A. Obscurity -

Differences between wireless and wired network security

Pages

1. Cover Page (Title Name Date Class Teacher’s name)

Double spaces 12 point font)

References

Types of Attackers: Hacker, Script Kiddies, Spies, Employees, Cybercriminal, Cyber terrorist.

Hackers -Narrow sense: a person who uses advanced computer skills to attack computer only to expose security flows

Script kiddies - want to break into computer to create damage. Unskilled users. Download automated hacking software (scripts) from Web sites and use it to break into computer

Computer Spy - a person who has been hired to break into a computer and steal information

Employees: one of the largest information security threats to a business actually comes from its employees.

Cybercriminals: a loose-knit network of attackers, identity thieves, and financial fraudsters
- Targeted attacks against financial networks unauthorized access to information, and the theft of personal information

Cyber terrorists: their motivation may be defined as ideology or attacking for the sake or their principles or beliefs

Layering

· Information security must be created in layers

· Layered security provides the most comprehensive protection

Limiting

· Limiting access to information reduces the threat against it

· Only those who must use data should have access to it

Diversity

· Layers must be different(diverse)

o If attackers penetrate one layer, they cannot use the same techniques to break through all other layers

· Using diverse layers of defense means that breaching one security layer does not compromise the whole system’

Obscurity

· An example of obscurity would be not revealing the type of computer, operating system, software, and network connection a computer uses

· Obscurity information can be an important way to protect information

Chapter 3

Chapter 4

2 Types of network Vulnerabilities

· Those based on the network transport media

· Those found in the network device themselves

Install a Network Tap (test access point)

A. A separate device that can be installed between two network device, such as a switch, router, or firewall, to monitor traffic.

Attackers can access the wired network on following ways

§ False ceilings

§ Exposed wiring

§ Unprotected RJ-45 jacks

Weak Passwords

§ A password is a secret combination of letters and numbers that serves to authenticate (validate) a user by what he knows

Back Door

§ An account that is secretly set up without the administrator’s knowledge or permission, that cannot be easily detected, and that allows for remote access to the device

Privilege escalation

§ It is possible to exploit a vulnerability in the network device’s software to gain access to resources that the user would normally be restricted from obtaining

Categories include denial of service, spoofing, man-in-the-middle, and replay attacks

§ Denial of service (DoS) – attempts to consume network resources so that the network or its devices cannot respond to legitimate requests

§ Distributed Denial of Service (DDoS) – attack may use hundreds or thousands of zombie computers in a botnet to flood a device with requests

§ Spoofing

§ Man-in-the-middle.

o Intercepts legitimate communication and forges a fictitious response to the sender.

o Can be active or passive

§ Replay attack

o Similar to a passive man-in-the-middle attack

o Captured data is used at a later time

What to study

1.

a. Confidentiality - ensures that only authorized parties can view the information.

b. Availability - ensures that the information is correct and no unauthorized person or malicious software has altered that data.

a. Integrity - ensures that data is accessible to authorized users.

2.

a. Hacker -identify anyone who illegally breaks into or attempts to break into a computer system.

b. Script Kiddie -are unskilled users who download software from internet to cause the damage

c. Spies -is a person who has been hired to break into a computer and steal information.

d. Employees –

e. Cybercriminal -loose-knit network of attackers, identity thieves, and financial fraudsters. These cybercriminals are described as being more highly motivated, less risk-averse, better funded, and more tenacious than hackers

f. Cyber terrorist -their motivation may be defined as ideology, or attacking for the sake of their principles or beliefs.

3.

a. Layering -If one layer is penetrated—such as the thief getting into the

building—several more layers must still be breached, with each layer being more difficult or

complicated than the previous layer. A layered approach has the advantage of creating a barrier

of multiple defenses that can be coordinated to thwart a variety of attacks.

b. Limiting -Limiting access to information reduces the threat

against it. Only those who must use data should have access to it. In addition, the amount of

access granted to someone should be limited to what that person needs to know.

c. Diversity -Diversity is closely related to layering. Just as it is important to protect data with layers of security, so too must the layers be different (diverse) so that if attackers penetrate one layer, they cannot use the same techniques to break through all other layers.

a. Obscurity -

Дата добавления: 2015-11-16