UNDERSTANDING THREATS(FORCES OF EVIL)● Access control threats can be a negativeimpact on confidentiality, integrity, andavailability of information assets.● There are threats that attack the networksystems, and applications that store andprocess an organizations data.● There many different types of threats and itsimportant for us to understand how thethreats work.
EXAMPLES OF THREATS:● Denial of service● Buffer overflows● Mobile code● Malicious software● Password crackers● Spoofing/masquerading● Sniffers● Eavesdropping● Emanations
EXAMPLES OF THREATS(CONTINUED):● Shoulder surfing● Tapping● Object reuse● Data remnants● Unauthorized targeted data mining● Dumpster diving● Backdoor/trapdoor● Theft● Intruders● Social engineering
DENIAL OF SERVICE(DOS):● DoS can range from consumption of specificresources, preventing resources, andpreventing networks to communicate topreventing communication, performance ofsystem service or application unusable, or acomplete outage.● Known as SYN floods, attacker would maketo many SYN packets without completing theproper setup, taking all available server andmaking sure that the owner would nevergain access to the server.
DOS(CONTINUED):● DDoS is where DoS only attacks fromone location, DDoS attacks frommany different locations.● Attackers built a vast networks ofcommandeered system, known as"Zombies", zombies make millions ofrequest to the web site at once andfully floods the system, and thus itshuts down.
BUFFER OVERFLOWS:● Buffering is for controlling data inputsand outputs at all levels of a systeminteraction.● Buffer overflow is an attack thathandles the systems capability tooperate its buffers, causing systemfailures and outages, fail to control anapplication state, not able to control arunning program, or the performanceof code of an attackers choosing.
BUFFER OVERFLOWS (CONTINUED):● Buffer overflows can also be used toinsert malicious software for processingfor the attacker. Also because memorybuffers are used in network interfaces,video systems, RAM, or virtual memoryon hard disks, all are vulnerable to abuffer overflow.● Buffering overflows are mostly causedby poor application or system memorymanagement.
MOBILE CODE:● Mobile code is a software that is transmittedacross a network from a remote source to alocal system.● Security involvement are important becausedistribution capability, limited user awareness,and potential for harm.● Mobile code is designed to be provided to anend-user device. If device is not configuredproperly it can infect or manipulate system.● Organizations should make its users aware of thedangers of mobile code.
MALICIOUS SOFTWARE (MALWARE):● Malware any digital material that is deliberatelydesigned to perform undesirable tasks.● ○Virus: Parasitic code that requires human action orinsertion.● ○ Worm: Self-propagation code that exploits systemor application vulnerability to replicate.● ○ Trojan Horse: Is general temp referring to programsthat appear desirable, but contains somethingharmful.● ○ Spyware: Spyware was a hidden applicationinjected through poor browser security by companiesseeking:
MALWARE (CONTINUED):a) Malvertisement: are webadvertisements which appear to belegitimate yet direct users to downloadmalware onto system.b) Malnets: are malware networkswhich typically consist of numerousinfected websites, desktops, laptops,and increasingly mobile devices togain more information about usersInternet activity.
PASSWORD CRACKERS:● Key factor is the saving of the hashedpassword, and that is where passwordcracker comes in.● Password crackers are one of the few toolsthat are equally effective for securityadministrators and attackers alike.● Rainbow table: attack has revolutionizedpassword cracking is being rapidlyadopted by tool creators.
SPOOFING/MASQUERADING● Is the act of appearing to a system as if acommunication from an attacker is coming from aknown and trusted source● Early versions of spoofing were performed bymanipulating the packets of data used in the IPprotocol.● Not common because todays computers areprepared from the systems and firewalls.● Have a profound effect on access control systembecause they move the assurance that a person isdealing with a trusted entity.
SNIFFERS,EAVESDROPPERS. ANDTAPPING● All communications, weather wired orwireless need to travel from point to pointover some medium.● Sniffers are devices that can collectinformation from a communication medium,such as a network.● Sniffing can be used for good and evil.● Best protecting against sniffing,eavesdropping, and tapping is to intercepttransmission between devices.
EMANATION:● Is the proliferation or propagation at thosesignals.● By intercepting and interpreting the emanationscoming from a particular device, an attackercan often by reconstruct the information that isbeing shown or processed on the device.● There are materials that restrict the ability forradio waves to propagate through them. Thisinvolves the use of special point on the wallsand special window coverings that can beplaced on windows or other weak points tofurther disrupt the emanation of
SHOULDER SURFING● Is the act of surreptitiously gatheringinformation from a user by, means ofdirect observation of the usersactivity, by looking over theirshoulder as they perform someaction.
OBJECT REFUSE:● Refers to the allocation or reallocation of systemresources to a user or to an application orprocess.● There are two areas of concern withapplication object reuse: the directemployment of the objects, or the data input oroutput from the object.● Object reuse is also applicable to systemmedia, such as a hard drive, magnetic media,RAM-based devices or other forms to datastorage.
DATA REMANENCE● It is becoming increasingly common place tobug used computers equipment, such as ahard drive, or router, and find information onthe device left there by the previous owner,information they thought had been deleted.● Another potential source of data exposurecomes from the slack space at the end of afile.● In early computer systems, the slack space atrandom portions of data pulled from memory.
DATA REMANENCE (CONTINUED):● Slack space can also be used by an attacker. Somedata is completely used to identify and extract theinformation.● There are utilities that can be used to securely wipethe data from the hard drive by over writing the fileinformation with bytes of 1s and 0s, or a randomcombination of both. This wipe includes the unusualstable space in clusters assigned to allocated files.● The most effective mechanism to destroy data,either a single file or an entire disk-short of grindingthe disk into little pieces, which is still no guarantee, isto over write the data several times.
UNAUTHORIZED TARGETED DATAMINING● Is the act of collecting and analyzing largequantities of information to determinepatterns of use or behavior and use thosepatterns to form conclusion about past,current, or future behavior.● Attackers will perform reconnaissanceagainst their target in an effort to collect asmuch information as possible to drawconclusions on operations, practices,
DUMPSTER DIVING● Is simply the act of taking what people assume istrash and using that information, sometimes incombination with other data, to formulateconclusions or refine strategies for an attack.● Most attackers dont want to risk physicalcontact with their target and the potentialexposure of going through the organizationstrash.● The ability of an unauthorized person to get tothe trash repository of a site also shows aweakness in the physical access controls of thatfacility.
BACKDOORS AND TRAPDOORS● Applications may have hard-coded instructions thatallow complete and unfettered access to those whoknow the existence of the backdoor.● Most common method of backdoor access is theuse of hidden accounts built within the application.● The threat to access controls from backdoors andtrapdoors is based on the existence of unknownconfigurations that will allow someone to circumventestablished controls and gain full access to system.
LOGIC BOMBS:● Attacks can be immediately seen or effect takeshold as soon as the attack is launched, or someattacks can hold for days, weeks, even years. Theseattacks are called logic bombs because the rely ona logical progression of events before they unleashtheir aggression.● Can be difficult to find, particularly if they havebeen placed there by someone with intimateknowledge of the system of its source code.● Best way to defend against them is to include athrough out code review on all software deployedthroughout the enter prise.
THEFT:● Is a simple concept anyone can grasphow ever, as the digital interactionbetween people and business expands,the exposure of valuable informationcontinues to exceed the physical notionof the term theft.● Physical theft includes anything of valuean unauthorized entity can remove.● Digital theft is when the thief hasdestroyed the information during the actof stealing it, original data is still there
SOCIAL ENGINEERING:● Is the practice of misdirection to obtaininformation through social contacts.● Can take many forms, ranging fromtelephone calls to e-mail to face toface interaction.● Best prevention is effective andcontinues security awareness andeducation effort to all personnel withinthe organization.
E-MAIL SOCIAL ENGINEERING● Can be a powerful persuasion device forattackers and con artists alike.● E-mail has become a basic mode ofcommunications for many people and isconsidered crucial for many companies to run asuccessful business.● E-mail social engineering presents manyproblems to effective access control,but theprimary problem is that it can be used to obtainenough personal or system information from avictim that the attacker can subsequentlyobtain or bypass legitimate authentication andauthorization information.
HELP DESK FRAUD● The goal of a helped desk attack is forthe attacker to get a valid ID andpassword to an internal system.● This technique is becoming harder andharder to use, because helped deskemployees are usually trained to follow aspecific protocol and providingpasswords,and many of these protocolsdo not include furnishing passwords overthe phone
THREAT MODELING● In reviewing access control attacks and mitigating factors,several risk assessment methods can be considered.● Threat modeling approaches vary from organization toorganization but generally follow an approach of:● Defining the scope and objectives● Understanding or modeling the system● Development of threats● Development of vulnerabilities● Determining the impact and risk● Develop the mitigation plan
DEFINE THE SCOPE AND OBJECTIVES● An effective threat modeling exercise mustdetermine what is within the scope of themodeling.● There is a trade off between the size of thescope and amount of effort required to providemeaningful recommendations.● If scope is to narrow the assessor may neglectsignificant information.● If scope is too large, resources available formitigation are spent on assessment.
UNDERSTANDING OR MODELINGTHE SYSTEM:● In understanding how the target systemor application operates, collect as muchinformation available about the system.● Cost information about the operation,development and information containedin the system should also be understoodas it will be required to make value baseddecisions.
DEVELOPMENT OF THREATS:● Can be as much of an art as a scienceand will vary greatly depending on thethreat information sources available.● Classified or national security information,which may be relevant to the system.
DEVELOPMENT OF VULNERABILITIES:● Using automated tools, avulnerability scan of the targetsystem or application should beperformed.● Weakness should also be reviewed.
DETERMINING IMPACTS AND RISK:● There are several qualitative andquantitative ways to determineimpacts and risks.● Qualitative route is the simplest andhelps determine the overall impactand risk to the organization.● Once levels of risk are determined avalue to mitigate each should bedetermined.
DEVELOP A MITIGATION PLAN:● This plan should ideally identifyresidual risks, exposure, resourcesrequired to mitigate risks and timelines for mitigations.● Plan should also have identifyresponsible party for each riskmitigation and who acceptedresidual risks on behalf of theorganization.
ASSET VALUATION:● In determining the value of information systemsthere are several components which must beaccounted for:● Hardware● Software● Integration● Opportunity cost● Regulatory exposure● Information replacement● Reputation exposure
HARDWARE, SOFTWARE,AND INTEGRATION:● Hardware:● The replacement cost of hardware can be significantand can increase dramatically when the hardware isout of support or the vendor has gone out of business.● Software:● Much like hardware, software can go out of supportand vendors can dissolve or merge with othercompanies.● Integration:● Cost are often “sunk” invisible costs that are easilyoverlooked when considering the value of an asset.
OPPORTUNITY COSTS, REGULATORY ANDREPUTATIONAL EXPOSURE, ANDINFORMATION REPLACEMENT:● Opportunity Costs:● When a crucial business support system such as an e-commercesite for a major online retailer is down time is substantial money.● Regulatory Exposure:● In a regulated environment, there are stiff penalties for breachinginformation.● Information Replacement:● The information an organization develops as part of its operation ismost likely not going to be replaced overnight.● Reputational Exposure:● Whats that cost of losing a reputation? Reputation is extremelydifficult and expensive to achieve and mainstream.
ACCESS AGGREGATION:● Is the act of collecting additional roles andresponsibilities in organization or information system.● The combination of systems may make it possible tocommit fraud as separation of duties also breaksdown as access aggregation occurs.● Information security professionals should work withhuman resources and information technologyadministrators to ensure DE-provisioning of access isperformed any time an human resource changesroles.
VULNERABILITY ASSESSMENT:● To begin the vulnerability assessment process, assessormust have a good understanding of the business, itsmission and the system or application to be assessed.● The next step is to examine the existing controls in placeto protect the system or process.● Once the vulnerability scanning is complete the securityanalyst must examine the results for accuracy.● Once the final analysis is complete the assessor shoulddiscuss the findings with the business are to determine theappropriate course of remediation action to take.
PENETRATION TESTING:● The next level in vulnerability assessment seeks toexploit existing vulnerabilities to determine the truenature and impact of a given vulnerability.● Penetration testing goes by many names, such asethical hacking, tiger teaming, red teaming andvulnerability testing.● Penetration testing can be employed against anysystem or service.● The key to successful and valuable penetrationtesting is clearing defined objectives, scope,started goals, agreed-upon limitations, andacceptable activities.
PENETRATION TEST STRATEGIES:● Strategies are based on specificobjectives to be achieved, are acombination of the source of the test,how the companys assets are targeted,and the information provided to thetester.● The organization must determine the areaof the organization or the service to betested.
APPLICATION SECURITY TESTING:● The objective of application security testing is toevaluate the controls within an application andits information process flow.● Application testing will test the flow ofinformation through the application and itssusceptibility to intercept or alteration.● Application will test for a wide range ofcommon attack scenarios to gauge the level ofresistance an application has to attacks ofvarying level of sophistication.
DENIAL-OF-SERVICE (DOS) TESTING:● Goal is to evaluate the systemssusceptibility to attacks that will render itinoperable or unable to provide neededservices to the organization external users.● Because the DoS testing presents such arisk to systems, many testers will performthe attack steps leading up up to the DoSbut stop short of crashing the system. Thissaves a great deal of response and
WAR DIALING:● Is a technique for systematically calling arange of telephone numbers in an attemptto identify modems, remote-access devices,and maintenance connections for computerthat may exist within an organizationsnetwork.● Organizations would be wise not tounderestimate their reach into theinfrastructure or their potential for creatingvulnerabilities in the environment.
WIRELESS NETWORK TESTING:● Wireless networks, whether throughformal, approved network architecture orthe inadvertent actions of well-meaningusers, creates additional securityexposures.● Goal is to identify security gaps or flaws inthe design, implementation, or operationof the organizations wireless network.
SOCIAL ENGINEERING:● Often used in conjunction with blindand double-blind testing, socialengineering refers to techniquesused social interaction, typically withthe organizations employees,suppliers, and contractors, to gatherenough information to be able topenetrate the organizationsphysical premises or systems.
PBX AND IP TELEPHONY TESTING:● Beyond war dialing, phone systemshave been a highly vulnerable, yetoften overlooked, method of gainingaccess to corporate resources.● The potential threat profile representedby combining the threats associatedwith IP networks and those oftelephone systems is one andorganization should take seriously.
PENETRATION TEST METHODOLOGY:● A methodology is an established collection of processesthat are preformed in a predetermined order to ensurethe job, function, or security test is accurately executed.● (1)Reconnaissance/Discovery:Identify and documentinformation about the target.● (2)Enumeration:Gain more information with intrusivemethods.● (3)Vulnerability Analysis:Map the environment profile toknown vulnerabilities.● (4)Execution:Attempt to gain user and privileged access.● (5)Document findings:Document the results of the test.