Intro to Network Security Vocabulary n Vulnerability n

Intro to Network Security

Vocabulary n Vulnerability n Weakness that can be compromised n Threat n A method to exploit a vulnerability n Attack n Use of one or more threats n Countermeasure n Action taken to protect from vulnerabilities

Threats to System Security n Viruses n Technically a malicious program which must run to spread itself n General use: any malicious program n Worm n Once started, spreads itself through network n Trojan Horse n Something that looks good to begin with, but beats you up later n Logic Bomb n Waits for a trigger and then detonates. Trigger could be date, data, and/or combination of events.

Threats to Internet Security n System Vulnerabilities n A trusted Computer is compromised. n Holy Grail is to get the administrative account n Application Vulnerabilities n Network services n User applications n Network Vulnerabilities n Denial of Service n Packet Sniffing n Brute Force Attack

System Countermeasures n OS updates particularly Microsoft n Antivirus Software n System Software Firewall (helps keep out the worms) n Disaster Recovery Preparation: Expect the Worst.

Network Security Countermeasures n Intrusion Detection System n Sniffer: listens to packets looking for attack. n Tripwire: Lets you know system has been altered. n If you don’t know you have been compromised, you can’t recover from it. n Sniffing IDS can indicate source and nature of attack. n Sniffing IDS that sends an alarm thwarts a coverup. n See snort. org

Network Countermeasures continued n Run only needed services. n If the service isn’t running it can’t be exploited n Update service frequently, especially after a vulnerability discovery. n Application Sercurity n Look for updates: especially Microsoft. n Disable scripting features if not used.

Network Countermeasures still continued n DDOS attacks are out of your control. n You can secure the server, but the network? n Firewall filter is too late. n Traceback or Packet tagging must occur “in the cloud. ” n Stop the Zombies!

Packet Sniffing n Network sniffing for passords or worse n Inside Job n Threat has been greatly lessened due to switching n Switches can still be compromised n n Arp spoofing MAC Flooding

Brute Force Attacks n Use secure Passwords. See 10 Most Common Passwords n Set (stateful) Firewall Rules to limit logins from 1 host (I use 3 attempts/minute) n Account Lockouts n CAPTCHA: Those annoying pictures where you have to “GUESS” what the letters are in the picture.

Anatomy of an Attack 1. 2. 3. 4. 5. 6. 7. Target Selection Information Gathering Port Scan/Vulnerability Assessment Penetration: successful attack Persist : backdoor Propogate: use trusted machine to spread Payload: DDOS, Surveillance, theft of information, make phone calls,