivirus Software System Software Firewall (helps keep out the worms) Disaster Recovery Preparation: Expect the Worst.

Network Security Countermeasures Intrusion Detection System Sniffer: listens to packets looking for attack. Tripwire: Lets you know system has been altered. If you don’t know you have been compromised, you can’t recover from it. Sniffing IDS can indicate source and nature of attack. Sniffing IDS that sends an alarm thwarts a coverup. See snort.org

Network Countermeasures continued Run only needed services. If the service isn’t running it can’t be exploited Update service frequently, especially after a vulnerability discovery. Application Sercurity Look for updates: especially Microsoft. Disable scripting features if not used.

Network Countermeasures still continued DDOS attacks are out of your control. You can secure the server, but the network? Firewall filter is too late. Traceback or Packet tagging must occur “in the cloud.” Stop the Zombies! Stop the Zombies!

Packet Sniffing Network sniffing for passords or worse Inside Job Threat has been greatly lessened due to switching Switches can still be compromised Arp spoofing MAC Flooding

Brute Force Attacks Use secure Passwords. See 10 Most Common PasswordsSee 10 Most Common Passwords Set (stateful) Firewall Rules to limit logins from 1 host (I use 3 attempts/minute) Account Lockouts CAPTCHA: Those annoying pictures where you have to “GUESS” what the letters are in the picture.

Anatomy of an Attack 1. Target Selection 2. Information Gathering Information Gathering 3. Port Scan/Vulnerability Assessment 4. Penetration: successful attack 5. Persist : backdoor 6. Propogate: use trusted machine to spread 7. Payload: DDOS, Surveillance, theft of information, make phone calls,