Download as PDF, PPTX
![VCE Exam Simulator Pro 2.1 Crack Free Download [Latest Version]](https://cdn.slidesharecdn.com/ss_thumbnails/informationtechnology1-250521183342-ee236b53-thumbnail.jpg?width=640&height=640&fit=bounds)
CLOUD & ETHICAL HACKING INTRODUCTION PDF
- 1. Cloud computing & EthicalHacking
- 2. Index ï” What iscloud computing? ï” Cloud computing History? âŠ ï” Architectural Layers of Cloud Computing ï” Cloud Computing Infrastructure Models ï” Advantages of Cloud Computing ï” Certified Ethical Hacker (CEH) ï” Types of hackers ï” Security vulnerability ï” Types of Security Vulnerabilities
- 3. What is cloudcomputing? ï” Distributed computing on internet Or delivery of computing service over the internet. Eg: Yahoo!, GMail, Hotmail ï” Instead of running an e-mail program on your computer, you log in to a Web e-mail account remotely. The software and storage for your account doesn't exist on your computer -- it's on the service's computer cloud
- 4. History? âŠ. ï” Conceptevolved in 1950(IBM) called RJE (Remote Job Entry Process). ï” In 2006 Amazon provided First public cloud AWS(Amazon Web Service).
- 5. Architectural Layers ofCloud Computing ï” Software as a service (SaaS) ï” Platform as a service (PaaS) ï” Infrastructure as a service (IaaS)
- 6. Software as aservice (SaaS) ï” Offers a complete application as a service on demand ï” A single instance of software runs on cloud and provides service to multiple end users or organizations ï” Examples are Google apps, salesforce.com etc.
- 7. Platform as aservice (PaaS) ï” Encapsulates a layer of software and provides it as service which is used to build higher-level services ï” Consumers creates the software using tools and libraries from the provider ï” Consumer controls deployment and configuration settings ï” Provider provides networks, servers and storage ï” Example, Google Apps Engine
- 8. Infrastructure as aservice (IaaS) ï” Most basic cloud service model ï” Provider provides computers (physical or a virtual machine), storage, firewalls, and networks ï” Provider provides these facilities on demand ï” Consumer is responsible for maintaining application software and operating system ï” Cloud provider bill the consumer on the basis of amount of resources allocated and consumed
- 9. Cloud Computing InfrastructureModels ï”Public Clouds ï”Private Clouds ï”Hybrid Clouds
- 10. Public cloud ï” Runby third parties ï” Resources like applications and storage is available to general public over internet for free or on a pay-per usage mode
- 11. Private cloud ï” Buildfor exclusive use of one client ï” Provides utmost control over data, security and QoS ï” Provides access to external resources through web services
- 12. Hybrid cloud ï” Hybridcloud uses local infrastructure with cloud computing capacity from public cloud
- 13. Advantages of CloudComputing ï” Cost Savings. Cost saving is one of the biggest Cloud Computing benefits. ... ï” Strategic edge. Cloud computing offers a competitive edge over your competitors. ... ï” High Speed. ... ï” Back-up and restore data. ... ï” Automatic Software Integration. ... ï” Reliability. ... ï” Mobility. ... ï” Unlimited storage capacity. ... ï” Collaboration. ... ï” Quick Deployment. ...
- 14. Certified Ethical Hacker(CEH) ï” Certified Ethical Hacker (CEH) is a qualification obtained by demonstrating knowledge of assessing the security of computer systems by looking for weaknesses and vulnerabilities in target systems, using the same knowledge and tools as a malicious hacker, but in a lawful and legitimate manner to assess the security posture of a target system. This knowledge is assessed by answering multiple choice questions regarding various ethical hacking techniques and tools. The code for the CEH exam is 312-50. This certification has now been made a baseline with a progression to the CEH (Practical), launched in March 2018, a test of penetration testing skills in a lab environment where the candidate must demonstrate the ability to apply techniques and use penetration testing tools to compromise various simulated systems within a virtual environment
- 15.
- 16. Security vulnerability ï” Asecurity vulnerability is defined as an unintended characteristic of a computing component or system configuration that multiplies the risk of an adverse event or a loss occurring either due to accidental exposure, deliberate attack, or conflict with new system components.
- 17. Types of SecurityVulnerabilities ï” Unpatched Software ï” Misconfiguration ï” Weak Credentials ï” Phishing, Web & Ransomwar ï” Trust Relationship ï” Compromised Credentials ï” Malicious Insider ï” Missing/Poor Encryption ï” Zero-days & Unknown Methods
- 18. ï” Unpatched Softwareâ Unpatched vulnerabilities allow attackers to run a malicious code by leveraging a known security bug that has not been patched. The adversary will try to probe your environment looking for unpatched systems, and then attack them directly or indirectly. â ï” Misconfiguration â System misconfigurations (e.g. assets running unnecessary services, or with vulnerable settings such as unchanged defaults) can be exploited by attackers to breach your network. The adversary will try to probe your environment looking for systems that can be compromised due to some misconfiguration, and then attack them directly or indirectly. ï” Weak Credentials â An attacker may use dictionary or brute force attacks to attempt to guess weak passwords, which can then be used to gain access to systems in your network.
- 19. ï” Phishing, Web& Ransomware â Phishing is used by attackers to get users to inadvertently execute some malicious code, and thereby compromise a system, account or session. The adversary will send your users a link or malicious attachment over email (or other messaging system), often alongside some text/image that entices them to click. ï” Trust Relationship â Attackers can exploit trust configurations that have been set up to permit or simplify access between systems (e.g. mounted drives, remote services) to propagate across your network. The adversary, after gaining access to a system, can then proceed to breach other systems that implicitly trust the originally compromised system. ï” Compromised Credentials â An attacker can use compromised credentials to gain unauthorized access to a system in your network. The adversary will try to somehow intercept and extract passwords from unencrypted or incorrectly encrypted communication between your systems, or from unsecured handling by software or users. The adversary may also exploit reuse of passwords across different systems
- 20. ï” Malicious Insiderâ An employee or a vendor who might have access to your critical systems can decide to exploit their access to steal or destroy information or impair them. This is particularly important for privileged users and critical systems. ï” Missing/Poor Encryption â With attacks on Missing/Poor Encryption, an attacker can intercept communication between systems in your network and steal information. The attacker can intercept unencrypted or poorly encrypted information and can then extract critical information, impersonate either side and possibly inject false information into the communication between systems. ï” Zero-days & Unknown Methods â Zero days are specific software vulnerabilities known to the adversary but for which no fix is available, often because the bug has not been reported to the vendor of the vulnerable system. The adversary will try to probe your environment looking for systems that can be compromised by the zero day exploit they have, and then attack them directly or indirectly.