1. Network Security Introduction Some of these slides have been modified from slides of Michael I. Shamos COPYRIGHT © 2003 MICHAEL I. SHAMOS

2. Reading list For current lecture: Required: Pfleeger Chapters 7.1, 7.2, 7.3 Recommended: www.cert.org

3. Internet Connectivity  Advantage: private networks able to reach and communicate with the outside word  Disadvantage: outside world can also reach and interact with the private network

4. Advantages of Networks Resource sharing Distributed workload Increased reliability Expandability

5. Security in Networks  Sharing: increased number of users  System complexity: heterogeneous operating and control systems  Unknown perimeter: shared nodes, new nodes  Many points of attack: hosts and communications as a unit  Anonymity: location and identity of attacker  Unknown routing: delivery path of messages

6. Security Threat Analysis Local threats Network related threats

7. Local Threats Local nodes Local communications Local storage Local devices

8. Network Threats Network gateways Network communications Network control resources Network routers Network resources

9. Specific Security Threats Interception of data in transit Access to programs or date at remote hosts Modification of programs or data at remote hosts Modification of data in transit Insertion of communications impersonating a user Insertion of a repeat of a previous communication Blocking a selected traffic Running a program on a remote host

10. Client Side What can the server do to the client? Fool it Install or run unauthorized software, inspect/alter files COPYRIGHT © 2003 MICHAEL I. SHAMOS

11. Server Side What can the client do to the server? Bring it down (denial of service) Gain access (break-in) COPYRIGHT © 2003 MICHAEL I. SHAMOS

12. Network Perspective Is anyone listening? (Sniffing) Is the information genuine? Are the parties genuine? COPYRIGHT © 2003 MICHAEL I. SHAMOS

13. Early 1990’s Internet social engineering attacks Sniffers Packet spoofing Hijacking sessions Automated probes/scans COPYRIGHT © 2003 MICHAEL I. SHAMOS

14. Middle 1990’s Automated widespread attacks Executable code attacks (against browsers) Widespread denial-of-service attacks Techniques to analyze code for vulnerabilities without the source GUI intruder tools COPYRIGHT © 2003 MICHAEL I. SHAMOS

15. Late 1990’s Widespread attacks using NNTP to distribute attack “Stealth”/Advanced scanning techniques Widespread attacks on DNS infrastructure Windows-based remote controllable Trojans (back orifice) COPYRIGHT © 2003 MICHAEL I. SHAMOS

16. Even Later 1990’s Email propagation of malicious code Increase in wide-scale Trojan horse distribution Distributed attack tools Distributed denial-of-service tools COPYRIGHT © 2003 MICHAEL I. SHAMOS

17. What is a Firewall? A device placed between two networks or machines All traffic in and out must pass through the firewall Only authorized traffic is allowed to pass The firewall itself is immune to penetration COPYRIGHT © 2003 MICHAEL I. SHAMOS

18. Denial-of-Service Attacks Attack to disable a machine (server) by making it unable to respond to requests Use up resources Bandwidth, swap space, RAM, hard disk Some attacks yield millions of service requests per second COPYRIGHT © 2003 MICHAEL I. SHAMOS

19. Rate Limiting  Allows network managers to set bandwidth limits for users and by traffic type.  Prevents deliberate or accidental flooding of the network SOURCE: CISCO COPYRIGHT © 2003 MICHAEL I. SHAMOS

20. Code Attacks: Viruses Virus executable code that attaches itself to other executable code (infection) to reproduce itself (spread) replicator + concealer + payload COPYRIGHT © 2003 MICHAEL I. SHAMOS

21. Code Attacks: Others Rabbit, Worm program that makes many copies of itself and spreads them. Each copy makes copies, etc. Worm spreads via networks. Trojan Horse performs unauthorized activity while pretending to be another program. Example: fake login program COPYRIGHT © 2003 MICHAEL I. SHAMOS

22. Virus Characteristics Some virus families have common characteristics Presence or absence of particular strings File virus Compare size with known backup copy. Presence of strings, like “.EXE” COPYRIGHT © 2003 MICHAEL I. SHAMOS

23. Virus Detection Antiviral software Only detects what it know how to detect. Must be upgraded regularly for new viruses. Symantec encyclopedia Retrovirus Attacks or disables antivirus software COPYRIGHT © 2003 MICHAEL I. SHAMOS