Introduction & Framework Chapter 1

Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Revised by Huei Lee

Critical Infrastructure 2

Figure 1-1: CSI/FBI Computer Crime and Security Survey  Survey conducted by the Computer Security Institute ( http://www.gocsi.com

).

 Based on replies from 503 U.S. Computer Security Professionals.

3

Figure 1-1: CSI/FBI Computer Crime and Security Survey Threat Viruses Percent Reporting an Incident 1997 Percent Reporting an Incident 2002 82% 85% Average Annual Loss per Firm (x1000) 1997 $76 Average Annual Loss per Firm (x1000) 2002 $283 Laptop Theft 58% 65% $38 $89 4

Figure 1-1: CSI/FBI Computer Crime and Security Survey Threat Denial of Service System Penetration Unauthorized Access by Insiders Percent Reporting an Incident 1997 Percent Reporting an Incident 2002 24% 40% Average Annual Loss per Firm (x1000) 1997 $77 20% 40% 40% 38% $132 NA Average Annual Loss per Firm (x1000) 2002 $297 $226 NA 5

Figure 1-1: CSI/FBI Computer Crime and Security Survey Threat Theft of Intellectual Property Financial Fraud Sabotage Percent Reporting an Incident 1997 Percent Reporting an Incident 2002 20% 20% Average Annual Loss per Firm (x1000) 1997 $954 12% 14% 12% 8% $958 $164 Average Annual Loss per Firm (x1000) 2002 $6,571 $4,632 $541 6

Figure 1-1: CSI/FBI Computer Crime and Security Survey Threat Telecom Fraud Telecom Eaves dropping Active Wiretap Percent Reporting an Incident 1997 Percent Reporting an Incident 2002 27% 9% Average Annual Loss per Firm (x1000) 1997 NA Average Annual Loss per Firm (x1000) 2002 NA 11% 6% NA NA 3% 1% NA NA 7

What is new in CSI Survey 2007?

 Some of the preliminary key findings from the 2007 Survey include:    The average annual loss reported more than the last five years. doubled, from $168,000 in last year’s report to $350,424 in this year’s survey. Reported losses have not been this high in Financial fraud second place. overtook virus attacks as the source of the greatest financial loss. Virus losses, which had been the leading cause of loss for seven straight years, fell to Almost one-fifth of those respondents who suffered one or more kinds of security incident said they'd suffered a "targeted attack," i.e. a malware attack aimed exclusively at a specific organization or at a small group of organizations. 8

Identity Theft  The stealing of another person’s information for financial gain.

  See the video

http://abcnews.go.com/Video/playerIndex?id=5523911

 9

Software that covertly gathers information about a user is called ______.

 Adware  Malware 

Spyware

 Shareware  Freeware shareware programs. In other instances, it is embedded within a Web site and is downloaded to the user’s computer, without the user’s knowledge, in order to track data about the user for marketing and advertisement purposes 10

 When receiving warnings of viruses, or requests to donate money to victims of some disaster, you should always check if it is a ____ before reacting to it.

Trick 

Hoax

 Prank  Joke Spam nonexistent causes or warning you of viruses and other Internet dangers that do not exist. You should always check before forwarding such messages to your friends 11

Figure 1-2: Other Empirical Attack Data  Riptech  Analyzed 5.5 billion firewall log entries in 300 firms in five-month period  Detected 128,678 attacks —an annual rate of 1,000 per firm  Only 39% of attacks

after

viruses were removed were directed at individual firms 12

Figure 1-2: Other Empirical Attack Data  SecurityFocus  Data from 10,000 firms in 2001  Attack Frequency  129 million network scanning probes (13,000 per firm)  29 million website attacks (3,000 per firm)  6 million denial-of-service attacks (600 per firm) 13

Figure 1-2: Other Empirical Attack Data  SecurityFocus  Attack Targets  31 million Windows-specific attacks  22 million UNIX/LINUX attacks  7 million Cisco IOS attacks  All operating systems are attacked!

14

Figure 1-3: Attack Trends  Growing Incident Frequency        Incidents reported to the Computer Emergency Response Team/Coordination Center 1997: 2,134 1998: 3,474 (75% growth from previous year) 1999: 9,859 (164% growth) 2000: 21,756 (121% growth) 2001: 52,658 (142% growth) Tomorrow?

15

Attack Trends 16

Figure 1-3: Attack Trends  Growing Randomness in Victim Selection  In the past, large firms were targeted  Now, targeting is increasingly random  No more security through obscurity for small firms and individuals 17

Figure 1-3: Attack Trends  Growing Malevolence  Most early attacks were not malicious  Malicious attacks are becoming the norm 18

Figure 1-3: Attack Trends  Growing Attack Automation  Attacks are automated, rather than humanly directed  Essentially, viruses and worms are attack robots that travel among computers  Attack many computers in minutes or hours 19

Why You need to take this course?

 Most network software is designed for security.

 This course teaches you fundamental concepts of security and infrastructure.

 Some governmental IT jobs requires that you have security training.

20

Figure 1-4: Framework for Attackers  Elite Hackers   Hacking: intentional access without authorization or in excess of authorization Some call this cracking, not hacking, which they equate to any skilled computer use   Characterized by technical expertise and dogged persistence, not just a bag of tools  Use attack scripts to automate actions, but this is not the essence of what they do Deviants and often part of hacker groups that reinforce deviant behavior 21

Figure 1-4: Framework for Attackers  You may hear the terms “white hat” (good guys) and “black hat” bad guys  Black hat hackers break in for their own purposes  “White hat” can mean multiple things  Strictest: Hack only by invitation as part of vulnerability testing  Some who hack without permission but report vulnerabilities (not for pay) also call themselves white hat hackers 22

Figure 1-4: Framework for Attackers  You will also hear the term “ethical hacker”  Some hack only by invitation as part of vulnerability testing  Others hack without invitation but have a “code of ethics”   Do no damage or limited damage Some “hacker codes” allow considerable victimization 23

Figure 1-4: Framework for Attackers  Hats, Ethical Codes of Conduct, and Criminality  If hack without explicit authorization, it is criminal  Motive for hacking is not part of the law —only intentionally accessing without authorization or in excess of authorization 24

Figure 1-4: Framework for Attackers  Virus Writers and Releasers  Virus writers versus virus releasers  Only releasing viruses is punishable 25

Figure 1-4: Framework for Attackers  Script Kiddies  Use pre-written attack scripts (kiddie scripts)  Viewed as lamers and script kiddies  Large numbers make dangerous  Noise of kiddie script attacks masks more sophisticated attacks 26

Figure 1-4: Framework for Attackers  Criminals  Many attackers are ordinary garden-variety criminals  Credit card and identity theft  Stealing trade secrets (intellectual property)  Extortion 27

Figure 1-4: Framework for Attackers  Employees, Consultants, and Contractors  Have access and knowledge  Financial theft  Theft of trade secrets (intellectual property)  Sabotage  IT and security staff  Consultants 28

Figure 1-4: Framework for Attackers  Cyberterrorism and Cyberwar  New level of danger  Infrastructure destruction   IT Infrastructure Use IT to damage physical infrastructure  Cyberterrorists versus cyberwar by national governments  Amateur information warfare is also a danger 29

Figure 1-5: Framework for Attacks

Attacks

Physical Access Attacks - Wiretapping Server Hacking Vandalism Dialog Attacks - Eavesdropping Impersonation Message Alteration Scanning (Probing) Penetration Attacks Social Engineering - Opening Attachments Password Theft Information Theft Break-in Denial of Service Malware - Viruses Worms 30

Figure 1-6: Social Engineering Attacks and Defenses  Social Engineering  Tricking an employee into giving out information or taking an action that reduces security or harms a system  Opening an e-mail attachment that may contain a virus  Asking for a password claiming to be someone with rights to know it  Asking for a file to be sent to you 31

Figure 1-6: Social Engineering Attacks and Defenses  Social Engineering Defenses  Training  Enforcement through sanctions (punishment) 32

Figure 1-7: Eavesdropping on a Dialog Dialog Client PC Bob Hello Hello Attacker (Eve) intercepts and reads messages Server Alice 33

Figure 1-8: Encryption for Confidentiality Encrypted Message “100100110001” Client PC Bob Original Message “Hello” “100100110001” Attacker (Eve) intercepts but cannot read Server Alice Decrypted Message “Hello” 34

Figure 1-9: Impersonation and Authentication I’m Bob Client PC Bob Attacker (Eve) Prove it!

(Authenticate Yourself) Server Alice 35

Figure 1-10: Message Alteration Dialog Client PC Bob Balance = $1 Balance = $1,000,000 Balance = $1 Attacker (Eve) intercepts and alters messages Balance = $1,000,000 Server Alice 36

Figure 1-11: Secure Dialog System Secure Dialog Client PC Bob Automatically Handles Negation of Security Options Authentication Encryption Integrity Server Alice Attacker cannot read messages, alter messages, or impersonate 37

Figure 1-12: Network Penetration Attacks and Firewalls Hardened Client PC Hardened Server Passed Packet Internet Firewall Internet Attack Packet Attacker Dropped Packet Log File Internal Corporate Network 38

Figure 1-13: Scanning (Probing) Attacks Reply from 172.16.99.1

Host 172.16.99.1

No Host 172.16.99.2

No Reply Corporate Network Probe Packets to 172.16.99.1, 172.16.99.2, etc.

Internet Attacker Results 172.16.99.1 is reachable 172.16.99.2 is not reachable … 39

Figure 1-14: Single-Message Break In Attack 1.

Single Break-In Packet 2.

Server Taken Over By Single Message Attacker 40

Figure 1-15: Denial-of-Service (DoS) Flooding Attack Message Flood Server Overloaded By Message Flood Attacker 41

Figure 1-16: Intrusion Detection System 4. Alarm Network Administrator 2. Suspicious Packet Passed 3. Log Packet Hardened Server Log File Intrusion Detection System 1.

Suspicious Packet Internet Attacker Corporate Network 42

Figure 1-17: Security Management  Security is a Primarily a Management Issue, not a Technology Issue  Top-to-Bottom Commitment  Top-management commitment  Operational execution  Enforcement 43

Figure 1-17: Security Management  Comprehensive Security  Closing all avenues of attack  Asymmetrical warfare  Attacker only has to find one opening  Defense in depth  Attacker must get past several defenses to succeed  Security audits  Run attacks against your own network 44

Figure 1-17: Security Management  General Security Goals (CIA)  Confidentiality  Attackers cannot read messages if they intercept them  Integrity  If attackers change messages, this will be detected  Availability  System is able to server users 45

Figure 1-18: The Plan —Protect— Respond Cycle  Planning   Need for comprehensive security (no gaps) Risk analysis  Enumerating threats    Threat severity = estimated cost of attack X probability of attack Value of protection = threat severity – cost of countermeasure Prioritize countermeasures by value of prioritization 46

Figure 1-19: Threat Severity Analysis 4 5 6 7

Step

1 2 3

Threat

Cost if attack succeeds

A

$500,000 Probability of occurrence Threat severity 80% $400,000 Countermeasure cost Value of protection Apply countermeasure?

Priority $100,000 $300,000 Yes 1

B

$10,000 20% $2,000 $3,000 ($1,000) No NA

C

$100,000 5% $5,000 $2,000 $3,000 Yes 2

D

$10,000 70% $7,000 $20,000 ($13,000) No NA 47

Figure 1-18: The Plan —Protect— Respond Cycle  Planning     

Security policies

drive subsequent specific actions

Access control

Technical security architectures  Tools for comprehensive security (firewalls, etc.)  Central management Awareness and procedure training Punishment 48

Figure 1-18: The Plan —Protect— Respond Cycle  Protecting  Installing protections: firewalls, IDSs, host hardening, etc.

 Updating protections as the threat environment changes  Testing protections: security audits 49

Figure 1-18: The Plan —Protect— Respond Cycle  Responding  Planning for response (Computer Emergency Response Team)  Incident detection and determination  Procedures for reporting suspicious situations   Determination that an attack really is occurring Description of the attack 50

Figure 1-18: The Plan —Protect— Respond Cycle  Responding  Recovery    The first priority Stop the attack Repair the damage   Punishment  Forensics   Prosecution Employee Punishment Fixing the vulnerability that allowed the attack 51

Security Certification  The most widely recognized security certification: CISSP and SSCP  CISSP of the International Information Systems Security Certification Consortium (ISC 2 )  SSCP: System Security Certified Practitioners.

 Problems: need working experience  CISCO Certificated Security Professional (CCSP) 52

CCNA  Prerequisites  No prerequisites  Content:  http://www.cisco.com/en/US/learning/le3/current_ exams/640-801.html

53

Other Certificates in CISCO Cisco Certificated Internetworking Expert Cisco Certified Network Professional 54