CSF_Week_2_Assignment

*

*

Identify the top threats to a computer network: malware, intrusion, Denial of service attacks

Assess the likelihood of an attack on your personal computer and network

Define key terms such as cracker, sneaker, firewall and authentication

Compare and contrast perimeter and layered approaches to network security

Use online resources to secure your network

*

Computer systems are everywhere.

• Online banking, ATMs, debit cards
• E-Bay, Amazon, Half.com for textbooks
• Expedia, Travelocity, airplane e-tickets

*

How is my online personal information safeguarded?

Passwords, account numbers, etc.

What are the vulnerabilities to these systems?

Web site security

What steps are taken to ensure that these systems and data are safe?

SSL, Encryption, etc.

*

Which group do you belong to?:

“No one is coming after me/my computer.”

Prove to me that I am at risk

Ostrich Theory

“The sky is falling!!”

Prove to me that I am not at risk

Paranoia

Middle Ground

An educated awareness of true risk

*

Malware – MALicious softWARE, the most common threat to your system

Intrusions – an attempt to gain unauthorized access to your system

DoS – Denial of Service attacks, attempts to deny authorized users access to the system

*

Virus – “a small program that replicates itself and hides itself inside other programs, usually without your knowledge” (Symantec, 2003)

Trojan horse - a malicious program disguised as something desirable or harmless

Spyware – the fastest-growing category of malware

*

One of the two most common types of malware

Usually spreads itself through unsuspecting user’s e-mail

Even without malicious payload, rapid replication uses system resources, causing slow down or stoppage

*

The other most common kind of malware

Named after the famous wooden horse of ancient history

It disguises itself as something benign, something you need or want, i.e. a game, screen saver, account logon, etc

It captures your information and returns it to the intruder

*

Spyware is the most rapidly growing type of malware.

Cookies: initially a good idea to help users surf the Web, now misused to spy on users

Key logger: both in software and hardware, captures all the user’s typing and logs it, capturing passwords, account numbers, credit card numbers, etc.

*

Spyware is the most rapidly growing type of malware.

Cookies: initially a good idea to help users surf the Web, now misused to spy on users

Key logger: both in software and hardware, captures all the user’s typing and logs it, capturing passwords, account numbers, credit card numbers, etc.

*

Intrusions are attacks that break through your system’s resources without authorization

Hackers – early internet joy riders, by intent not malevolent

Crackers – system intruders, with malevolent intent

Social Engineering – intruding into a system using human nature, not technology

War driving – driving around looking for unprotected wireless networks

*

The attacker does not actually intrude into the system, just blocks access from authorized users

Keeps your customers from purchasing on your Web site, denying you sales

Keeps your employees from purchasing e-tickets to a trade show, making them use a travel agent, which costs more money than you had planned

Keeps you from transferring the money from your business Line of Credit to your business account to pay for the tickets, causing your account to be overdrawn

*

The attacker does not actually intrude into the system, just blocks access from authorized users

Keeps your customers from purchasing on your Web site, denying you sales

Keeps your employees from purchasing e-tickets to a trade show, making them use a travel agent, which costs more money than you had planned

Keeps you from transferring the money from your business Line of Credit to your business account to pay for the tickets, causing your account to be overdrawn

*

The attacker does not actually intrude into the system, just blocks access from authorized users

Keeps your customers from purchasing on your Web site, denying you sales

Keeps your employees from purchasing e-tickets to a trade show, making them use a travel agent, which costs more money than you had planned

Keeps you from transferring the money from your business Line of Credit to your business account to pay for the tickets, causing your account to be overdrawn

*

The attacker does not actually intrude into the system, just blocks access from authorized users

Keeps your customers from purchasing on your Web site, denying you sales

Keeps your employees from purchasing e-tickets to a trade show, making them use a travel agent, which costs more money than you had planned

Keeps you from transferring the money from your business Line of Credit to your business account to pay for the tickets, causing your account to be overdrawn

*

Viruses are most common network attacks

Check any AV vendor Web site to catch up on new and refurbished viruses

Unauthorized use of systems is the next most common attack

DoS attacks

Intrusions

Employee misuse, either deliberate or accidental

*

People

Hackers – anyone who studies a system through analyzing its flaws

White hats – Consider themselves the “good guys”

Black hats – Or “crackers” are definitely the “bad guys”

Gray hats – Not a common term; refers to individuals who operate out side of the law on occasion

Script kiddies – Inexperienced; consider themselves hackers, but only copy the work of others

Ethical hackers – Consultants who are hired to do vulnerability assessments on company systems

*

Firewalls – Found in a router or a server or as a stand-alone device, it filters ingress and egress network traffic.

Proxy server – This sits between a client and an application, acting as the host on your network, disguising the IP address of your internal host.

Intrusion Detection System – IDS monitors traffic, looking for attempted attacks.

*

Phreaking – A subspecialty of hacking, breaking into telephone systems, it gave Kevin Mitnick his start down the road to prison.

Authentication – Process todetermine if the credentials given by a user are authorized to access system resources.

Auditing – Process of reviewing logs, records, and procedures to ensure established standards are being met; tedious but critical.

*

How will youprotect our network?

Perimeter security approach

Perimeter Defense is the most popular because it used to be clearly defined, but as companies hire mobile workers, home workers, and contract workers, the perimeter is becoming less and less clearly defined.

Layered security approach

Not only the perimeter but separate sections of the network are protected to the security level assigned to them.

Proactive Versus Reactive

Are your security measures active or passive?

Do you have a security plan, or are you part of someone else’s plan to intrude on you?

Hybrid Security Method

Only a thorough and ongoing risk assessment and vulnerability can keep you informed about what combination of postures will benefit your network the most.

*

The Computer Security Act of 1987, the first piece of U.S. legislation to affect computer systems

OMB Circular A-130, a more specific federal law that addresses the idea of security standards

*

CERT

Computer Emergency Response Team, sponsored by Carnegie-Mellon University, the first computer incident response team

Microsoft Security Advisor

Microsoft security information, tools, and updates

F-Secure

Information on virus outbreaks

SANS

Documentation on computer security issues

*