1. Ethical Hacking and Network Defense

2. Contact Information Sam Bowne Sam Bowne Email: sbowne@ccsf.edu Email: sbowne@ccsf.edu Website: samsclass.info Website: samsclass.info All materials from this talk are already on that website All materials from this talk are already on that website Download them and use them freely Download them and use them freely Hands-On Ethical Hacking and Network Defense2

3. 3 Isn’t Hacking a Crime?

4. Ethical Hacking Ethical hackers Ethical hackers Employed by companies to perform penetration tests Employed by companies to perform penetration tests Penetration test Penetration test Legal attempt to break into a company’s network to find its weakest link Legal attempt to break into a company’s network to find its weakest link Tester only reports findings, does not harm the company Tester only reports findings, does not harm the company

5. 5 Penetration Testers Hackers Hackers Access computer system or network without authorization Access computer system or network without authorization Breaks the law; can go to prison Breaks the law; can go to prison Crackers Crackers Break into systems to steal or destroy data Break into systems to steal or destroy data U.S. Department of Justice calls both hackers U.S. Department of Justice calls both hackers Ethical hacker Ethical hacker Performs most of the same activities but with owner’s permission Performs most of the same activities but with owner’s permission

6. 6 Penetration Testers Script kiddies or packet monkeys Script kiddies or packet monkeys Young inexperienced hackers Young inexperienced hackers Copy codes and techniques from knowledgeable hackers Copy codes and techniques from knowledgeable hackers Experienced penetration testers use Perl, C, Assembler, or other languages to code exploits Experienced penetration testers use Perl, C, Assembler, or other languages to code exploits

7. Security Credentials CompTIA offers Security+ certification, a basic familiarity with security concepts and terms CompTIA offers Security+ certification, a basic familiarity with security concepts and terms 7

8. 8 OSSTMM Professional Security Tester (OPST) Designated by the Institute for Security and Open Methodologies (ISECOM) Designated by the Institute for Security and Open Methodologies (ISECOM) Based on the Open Source Security Testing Methodology Manual (OSSTMM) Based on the Open Source Security Testing Methodology Manual (OSSTMM)

9. 9 Certified Information Systems Security Professional (CISSP) Issued by the International Information Systems Security Certifications Consortium (ISC 2 ) Issued by the International Information Systems Security Certifications Consortium (ISC 2 ) Usually more concerned with policies and procedures than technical details Usually more concerned with policies and procedures than technical details Web site Web site www.isc2.org www.isc2.org

10. 10 Certified Ethical Hacker (CEH) But see Run Away From The CEH Certification But see Run Away From The CEH Certification Link at samsclass.info Link at samsclass.info

11. 11 What You Cannot Do Legally Accessing a computer without permission is illegal Accessing a computer without permission is illegal Other illegal actions Other illegal actions Installing worms or viruses Installing worms or viruses Denial of Service attacks Denial of Service attacks Denying users access to network resources Denying users access to network resources Possession of others’ passwords can be a crime Possession of others’ passwords can be a crime See Password theft See Password theft Link at samsclass.info Link at samsclass.info

12. 12 Get Out of Jail Free Card When doing a penetration test, have a written contract giving you permission to attack the network When doing a penetration test, have a written contract giving you permission to attack the network Using a contract is just good business Using a contract is just good business Contracts may be useful in court Contracts may be useful in court Have an attorney read over your contract before sending or signing it Have an attorney read over your contract before sending or signing it

13. Projects To get credit for this session, do any one of these: To get credit for this session, do any one of these: Project 1: Using The Metasploit Framework to take over a vulnerable computer remotely Project 1: Using The Metasploit Framework to take over a vulnerable computer remotely Project 2: : Using Ophcrack to crack Windows passwords with Rainbow tables Project 2: : Using Ophcrack to crack Windows passwords with Rainbow tables Project 3: Using a Keylogger to record keystrokes (including passwords) Project 3: Using a Keylogger to record keystrokes (including passwords) 13

14. CNIT 123: Ethical Hacking and Network Defense 3-unit course 3-unit course Offered face-to-face next semester Offered face-to-face next semester Face-to-face and online sections in Spring 2008 Face-to-face and online sections in Spring 2008 14