1. Lesson Objectives Aims You should be able to:
Describe methods of identifying and preventing attacks, including:
Penetration Testing
Network Forensics
Network Policies
Anti-Malware Software
Firewalls
User Access Levels/Rights
User accounts and Passwords
Encryption

2. We discussed common threats to network security
Last time…
We discussed common threats to network security
Now we need to look at what we do to:
Prevent attacks
Find out what happened
Protect users and systems

3. Penetration testing
Penetration testing is quite simply the best job ever.
Penetration testing is where a company pays someone to:
Deliberately break in to their systems
In any way possible
Without warning
Steal as much as possible (both data and physical objects!)
Produce a report afterwards

4. Penetration Testing It usually involves: Lots of social engineering
Lots of observation about working practises, habits of employees and potential targets
Collecting data from employees
Creating fake credentials
Finding a way in to a building or system
Running amok.

5. Penetration Testing
Read this: If you can handle books, read this:

6. Penetration Testing The outcome of this is: Real world testing
Finding vulnerabilities not only in computer systems but also policies and people!
An indication of how secure your data really is

7. Most forensics involves:
Network Forensics
If someone breaks your system, you might want to find out how it happened
Most forensics involves:
Reading through log files
Investigating suspicious files
Tracing network addresses
Finding security holes that have been exploited

8. Network Policy
Network policy is designed to protect your systems in the first place
It can cover LOTS of things:
Usernames and passwords
Permissions
Who can see what (shares)
Who can do what (access rights, install/execute etc)
When people can do things
Which machines people can use
How servers and machines are configured
How security updates are applied and when

9. Firewall/Anti Malware
We’ve looked at firewalls before:
Hardware or software
Inspects packets
Blocks packets based on a set of rules
On both incoming and outgoing traffic
Anti-Malware:
Used to scan files, downloads, websites, usb drives etc
Looks for malicious software using signatures and heuristics

10. User Accounts/Passwords
Aren’t they obvious?
Provides a level of authentication on a system
Provides an audit trail (log) of who used what and when (but you can steal credentials, remember!)
Used to set access rights, permissions and shares
First line of defence on a network – if you shouldn’t be on there, you shouldn’t be able to log in!

11. Rights/Access Levels Access rights and levels: What can they do:
Administrator
Power user
Standard user
Restricted user
What can they do:
Just read files?
Read/Write but to a certain area
Install software
Change settings and configs

12. Encryption We did encryption in a previous lesson: Scrambles data
So that it cannot be understood even if intercepted
Usually using a key
Cannot be decrypted without a key
Provides protection for data even if stolen/intercepted