1. Vulnerability Analysis Stefanie Wilcox

2. Vulnerabilities zHardware zSoftware zData

3. Hardware Vulnerabilities zDevices-adding, removing zTraffic-interrupting, flooding zPhysical Attacks yInvoluntary machine slaughter yMachinicide yTheft x“... thousands of dollars worth of equipment sits unattended on desks. Curiously, the supply cabinet, containing only a few hundred dollars worth of pens, pencils and paper clips is often locked....”

4. Software Vulnerabilities zSoftware Deletion zSoftware Modification yLogic Bombs yTrojan Horse yVirus yTrapdoor yInformation Leaks zSoftware Theft yUnauthorized copying

5. Data Vulnerabilities zConfidentiality yunauthorized disclosure of a data item zIntegrity yunauthorized modification zAvailability ydenial of authorized access

6. Penetration Studies zAlso called tiger team attack or red team attack zTests the system once it is in place. zGoal is to violate the site security policy. yType 1 yAuthorized attempt to violate specific constraints stated in the for of a security or integrity policy. yPenetration Test Example. yType 2 yNo specific target. Find some number of vulnerabilities in a set period of time. yPenetration Test Example.

7. Penetration Studies cont’ zLayering of tests y1) External attacker with no knowledge of the system y2) External attacker with access to the system. y3) Internal attacker with access to the system.

8. Flaw Hypothesis Methodology z1) Information Gathering z2)Flaw Hypothesis z3)Flaw Testing z4)Flaw Generalization z5)Flaw Elimination

9. Vulnerability Classification z1)The ability to specify, design, and implement a computer system without vulnerabilities. z2)The ability to analyze a computer system to detect vulnerabilities. z3)The ability to address any vulnerabilities introduced during the operation of the computer system. z4)The ability to detect attempted exploitation's of vulnerabilities

10. Frameworks zThe RISOS Study zProtection Analysis Model zNRL Taxonomy zAslam’s Model

11. Bibliography zBishop, Matt. Computer Security