1. Hacking and Network Defense

2. Introduction  With the media attention covering security breaches at even the most tightly controlled organization, it is more important than ever to learn about hackers.

3. Hacker Profile  “Hacker” can be ranged from the computer programmer you work with who hacks in the evening, to a high school student who plays on the computer after he/she gets out of school, to almost anyone in between.  Why? Enjoy the game of discovering the vulnerabilitiesEnjoy the game of discovering the vulnerabilities Criminal intentCriminal intent RevengeRevenge

4. Enterprise Risks  Disruption of Services  Damaged Reputation  Exposure of Confidential information  Corruption of Data  Liability

5. Anatomy of an Attack  Profiling Gathering information about targetGathering information about target  Scanning Identify what systems are activeIdentify what systems are active  Enumerating Determining valid user account and sharesDetermining valid user account and shares

6. Anatomy of an Attack  Enumerating (Cont.) How?How?  Social Engineering  Observation  Eavesdropping  Exploiting Gain unlawful entry to a systemGain unlawful entry to a system

7. Different Kind of Exploits  Buffer Overflows Result of poor programmingResult of poor programming  Privilege Escalation Unsecured lower privilege accountUnsecured lower privilege account  Brute Force Attacks Password guessing gamePassword guessing game  Unexpected Input Username: jdoe; rm –rf /Username: jdoe; rm –rf /

8. Different Kind of Exploits  Defacements Surprise on Web sitesSurprise on Web sites  Denial of Service (DoS) A fleet attackA fleet attack  Launch Pad Attacks A victim attacked by other victimA victim attacked by other victim

9. The Hackers Toolkit  Web Scanner  Port Scanner  Password Crackers  Password Grinders  War Dialers  Program Password Recovery  Credit Card Number Generators  Vulnerability Scanners  Packet Sniffers  Net BIOS Auditing Tools  Virus, Trojans, Worms

10. Defending Against the Hack 1. Keep patched up to date 2. Shut down unnecessary services/ports 3. Change default passwords 4. Control physical access to system 5. Curtail unexpected input

11. Defending Against the Hack 6. Perform backups the test them 7. Educate people about social engineering 8. Encrypt and password-protect sensitive data 9. Implement security hardware and software 10. Develop a written security policy for the company

12. More Hacking  Hacker tools http://www.insecure.org/tools.htmlhttp://www.insecure.org/tools.htmlhttp://www.insecure.org/tools.html  Wireless Networks Wireless LAN AnalyzersWireless LAN AnalyzersWireless LAN AnalyzersWireless LAN Analyzers  Viruses and Worms http://www.nai.comhttp://www.nai.comhttp://www.nai.com  Terrorism  Security Advisory http://www.microsoft.com/securityhttp://www.microsoft.com/securityhttp://www.microsoft.com/security