© ITT Educational Services, Inc. All rights reserved. IS3220 Information Technology Infrastructure Security Unit 3 Network Security Threats Chapter 4

© ITT Educational Services, Inc. All rights reserved.Page 2 IS3220 Information Technology Infrastructure Security Class Agenda 1  Learning Objectives  Discussion of Project  Lesson Presentation and Discussions.  Discussion on Assignments.  Discussion on Lab Activities.  Break Times. 10 Minutes break in every 1 Hour.  Note: Submit all Assignment and labs due today.

© ITT Educational Services, Inc. All rights reserved.Page 3 IS3220 Information Technology Infrastructure Security Class Agenda 2  Theory: Network Security Threats ( 6:00pm -8:00pm)  Lab: Network Discovery & Security Scanning Using ZenMap GUI (Nmap) (8:15pm to 11:00pm)

© ITT Educational Services, Inc. All rights reserved.Page 4 IS3220 Information Technology Infrastructure Security Reading  Stewart, Chapter 4. “Network Security Threats and Issues”  NIST SP : Risk Management Guide for Information Technology Systems ( 30.pdf) 30.pdf  Other Website: CWE/SANS TOP 25 Most Dangerous Software Errors

© ITT Educational Services, Inc. All rights reserved.Page 5 IS3220 Information Technology Infrastructure Security Learning Objective  Recognize the impact that malicious exploits and attacks have on network security

© ITT Educational Services, Inc. All rights reserved.Page 6 IS3220 Information Technology Infrastructure Security Key Concepts  What are you protecting and from whom?  Intellectual property and privacy data  Risk assessment for network infrastructure  Wired and wireless network infrastructure risks, threats, and vulnerabilities  Common network hacking tools, applications, exploits, and attacks  Social engineering practices and their impact on network security efforts

© ITT Educational Services, Inc. All rights reserved.Page 7 IS3220 Information Technology Infrastructure Security EXPLORE: CONCEPTS

© ITT Educational Services, Inc. All rights reserved.Page 8 IS3220 Information Technology Infrastructure Security Malware ~ Malacious Code  Distribution Methods Software downloads Malicious web sites File transfer Flaws in software  Effects of Malware Data loss, exposure, or change Poor system performance Pop-up ads System becomes a “bot” or “zombie”

© ITT Educational Services, Inc. All rights reserved.Page 9 IS3220 Information Technology Infrastructure Security Common Types of Malware  Viruses and Worms  Trojan Horses  Keystroke Loggers (“keyloggers”)  Spyware and Adware  Rootkits  Logic Bombs  Trapdoors and Backdoors  URL Injectors and Browser Redirectors  Exploits

© ITT Educational Services, Inc. All rights reserved.Page 10 IS3220 Information Technology Infrastructure Security Malware: Viruses and Worms  Viruses Infect boot sectors or files, such as executables, drivers, and system Need user interaction to spread  Worms Infect systems Don’t need user interaction to spread Can be carriers for other types of malicious code

© ITT Educational Services, Inc. All rights reserved.Page 11 IS3220 Information Technology Infrastructure Security Malware: Trojan Horses  Delivery method for a malicious payload  Usually appear to be a benign program, such as a game or utility  Installed by users without knowledge of malicious payload  Allows remote access to attackers

© ITT Educational Services, Inc. All rights reserved.Page 12 IS3220 Information Technology Infrastructure Security Malware: Keystroke Loggers  Also called “keyloggers”  Software-based keyloggers can be installed via worms or Trojan horses  Record keystrokes and transmit them to the attacker  Hardware-based keyloggers

© ITT Educational Services, Inc. All rights reserved.Page 13 IS3220 Information Technology Infrastructure Security Malware: Spyware and Adware  Spyware  Adware  May be bundled together  May be embedded in other programs  May masquerade as antimalware product

© ITT Educational Services, Inc. All rights reserved.Page 14 IS3220 Information Technology Infrastructure Security Malware: Rootkits  Codes that position themselves between the operating system kernel and hardware  Allows attacker to gain root/administrative access to system  Uses of rootkits

© ITT Educational Services, Inc. All rights reserved.Page 15 IS3220 Information Technology Infrastructure Security Malware: Logic Bombs  Malicious code that lies dormant until triggered  Triggering events Time and date Program launch Keyword Accessing a URL

© ITT Educational Services, Inc. All rights reserved.Page 16 IS3220 Information Technology Infrastructure Security Malware: Backdoors and Trapdoors  Synonyms for the same type of malware  Bypass normal authentication or security controls  Benefits to the attacker  Examples of backdoors and trapdoors

© ITT Educational Services, Inc. All rights reserved.Page 17 IS3220 Information Technology Infrastructure Security Malware: URL Injectors and Browser Redirection  Also called browser hijacking  Replace URLs with alternative addresses  Redirect browser to target Web sites  May also change browser home page  May prevent access to anti-malware Web sites  May inject entries into HOSTS file  Other malware may contain URL injector code

© ITT Educational Services, Inc. All rights reserved.Page 18 IS3220 Information Technology Infrastructure Security Malware: Exploits  Take advantage of flaws or bugs in software  Often embedded into other forms of malware  May be stand-alone or part of hacker toolkits

© ITT Educational Services, Inc. All rights reserved.Page 19 IS3220 Information Technology Infrastructure Security Impact of Malware on Organizations  Melissa Virus caused $80 million in damages in North America  SQL Slammer Virus  Code Red

© ITT Educational Services, Inc. All rights reserved.Page 20 IS3220 Information Technology Infrastructure Security Application Vulnerabilities  Buffer overflow  SQL Injection  Cross-site scripting (XSS)  Cached credentials

© ITT Educational Services, Inc. All rights reserved.Page 21 IS3220 Information Technology Infrastructure Security Mitigating Application Vulnerabilities  In-House Coding  Operating systems or applications  Vulnerability scanning  Open Web Application Security Project (OWASP) for Web application security

© ITT Educational Services, Inc. All rights reserved.Page 22 IS3220 Information Technology Infrastructure Security Port Scanning MechanicsUses  TCP or UDP packets are sent to ports on a system  Scanning performed on single IP address or IP address range  Open ports can verify:  Indicators of open ports  Noticeable and detectable  Useful to both hackers and security professionals  Hackers  Security Professionals

© ITT Educational Services, Inc. All rights reserved.Page 23 IS3220 Information Technology Infrastructure Security EXPLORE: PROCESS

© ITT Educational Services, Inc. All rights reserved.Page 24 IS3220 Information Technology Infrastructure Security What is Risk?  Risk has several meanings Danger Consequences Likelihood or probability  Definition of risk in formal risk assessment

© ITT Educational Services, Inc. All rights reserved.Page 25 IS3220 Information Technology Infrastructure Security Risk Assessment Methodology  Identification  Analysis  Determine risk for each threat-vulnerability pair  Prioritize mitigation efforts

© ITT Educational Services, Inc. All rights reserved.Page 26 IS3220 Information Technology Infrastructure Security Measuring Risk  Risk = Impact x Likelihood Impact: The consequence of a successful exploitation of a vulnerability Likelihood: How probable is it that an impact will occur?  Risk can be measured

© ITT Educational Services, Inc. All rights reserved.Page 27 IS3220 Information Technology Infrastructure Security Risk Matrix Likelihood LowMediumHigh Impact Low Medium LowMediumHigh MediumHighCritical

© ITT Educational Services, Inc. All rights reserved.Page 28 IS3220 Information Technology Infrastructure Security EXPLORE: ROLES

© ITT Educational Services, Inc. All rights reserved.Page 29 IS3220 Information Technology Infrastructure Security The Hacking Process: Reconnaissance

© ITT Educational Services, Inc. All rights reserved.Page 30 IS3220 Information Technology Infrastructure Security The Hacking Process: Scanning

© ITT Educational Services, Inc. All rights reserved.Page 31 IS3220 Information Technology Infrastructure Security The Hacking Process: Enumeration

© ITT Educational Services, Inc. All rights reserved.Page 32 IS3220 Information Technology Infrastructure Security The Hacking Process: Attacking

© ITT Educational Services, Inc. All rights reserved.Page 33 IS3220 Information Technology Infrastructure Security The Hacking Process: Post-Attack Activities

© ITT Educational Services, Inc. All rights reserved.Page 34 IS3220 Information Technology Infrastructure Security The Hacking Process: Fall Back Attacks

© ITT Educational Services, Inc. All rights reserved.Page 35 IS3220 Information Technology Infrastructure Security Social Engineering Basics  “Hacking” people instead of systems  Conducing research or reconnaissance to identify appropriate targets  Communication methods  Manipulating targets

© ITT Educational Services, Inc. All rights reserved.Page 36 IS3220 Information Technology Infrastructure Security Social Engineering Techniques  Methods for conducting research  Building relationships with targets then exploiting them  Impersonating  Reciprocity or a favor for a favor

© ITT Educational Services, Inc. All rights reserved.Page 37 IS3220 Information Technology Infrastructure Security Seven Domains of a Typical IT Infrastructure

© ITT Educational Services, Inc. All rights reserved.Page 38 IS3220 Information Technology Infrastructure Security Definitions Review  Risk  Threat  Vulnerability

© ITT Educational Services, Inc. All rights reserved.Page 39 IS3220 Information Technology Infrastructure Security Unit 3 Class Activities  Discussion 3.1: Social Engineering Defense Issues  Lab 3.2: Configuring a pfSense Firewall on the Client