1. IS Network and Telecommunications Risks Chapter Six

2. Network Components Computers and terminals Computers processed data in a networked telecommunication system Networked computers send and receive data from terminals Telecommunications channels – physical and wireless Telecommunications processors Routers and switching devices

3. Network Types Local versus wide area networks Internet, intranet, extranet Virtual private networks (VPN) Client/server networks

4. Network Configuration Types Star-shaped – centralized Ring – decentralized Bus - decentralized

5. Network Protocols and Software Open Systems Interconnect (OSI) model – a standard architecture for networking that allows different computers to communicate across networks Network and telecommuncations software – network OS, networks management software, middleware, web browsers, e-mail software

6. IS Network and Telecommunications Risks Social Engineering Physical Infrastructure Threats – the elements, natural disasters, power supply, intentional human attacks Programmed Threats – viruses, worms, Trojan horses, hoaxes, blended threats Denial of Service Attacks Software Vulnerabilities

7. Social Engineering Techniques Familiarity exploit Gathering and using information Phishing Tailgating Quid pro quo

8. Sample Scenario In one penetration test, Nickerson used current events, public information available on social network sites, and a $4 Cisco shirt he purchased at a thrift store to prepare for his illegal entry. The shirt helped him convince building reception and other employees that he was a Cisco employee on a technical support visit. Once inside, he was able to give his other team members illegal entry as well. He also managed to drop several malware-laden USBs and hack into the company's network, all within sight of other employees. Source:http://www.csoonline.com/article/514063/social-engineering-the- basics

9. Countermeasures Personnel training Awareness program Establish security protocols

10. IS Network and Telecommunications Security Network security administration Authentication Encryption – secret key and public key Firewalls – packet filtering and stateful inspection Intrusion Detection Systems Penetration Testing – war dialing, port scanning, sniffers, password crackers

11. Auditing Network Security Risk assessment and best practices Benchmark tools IT audit programs for network security

12. Security Service Comparison Evaluation against policy and security baseline Regulatory / industry compliance, e.g. SOX Evaluation against standards such as NIST800/ISO27002 Governance Framework – COBIT/COSO

13. Testing Security Controls Risk assessment Policy assessment Social Engineering Security Design review Security process review Document review Technology review