Most serious threat because...

1. people already have knowledge of the network and available resources
2. people already have some level of access granted to them because of their job
3. traditional IPS and Firewall are ineffective against much misuse originating internally.

More technical

• could perform ping sweep of network to identify IPs
• then use port scan to identify open services
• could then try to exploit known vulnerabilities for open services to gain access

many of these can be mitigated using network security tools and mechanisms

1. Confidentiality
2. Integrity
3. Availability

keeping data private

physically or logically restricting access to sensitive data

• use Network Security mechanisms to prevent unauthorized access (Firewall and ACLs)
• Require appropriate credentials to access specific network resources (Authentication)
• encrypt traffic

ensures data hasn't been modified

verifies that traffic originates from source that should be sending it

Violations include:

• modifying appearance of corporate website
• intercepting and altering an e-commerce transaction
• modifying financial records that are stored electronically

measure of data's accessibility

Attempts to compromise the availability of network include:

• send improperly formatted data to a networked device, resulting in unhandled exception error
• flood a network system with excessive amount of traffic or requests (DoS)

Government/Military Data Classification

Unclassified

Government/Military Data Classification

Sensitive but unclassified (SBU)

Government/Military Data Classification

Confidential

Government/Military Data Classification

Secret

Government/Military Data Classification

Top-secret

Organizational Data Classification

Public

Information made available to the public

(through marketing materials)

Organizational Data Classification

Sensitive

Organizational Data Classification

Private

Organizational Data Classification

Confidential

Data Classification Characteristics

Value

Data Classification Characteristics

Age

Data Classification Characteristics

Useful life

Data Classification Characteristics

Personal Association

Classification Roles

Owner

-Initially determines the classification level

-Routinely reviews documented procedures for classifying data

-Gives the custodian the responsibility of protecting the data

Classification Roles

Custodian

-Keeps up-to-date backups of classified data

-Verifies the integrity of the backups

-Restores data from backups on an as-needed basis

-Follows policy guidelines to maintain specific data

Classification Roles

User

-Accesses and uses data in accordance with an established security policy

-Takes reasonable measures to protect the data he or she has access to

-Uses data for only organizational purposes

Security Solution Controls

Administrative Controls

primarily policy-centric

Examples:

• Routine security awareness training programs
• Clearly defined security policies
• Change management system, which notifies parties of system changes
• Logging configuration changes
• Properly screening potential employees

Security Solution Controls

Physical Controls

help protect the data's environment and prevent potential attackes from readily having physical access to the data

Examples:

• Security systems to monitor for intruders
• Physical security barriers (i.e. locked doors)
• Climate protection systems, to maintain proper temp and humidity, in addition to alerting personnel in case of fire
• Security personnel to guard the data

Security Solution Controls

Technical Controls

variety of hardware and software technologies to protect data

Examples

• security appliances - Firewalls, IPSs, VPN termination
• Authorization applications - RADIUS or TACACS+ servers, one-time passwords, biometric security scanners

Responding to Security Incident

Motive

describes why the attacker committed the act

Example - could be a disgruntled employee?

Potential motives can be valuable to define during an investigation

Specifically an invesigation may start out by looking at those who had a motive to carry out the attack.

Responding to Security Incident

Means

with all security controls in place to protect data or computer systems, need to determined if the accused had means to carry out the attack

Example

did the individuals have the technical skills

Responding to Security Incident

Opportunity

was the accused available to commit the attack

addresses wrongs that have been committed; but wrongs are not considered criminal

Example

• civil litigation might involve patent infringement

has skills to break into computer systems and do damage

uses skills to help organizations

hacker of a telecommunications system

Examples

• Captain Crunch used a toy whistle (which generated a 2600-Hz tone) to trick phone systems into letting him place free long distance calls

• Convincing a telecommunications carrier to permit free long distance calls in this manner is an example of phreaking

user who lacks the skills of a typical hacker

downloads hacking utilities and uses those utilities to launch attacks, rather than writing own programs

hacker with political motivations

Example

• someone who defaces the website of a political candidate

knowledgeable about the technical aspects of computer and network security systems

Example

• might attempt to attack a system protected by IPS by fragmenting malicious traffic in a way that would go undetected by the IPS

typically is an employee or student at an institution of higher education. Uses institution's computing resources to write "clever" programs.

Typically these types use their real names and they tend to focus on open-standards-based software and operating systems

tends to focus on home computing

might modify exisiting hardware or software to use software without a legitimate license

difficult to detect because the attacker isn't actively sending traffic (malicious or otherwise)

Example

• attacker capturing packets from the network and attempting to decrypt them (if traffic was encrypted originally)

easier to detect because the attacker is actively sending traffic (malicious and otherwise)

Example

• might launch an active attacke in an attempt to access classifed information or to modify data on a system

occurs when the attacker is in close physical proximity with the target system

Example

• an attacker can bypass password protection on some routers, switches and servers if he gains physical access to those devices

occurs when legitimate network users leverage their credentials and knowledge of the network in a malicious fashion

Intentionally introduce back doors to hardware or software systems at the point of manufacture.

Example

• After systems have been distributed to a variety of customers, the attacker can use knowledge of the implanted back door to access protected data, manipulate data or make the target system unusable by legitimate users

Design philosphy that achieves this layered security approach

should provide redundancy for one another while offering a variety of defense strategies for protecting multiple aspects of a network

single points of failure in a security solution should be eliminated, and weak links in the security solution should be strengthened

• Defend multiple attack targets in network -protect the network infrastructure -protect strategic computing resources, such as HIPS

• Create overlapping defenses - IDS and IPS
• Let the value of a protected resource dictate strength of security mechanism - deploy more resources to protect a network boundary as opposed to the resources to protect an end-user workstation
• Use strong encryption technologies

1. originator sends a SYN segment to the destination, along with a sequence number
2. destination sends an acknowledgement (an ACK) of the originator's sequence number along with the destination's own sequence number (a SYN)
3. orginator sends an ACK segment to acknowledge the destination's sequence number, after which the TCP communication channel is open between the originator and destination

Nonblind

Blind

occurs when attacker is not on the same subnet as the destination

obtaining correct sequence numbers is more difficult

Using techniques such as IP source routing, an attacker can accurately determine those sequence numbers

1. Loose
2. Strict

Use access control lists on router interfaces

Encrypt traffic between devices via an IPsec tunnel

Use cryptographic authentication

Confidentiality Attack Strategies

Packet Capture

Wireshark for example, can capture packets visible by a PC's NIC by replacing the NIC in promiscuous mode.

Some protocols (HTTP, Telnet) are sent in plain text; therefore, an attacker can read these types of captured packets, perhaps allowing him to see confidential information

Confidentiality Attack Strategies

Ping sweep and port scan

confidentiality attack might start with a scan of network resources, to identify attack targets on a network. A ping sweep could be used to ping a series of IP addresses. As soon as a collection of IP addresses is identified, attacker might scan a range of UDP and/or TCP ports to see what services are available on the host at the specified IP address.

Port scans often help attackers identify the OS running on the target system

Confidentiality Attack Strategies

Dumpster diving

Confidentiality Attack Strategies

Electromagnetic interference (EMI) interception

data is often transmitted over wire (UTP wire) attackers can sometimes copy information traveling over the wire by intercepting EMI being emitted by the transmission medium.

EMI emissions are sometimes called emanations

Confidentiality Attack Strategies

Wiretapping

if an attacker gains physical access to a wiring closet, they might be able to physically tap into telephone cabling to eavesdrop on telephone conversations

might also insert a shared media hub inline with a network cable. Could let him connect to the hub and receive copies of packets flowing through the network cable.

Confidentiality Attack Strategies

Social engineering

Confidentiality Attack Strategies

sending information over overt channels

attacker might send or receive confidential information over a network using an overt channel.

Example

• using one protocol inside another (sending instant messaging traffic via HTTP)
• Steganography is sending a digital image made up of millions of pixels with secret information encoded in specific pixels. Only the sender and receiver know which pixels represent the encoded info

Confidentiality Attack Strategies

Sending information over covert channels

attacker might send or receive confidential information over a network using a covert channel, which can communicate information as a series of codes and/or events.

Example

• binary data could be represented by sending a series of pings to a destination - single ping within a certain period of time could represent binary 0 and two pings within that same period of time could represent binary 1

Integrity Attacks

Salami Attack

collection of small attacks that result in a larger attack when combined

Example

• if attacker had a collection of stolen credit card numbers, he could withdraw small amount of money from each credit card. Although each withdrawl is small, they add up to be a significant sum for attacker

Integrity Attacks

Data Diddling

changes data before it is stored in a computing system

malicious code in an input application or virus could perform data diddling.

Example

• a virus, Trojan horse, or worm could be written to intercept keyboard input. It would display the appropriate characters on-screen so that the user would not see a problem. Manipulated characters would be entered into a database app or sent over network

Integrity Attacks

Trust relationship exploitation

Certain hose might be trusted to communicate through a firewall using specific ports. If an attacker could compromise the host that had a trust relationship with the firewall, the attacker could use the compromised host to pass normally denied data through a firewall.

A web server and a database server mutually trusting one another. If attacker gained control of the web server, he might be able to leverage that trust relationship to compromise the database server.

Integrity Attacks

Password Attacks

attempts to determine a user's password

as soon as username and password are gained, the attacker can attempt to log into a system as that user, and therefore inherit that user's set of permissions

Integrity Attacks - Password Attacks

Trojan horse

Integrity Attacks - Password Attacks

Packet capture

packet-capture utility can capture packets seen on a PCs NIC.

if the PC can see a copy of a plain-text password being sent over a link, the packet-capture utility can be used to glean the password

Integrity Attacks - Password Attacks

Keylogger

program that runs in the background of a computer, logging the user's keystrokes

after a user enters a password, it is stored in the log created by the keylogger. An attacker then can retrieve the log of keystrokes to determine the user's password

Integrity Attacks - Password Attacks

Brute force

tries all possible password combinations until a match is made.

Example

• brute-force attack might start with the letter a and go through the letter z
• then the letters aa through zz are attempted, until password is determined

Using mixture of uppercase and lowercase helps mitigate brute force

Integrity Attacks - Password Attacks

Dictionary Attack

Integrity Attacks

Botnet

software robot typically is through of as an application on a machine that can be controlled remotely

if collection of computers is infected with such software robots, called bots, this collection of computers (zombies) is known as a botnet.

Because of the potentially large size of a botnet, it might comrpomise the integrity of a large amount of data

Integrity Attacks

Hijacking a session

Availability Attacks

Denial of Service (DoS)

attacker can launch a DoS attack on a system by sending the target system a flood of data or requests that consume the target system's resources

Alternatively, some OS and applications might crash when they receive specific strings of improperly formatted data, and the attacker could leverage such OS and/or app vulnerabilities to render a system or application inoperable.

Attacker often uses IP Spoofing to conceal his identity

Availability Attacks

Distributed denial of server (DDoS)

can increase the amount of traffic flooded to a target system. Specifically, the attacker compromises multiple systems.

The attacker can instruct those compromised systems, called zombies, to simultaneously launch a DDoS attack against a target system

Availability Attacks

TCP SYN flood

one variant of DoS attacks is for an attacker to initiate multiple TCP sessions by sending SYN segments but never completing the three-way handshake

can send multiple SYN segments to a target system, with false source IP addresses in the header

Because many servers limit the number of TCP sessions they can have open simultaneously, a SYN flood can render a target system incapable of opening a TCP session with a legitimate user

Availability Attacks

ICMP Attacks

Many networks permit ICMP traffic because pings can be useful in network troubleshooting. Attackers can use ICMP for DoS attacks.

Availability Attacks - ICMP Attacks

Ping of Death

ICMP DoS attack uses ICMP packets that are too big

ICMP traffic as series of fragments in an attempt to overflow the fragment reassembly buffers on the target device

Availability Attacks - ICMP Attacks

Smurf Attack

Availability Attacks

Electrical disturbances

at physical level - attacker could launch an attack by interrupting or interfering with the electrical service available to a system.

Availability Attacks - Electrical disturbances

Power spike

Availability Attacks - Electrical disturbances

Electrical surge

Availability Attacks - Electrical disturbances

Power fault

Availability Attacks - Electrical disturbances

Blackout

Availability Attacks - Electrical disturbances

Power sag

Availability Attacks - Electrical disturbances

Brownout

Availability Attacks

Attacks on system's physical environment

could intentionally damage computing equipment by influencing the equipment's physical environment

Example

• temperature - computing equipment generates heat, attacker could intefere with AC system, equipment could overheat
• Humidity - computing equipment is intolerant of moisture, attacker could create a high level of humidity
• Gas - can be flammable so attacker could inject gas, where small sparks could create fire