Download presentation
Presentation is loading. Please wait.
Published byTheresa Snow Modified over 8 years ago
1
Copyright © 2002 ProsoftTraining. All rights reserved. Security Auditing, Attacks, and Threat Analysis
2
Copyright © 2002 ProsoftTraining. All rights reserved. Lesson 1: Security Auditing
3
Objectives Identify a security auditor’s chief duties List security auditing principles Assess risk factors for a network Describe the security auditing process Plan an audit
4
What Is an Auditor? Network security Risk assessment
5
What Does an Auditor Do? Compliance Risk Analysis
6
Auditor Roles and Perspectives Auditor as security manager Auditor as consultant Insider threats
7
Conducting a Risk Assessment Check for a written security policy Analyze, categorize and prioritize resources Consider business concerns Evaluate existing perimeter and internal security Use existing management and control architecture
8
Risk Assessment Stages Discovery Penetration Control
9
Summary Identify a security auditor’s chief duties List security auditing principles Assess risk factors for a network Describe the security auditing process Plan an audit
10
Copyright © 2002 ProsoftTraining. All rights reserved. Lesson 2: Discovery Methods
11
Objectives Describe the discovery process Identify specific discovery methods Install and configure network-based and host- based discovery software Conduct network-level and host-level security scans Configure and deploy enterprise-grade network vulnerability scanners
12
Security Scans Whois nslookup The host command The traceroute ( tracert ) command Ping scanning Port scans Network-discovery and server- discovery applications NMAP Share scans Service scans Using Telnet
13
Using SNMP The SetRequest command SNMP software
14
TCP/IP Services Finger –User names –Server names –E-mail accounts –User connectivity –User logon status
15
Enterprise-Grade Auditing Applications Protocol support Network scanners Subnetting Configuring network scanners Configuring host scanners
16
Scan Levels Profiles and policies Reporting Symantec NetRecon ISS Internet Scanner eEye Retina Additional scanning application vendors
17
Social Engineering Telephone calls Fraudulent e-mail Education
18
What Information Can You Obtain? Network-level information Host-level information Research Legitimate versus illegitimate auditing tools
19
Summary Describe the discovery process Identify specific discovery methods Install and configure network-based and host- based discovery software Conduct network-level and host-level security scans Configure and deploy enterprise-grade network vulnerability scanners
20
Copyright © 2002 ProsoftTraining. All rights reserved. Lesson 3: Auditing Server Penetration and Attack Techniques
21
Objectives Identify common targets Discuss penetration strategies and methods List potential physical, operating system, and TCP/IP stack attacks Identify and analyze specific brute-force, social engineering, and denial-of-service attacks Implement methods designed to thwart penetration
22
Attack Signatures and Auditing Reviewing common attacks –Dictionary –Man in the middle –Hijacking –Viruses –Illicit servers –Denial of service
23
Common Targets Routers FTP servers Databases Web servers DNS WINS SMB
24
Routers Using your firewall to filter Telnet Routers and bandwidth consumption attacks
25
Databases The most desirable asset for a hacker to attack –Employee data –Marketing and sales information –R & D –Shipping information
26
Web and FTP Servers Common problems Web graffiti
27
E-Mail Servers Spam Relaying
28
Naming Services Unauthorized zone transfers DNS poisoning Denial-of-service attacks WINS SMB NFS NIS
29
Auditing Trap Doors and Root Kits Auditing bugs and back doors
30
Buffer Overflow Preventing denial-of-service attacks Auditing illicit servers, Trojans and worms
31
Combining Attack Strategies Penetration strategies –Physical –Operating system –Bad password policies –NAT –Bad system policies –Auditing file system weaknesses IP spoofing and hijacking –Blind and non-blind spoofing
32
Denial of Service and the TCP/IP Stack SYN flood Smurf and Fraggle attacks Teardrop/Teardrop2 Ping of death Land attack
33
Summary Identify common targets Discuss penetration strategies and methods List potential physical, operating system, and TCP/IP stack attacks Identify and analyze specific brute-force, social engineering, and denial-of-service attacks Implement methods designed to thwart penetration
34
Copyright © 2002 ProsoftTraining. All rights reserved. Lesson 4: Security Auditing and the Control Phase
35
Objectives Define control procedures Identify control methods List ways to document control procedures and methods
36
Control Phases Gain root access Gather information Open new security holes Erase evidence of penetration Spread to other systems Auditing UNIX file systems Auditing Windows 2000
37
UNIX Password File Locations The shadow password file Redirect information Create new access points Erase evidence of penetration Spread to other systems Port redirection
38
Control Methods System defaults Services, daemons, and loadable modules Illicit services, daemons, and loadable modules Keyloggers
39
Auditing and the Control Phase The auditor never truly enters the control phase The auditor must recognize suspicious traffic
40
Summary Define control procedures Identify control methods List ways to document control procedures and methods
41
Copyright © 2002 ProsoftTraining. All rights reserved. Lesson 5: Intrusion Detection
42
Objectives Define intrusion detection Differentiate between intrusion detection and automated scanning Discuss network- and host-based intrusion detection List the elements used in an IDS Implement intrusion-detection software
43
What Is Intrusion Detection? Capabilities –Network traffic management –System scanning, jails, and the IDS –Tracing Is intrusion detection necessary? IDS application strategies
44
Intrusion Detection Architecture Network-based IDS applications Host-based IDS architectures Host-based managers Host-based IDS agents Manager-to-agent communication
45
IDS Rules Network anomalies Network misuses Actions False positives and IDS configuration
46
IDS Actions and False Positives Creating rules Assigning actions to a rule Mistaking legitimate traffic for illegitimate traffic
47
Intrusion Detection Software eTrust Intrusion Detection Snort Intruder Alert ISS RealSecure Computer Misuse Detection System Network Flight Recorder CyberCop Monitor Cisco Secure IDS
48
Purchasing an IDS Product support Product training Update policy Company reputation IDS capacity Product scalability Network support Encryption
49
Summary Define intrusion detection Differentiate between intrusion detection and automated scanning Discuss network- and host-based intrusion detection List the elements used in an IDS Implement intrusion-detection software
50
Copyright © 2002 ProsoftTraining. All rights reserved. Lesson 6: Auditing and Log Analysis
51
Objectives Establish a baseline for your users’ activities Conduct log analysis Filter events found in Windows 2000 and Linux systems Establish auditing for logons, system restarts, and specific resource use
52
Baseline Creation and Firewall and Router Logs Baseline is standard activity for a network Logs help determine activity patterns of users
53
Operating System Logs Logging UNIX systems Logging Windows 2000 systems
54
Filtering Logs Filtering logs in Windows 2000 Filtering logs in Linux Operating system add-ons and third-party logging
55
Suspicious Activity Skilled hacking attempts to camouflage its use as legitimate system activity
56
Additional Logs Intrusion detection systems Telephony connections ISDN and/or frame relay connections Employee access logs
57
Log Storage Sending logs to a different machine for storage Replicating logs to a writable CD-ROM drive Scheduling hard-copy backups
58
Auditing and Performance Degradation Network traffic Packet sniffers
59
Summary Establish a baseline for your users’ activities Conduct log analysis Filter events found in Windows 2000 and Linux systems Establish auditing for logins, system restarts, and specific resource use
60
Copyright © 2002 ProsoftTraining. All rights reserved. Lesson 7: Audit Results
61
Objectives Recommend solutions based on specific network problems Suggest ways to improve compliance to a security policy Create an assessment report Enable proactive detection services
62
Objectives (cont’d) Cleanse operating systems Install operating system add-ons Implement native auditing Use SSH as a replacement for Telnet, rlogin, and rsh
63
Auditing Recommendations Recommending specific ways to continue or implement efficient auditing Confronting and correcting virus, worm and Trojan infections Recommending changes and improvements
64
Four Network Auditing Categories Firewalls and Routers Host and Personal Security Intrusion Detection and Traceback Policy Enforcement
65
Creating the Assessment Report Sample audit report elements include: –Overview of existing security –Estimates of time hackers require to enter system –Summary of important recommendations –Outline of audit procedures –Network element recommendations –Physical security discussion –Terms
66
Improving Compliance Steps for continued auditing and strengthening
67
Security Auditing and Security Standards ISO 7498-2 British Standard 7799 Common Criteria Evaluation Assurance Levels
68
Improving Router Security Ingress and egress filtering Disable broadcast filtering
69
Enabling Proactive Detection Scan detection, honey pots and jails –Detecting a NIC in promiscuous mode
70
Host Auditing Solutions Cleaning up infections Personal firewall software IPsec and personal encryption Native auditing services Fixing system bugs IPv6
71
Replacing and Updating Services Study the new product Determine the time needed to implement changes Test all updates Consider effect of updates on other services Determine whether end-user training is needed
72
Secure Shell (SSH) Security services provided by SSH Encryption and authentication in SSH SSH2 components Preparing SSH components
73
SSH and DNS Compatibility with SSH1 SSH and authentication: Establishing user- to-user trust relationships
74
Summary Recommend solutions based on specific network problems Suggest ways to improve compliance to a security policy Create an assessment report Enable proactive detection services
75
Summary (cont’d) Cleanse operating systems Install operating system add-ons Implement native auditing Use SSH as a replacement for Telnet, rlogin, and rsh
76
Security Auditing, Attacks, and Threat Analysis Security Auditing Discovery Methods Auditing Server Penetration and Attack Techniques Security Auditing and the Control Phase Intrusion Detection Auditing and Log Analysis Audit Results
Similar presentations
© 2024 SlidePlayer.com Inc.
All rights reserved.