Chapter 9: Network Risk Management

Symptoms of Malware

- Unexplained file size increases - Significant, unexplained system performance decline - Unusual error messages - System memory loss - Unexpected rebooting - Display quality loss

DRDS Attack (Distributed Reflector DoS)

A DDoS attack bounced off of uninfected computers, called reflectors, before being directed at target.

DNS Amplification

A DDoS attack in which the attacker exploits vulnerabilities in DNS servers to turn initialy small queries into larger payloads, which are then used to bring down servers. Very overwhelming to systems.

Zombie

A computer compromised by a hacker, virus, or trojan. Can be used to perform malicious tasks under remote direction.

Ping Flood

A denial of service attack in which the attacker attempts to overwhelm a targeted device with ICMP echo-request packets, causing the target to become inaccessible to normal traffic. When attack traffic comes from multiple devices, it becomes a DDoS attack.

Ransomware

A program that locks data or system until ransom is paid.

Gray Hat Hacker

Abides by a code of ethics of their own. Might engage in illegal activity, but goal is to educate and assist.

Privileged User / Access Agreement

Addresses specific concerns related to privileged access given to admins and support staff. When accessing privileged accounts: - Stay signed in as long as needed then sign off.

DNS Poisoning / Spoofing

Altering DNS records on DNS server, an attacker can redirect internet traffic from legitimate sites to phishing sites.

Password Policy

Always change system default passwords. Do not use familiar information. Do not use words in dictionaries. Make password longer than 8 chars. Do not repeat words or number sequences. Do not write down password or share. Change every 60 days, use different passwords.

Social Engineering

Asking people for passwords. Phishing, baiting, quid pro quo, and tailgating are all examples.

Unauthenticated Vulnerability Scanning

Attacker begins on perimeter of network, looking for vulnerabilities that do not require trusted user privileges.

Authenticated Vulnerability Scanning

Attacker is given same access as trusted user.

Deauth Attack (Deauthentication)

Attacker sends fakes deauthentication frames to AP, client, or both to trigger deauth process and knock clients off wireless network.

ARP Poisoning (Address Resolution Protocol)

Attackers use faked ARP replies to alter ARP tables in network.

Rogue DHCP Server

Can be used to implement MitM attacks. DHCP messages should be monitored by a security feature on switches called DHCP snooping. - ip dhcp snooping command.

MDM Software (Mobile Device Management)

Can configure devices automatically for BYOD policy. MDM Software can: - Automate enrollment - Enforce password policies - Encrypt data on device - Sync data across devices - Wipe devices - Monitor locations

Scanning Tools

Can discover: - Available hosts - Services, processes, threads, including apps and versions running on hosts. - OSs on hosts. - Ports on hosts - Config of firewalls - Software configs - Unencrypted data

Keypad / Cipher Lock

Cipher locks are physical or electronic locks requiring a code to open door.

Posture Assessment:

Complete examination assessment of each aspect of network to determine how it might be compromised. Should be performed at least annually.

PDoS Attack (Permanent DoS)

Damages firmware beyond repair

NMAP (Network Mapper)

Designed to scan large networks. Provides information about networks and hosts, is free.

Anti-Malware Software

Effective malware protection requires: - Choosing appropriate anti-malware S/W - Monitoring network - Continually updating anti-malware program Malware leaves evidence that can sometimes only anti-malware software can detect.

AUP (Acceptable Use Policy)

Explains to users what they can and cannot do while accessing network's resources. Explains penalties for violations, explains how it protects security. Restrictions: - Nothing illegal - No circumventing network security restrictions - No spam - No rights violations

Insecure Protocols and Services

FTP, HTTP, Telnet, SLIP, TFTP, SNMPv1, SNMPv2

Phishing

Fraudulent practice of sending emails purporting to be from reputable companies in order to trick people into revealing passwords or credit card numbers.

Black Hat Hacker

Groups or individuals that cause damage, steal data, or compromise privacy.

DoS Attack (Distributed Denial of Service)

Hacker issues flood of broadcast ping messages.

Quid pro Quo

Hacker offers a service or benefit in exchange for information or access.

White Hat Hacker

IT Security experts hired by organizations to identify security weaknesses. Also called ethical hackers.

Spoofing Attack

Impersonation of MAC address.

Tailgating

Involves someone who lacks the proper authentication following an employee into a restricted area.

Polymorphism

Malware characteristic, changes characteristics every time it transfers to new system.

Stealth

Malware characteristic, disguises as legit program.

Encryption

Malware characteristic, prevents detection.

Time Dependence

Malware characteristic, programmed to activate on particular dates. Can remain dormant and harmless until date arrives.

Administrative Credentials

Many devices are managed through remote access connections. - SSH keys are more secure than passwords, are more difficult to crack.

Access Badges

Many organizations provide electronic access badges called smart cards. Smart cards can be programmed to allow owner access to some but not all.

Security Audit

Many types, based on risk exposure, expected annual lose, quantitative / qualitative assessments. Performed by company that has been acredited by agency that sets network standards.

Exploit

Means of taking advantage of a vulnerability.

Honeypot

Mechanism set to detect, deflect, or counteract attempts at unauthorized use of systems. Consists of data that appears to be legit, but is actually isolated and monitored. Attackers are then blocked. Honeynet: Network of honeypots.

SHA (Secure Hash Algorithm)

Most commonly used hashing algorithm. Advantage: Resistance to collisions.

Employee Training

Most important defense against social engineering.

Friendly DoS Attack

Not done with malicious intent. Usually due to a flash sale

DDoS Attack ( Distributed DoS)

Orchestrated through several sources, called zombies.

Hacker

Originally someone who masters the inner workings of computer hardware and software in an effort to better understand them. Now, an individual who gains unauthorized access to systems.

Nessus Vulnerability Scanner

Performs more sophisticated scans than NMAP.

PAM (Privileged Account Management Tool)

Privileged accounts may be monitored through this.

Updates and Security Patches

Process includes: - Discovery - Standardization - Layered Security - Vulnerability Reporting - Implementation - Assessment - Risk Mitigation

Malicious Software

Program designed to intrude or harm systems and resources. Viruses, trojans, worms, bots, ransomware.

Trojan Horse

Program that disguises itself as something useful, harms system.

Bots

Program that runs automatically without requiring person to start/stop it. Can: - Damage data or system files. - Issue objectionable content. - Launch DoS attacks. - Open back doors.

Logic Bomb

Programs designed to start when conditions are met.

Worms

Programs that run independently and travel between computers and across networks.

Key FOB

Provides remote control over locks and security systems

Red Team Blue Team Exercise

Red team attacks, blue team defends network.

MitM Attack (Man in the Middle)

Relies on intercepted transmission, can take several forms.

Virus

Replicating program intent to infect more computers. Replicates through network connections or exchange of external storage devices.

Metasploit

Represents framework for pen testing, not an app. Combines known scanning and exploit techniques to explore new attack routes.

Physical Security

Restrict physical access to critical components-- only trusted networking staff should have access. Locked doors help, good detection measures to secure perimeter.

Versions of SHA

SHA-0 SHA-1: Takes input and produces a 160-bit (20-byte) hash value known as a message digest, often rendered as hexadecimal # 40 digits long. -SHA-2 -SHA-3 -SHA-2 and SHA-3 are often implemented together for increased security.

Back doors

Security flaws, allows unauthorized users to gain access to system.

NDA (Non-Disclosure Agreement)

Security policy should also define what confidential and private means to organization. If you work in secure environments, know where most data is confidential. Security policy should also classify information in degrees of sensitivity.

Baiting

Similar to phising. The promise of an item or good that hackers use to entice victims.

DLP (Data Loss Prevention)

Solution that identifies sensitive data and prevents it from being copied or transmitted off network.

Insider Threat

Someone trusted by an organization, may have or develop malicious intent. Reduce insider threats by: - Background checking new hires. - Principle of least privilege, which is giving minimal access to do job. - Checks and balances on employee behavior.

Device Hardening

Steps to secure device from network or software supported attacks. Many layers of defense.

Zero-Day Exploit

Taking advantage of undiscovered software vulnerability before developers are aware. One technique may lead to a second and third and so on.

BYOD (Bring Your Own Device)

The practice of allowing people to bring their devices into a facility for performing work responsibility. Variations: - BYOA (app) - BYCO (cloud) - BYOT (tech) - CYOD (choose, device)

Hashing

To transform data through an algorithm that reduces the amount of space needed for the data.

Anti-Malware Policy

Users should know what to do in case of malware. Users should be prohibited from installing unauthorized software on systems.

Penetration Testing

Uses variable tools to find network vulnerabilities, attempts to exploit them.

Amplified DR DoS Attack (Distributed Reflection Denial of Service)

Using small, simple requests triggers very large responses from target.

Vulnerability

Weakness of a system, process, or architecture