This ebook, written by Ron McFarland, serves as an introductory resource on information security, focusing on topics relevant to the CISSP, CISM, and CCNA-Security certification exams. It covers essential concepts like encryption, symmetric and asymmetric key algorithms, as well as various security measures to protect systems from threats. The intention of the book is to provide a broad understanding of information security, making it accessible for beginners and those preparing for certification exams.

1. 1
INFORMATION SECURITY
BASICS:
FUNDAMENTAL READING FOR INFOSEC
INCLUDING THE CISSP, CISM, CCNA-
SECURITY CERTIFICATION EXAMS
RON MCFARLAND, PH.D.
http://www.wrinkledbrain.net
Copyright © 2014-2017 by Ron McFarland Ph.D.

2. 2
WHY I WROTE THIS BOOK
I wrote this book because many of my readers and
students have requested preliminary information about
information security as it pertains to the CISSP
(Certified Information Systems Security Professional),
the CISM (Certified Information Security Manager), the
CCNA-Security (Cisco Certified Networking Associate –
Security), or other information security exams. Other
readers and learners who were either new or not as
familiar with the information security world have asked
for a fairly easy read that covers many of the
information security aspects that an information
technologist or an information systems.
This book is written in a broad-brush manner. That is, it
is my intention to introduce many of the topics covered
in either the CISSP, CISM or CCNA-Security realms. For
some readers, you might be planning on taking one of
these certification exams. And again, for others, you
wanted to find a quick read on many security topics so
that you are more familiar with the overall field. If this
describes you, this eBook is for you.

3. 3
As a further note, while this eBook does cover many
(not all) of the CISSP, CISM and CCNA-Security aspects
and also discusses many Information Security (InfoSec)
topics in general, more detailed books on this subject
are available (with an appropriate heavier cost).
However, in the next several months, I plan on
publishing additional InfoSec, Networking, and Ethical
Hacking eBooks that can supplement your studies.

4. 4
WHY YOU SHOULD READ THIS BOOK
This book will help you understand many of the
preliminary topics involved in the very rich and ever-
changing world of Information Security (InfoSec). I
wrote this eBook to assist you, the reader, in
understanding Information Security from the ground
up. The topics in this eBook cover many of the topics
found in as it pertains to the CISSP (Certified
Information Systems Security Professional), the CISM
(Certified Information Security Manager), the CCNA-
Security (Cisco Certified Networking Associate –
Security), and other information security exams.
If you are new to the information security world or wish
to brush up on many of the topics in the InfoSec world,
this easy-to-read eBook is for you. It was my intention
to make this an easy read and enjoyable read as we
discuss many information security topics as you,
perhaps, prepare for an interview or prepare to take on
more extensive studying required of many of the
security-related certifications.

5. 5

6. 6
TABLE OF CONTENTS
Why I Wrote This Book............................................................................2
Why You Should Read This Book.........................................................4
Table of Contents........................................................................................6
Introduction..................................................................................................7
Chapter 1. Introduction to Encryption..............................................9
Chapter 2. Introduction to Symmetric Key Algorithms ..........40
Chapter 3. Malware.................................................................................53
Chapter 4. Firewalls................................................................................73
Chapter 5. Denial of Service Attacks................................................86
Chapter 6. Cryptographic Tools......................................................103
Chapter 7. Wireless Security............................................................116
Chapter 8. Operating System Security.........................................151
Chapter 9. Database Security...........................................................166
Chapter 10. Computer Auditing .....................................................183
Summary ..................................................................................................199
References ...............................................................................................201
About The Author.................................................................................211
Other Books By Ron McFarland .....................................................213

7. 7
INTRODUCTION
Information Security is a hot topic and, for the
professional information technologist, is an important
set of skills to be proficient in. Further and more
importantly, since we are in this ever-expanding and
ever growing field of information technology and
information systems, having a certification or two in the
information security area can be a boost to our career.
On a very recent Internet search from a reputable
source (Global Knowledge:
http://www.globalknowledge.com/training/generic.as
p?pageid=3430 ), the CISSP (Certified Information
Systems Security Professional) offered by ISC2 was as
the second top-paying industry certification (followed
by the Project Management Professional – PMP), which
further emphasizes the importance of the information
security field in the technology industry. Likewise, other
security-related certifications are as important in other
aspects of the information technology and information
security fields.

8. 8
This eBook starts out with a discussion of encryption
and a discussion on various malware, as one focus of
our discussion on securing systems. Also, we’ll discuss
various types of system attacks as well as several
methods to prevent these. Further, we’ll discuss a few
relevant hardware and software-related items like
firewalls, Intrusion Detection Systems (IDS), Intrusion
Protection Systems (IPS), honeypots, and methods of
control for our systems. Further, we’ll discuss database
and programming related security topics like SQL-
injection and good programming practice. Also, we’ll
discuss the relevance of auditing and secure
configuration as it pertains to information systems in
general with a security focus in mind.
And, as a reminder, if any or all of these topics are not
familiar, or if you feel a bit rusty with several (or all) of
these concepts, again, this eBook is for you. We’ll take a
measured approach to these topics (and a few more) as
we go through our discussion on information security.
Hang on for an interesting ride!

9. 9
CHAPTER 1. INTRODUCTION TO
ENCRYPTION
I know that talking about encryption isn’t a sexy topic.
Try talking about encryption at your next social event
and count the number of people who roll their eyes or
who immediately change the topic! However, if you’re
reading this eBook, I’m going to assume that you’re one
of three types of people – you’re a geek (like me), you’re
a wanna-be-geek (as I once was), or a student/learner
interested in information security (I suppose I fit this
category earlier on as well). We’ll start our discussion
about encryption since it is the basis of much of the
work done in information security.
In general, encryption (of a few ‘flavors’) of digitally
stored (also known as static data) and transmitted data
(also known as data in motion) has been important
since computers and networks were first used. Recently
the subject of information security and encryption has
become a topic of high public interest following the
release of documents by Edward Snowden which

10. 10
detailed the various eaves-dropping programs by the
NSA (National Security Agency) and other intelligence
agencies that have been collecting organizational and
personal data for a number of years (NSA can be found
at: http://www.nsa.gov/).
First, let’s generally discuss what encryption is and why
we “do” encryption. Many already know, either very
generally or more specifically, what encryption is, but
let’s go through the specifics so as not to leave any stone
unturned. Next, let’s talk about what a message is, in
terms of information systems or information
technology. This leads into a discussion about what a
key is, especially when we want to encrypt a message.
As a result of encryption, we’ll derive a cipher, which is
essentially a scrambled message. After we get some of
these basic concepts handled, let’s talk about both
symmetric key encryption and later about asymmetric
encryption so that we can get these important terms
understood. We’ll discuss the application of both
symmetric and asymmetric encryption throughout this
book, so let’s get started with the details.

11. 11
WHAT IS ENCRYPTION
Before we discuss encryption and what it is in terms of
information technology, let’s chat a bit (pun intended, I
suppose) about where encryption comes from.
Encryption comes from the field of cryptography. That’s
another one of those terms that you can share in your
next party! ☺ Cryptography is the field of “secret
writing” that has its origins from the ancient Greeks.
Caesar, for example, would scramble his messages sent
to his generals in case the messages were inadvertently
intercepted. With scrambled writing, messages could
not be interpreted by the enemy. There’s an entire
history of cryptography that you can, optionally, read
up on. While there are textbooks galore about the
history of cryptography, you can find a bit of brief (and
interesting) reading about cryptography on one of the
premier technology websites – Wikipedia!
Encryption is one aspect of cryptography that is
relevant to our discussion in this book. Encryption is the

12. 12
process of encoding (scrambling) information so that
other unauthorized parties can’t read it (other than,
perhaps the NSA!).
Encryption relies on an algorithm (a mathematical
process). Sometimes this is referred to as an encryption
scheme. First, the information or a message, also known
as the plaintext (since it is not encrypted) is run
through the encryption algorithm resulting in the
unreadable (and scrambled) output, which is also
known as the cipher text.
We have a lot of terms here already. To recap, the clear
text message (the plaintext) is used as input to an
algorithm (essentially a program) that will convert the
readable text into cipher text (the scrambled output).
That’s it in a nutshell. So, if this is a new concept, think
about this for a bit before we move on. We’ll use this
basic concept in encryption and will present a few of the
many altered ways that encryption can be handled in an
information system.
By the way, when I mention an information system in
this book, I’m referring to the entire information system

13. 13
including the end users, to the networks, to the file and
database servers and all elements in between. So, I’m
using Information Systems in a very broad and generic
sense. Whenever the conversation needs to be
narrowed down to a specific detail, I’ll provide more of
an explanation so that you’re clear about the context
and scope of the discussion.
THE MESSAGE
To emphasize a bit more on the message portion in our
discussion on encryption, think of the message that a
typical web page will form. If you’re on Amazon
ordering a new book (or an eBook) the screen may have
quite a few fields on it. The screen that you’re working
with may have fields like your name, address, city, state,
zip code, and all the fields for the book information.
When you press enter, you send this information
bundled in a large message (for our example, it could be
as large as 5000 bytes). This message will ultimately be
sent to various networking components, sliced up into
smaller packets to be delivered from the sending end
(your side of the transaction) to the receiving side
(Amazon, in our example). During this process, the

14. 14
message (the plain text) not only will be sliced up into
smaller pieces for delivery, but will be encrypted to
provide you, the user, with security with your order. To
scramble or encrypt a message, the encryption
algorithm uses both the message and a unique key to
scramble the plaintext message into a cipher text
(scrambled) message. Since we’ve discussed what a
message is, let’s talk about the second necessary item
that the encryption process needs – the key.
THE KEY
Whenever I think about keys, I think about the lock on
my storage shed and all of the stuff that I want to keep
secure behind the locked door. I know that I keep a lot
of both needed and useless items in my storage shed,
but that’s for another discussion. Anyway, to secure and
protect your data, like you would if you’re securing your
old furniture and miscellaneous items in a storage shed,
you’d typically use a key and a lock to secure the
storage shed door. The analogy that we use for the
encryption of data is the same. When we encrypt data
(again, scramble data), the algorithm (program,
process) that scrambles the data requires, of course, the

15. 15
data (the plaintext) and also needs a key that it uses to
scramble the data with.
First, the key is a string of data separate and unique
from the plaintext data. Again, the encryption program
looks for the key and the data to scramble your
message.
So, now that we know where the data is from (in our
example, the system got our data from the Amazon web
page that we filled out).
The key is generally (note the ‘generally,’ since we’ll talk
about variations later) obtained by the user. The
encryption system not only gets the data from the
webpage that you’ve sent by hitting enter, but the
encryption program will also ask of the system, “What is
the user’s key that I’ll use along with this message to
encrypt?”
There’s quite a few ways that keys are generated and
stored. We’ll cover several of the important ones in this
book. But for now, just know that when you are
entering in data into (for example, the Amazon website)
you will also have a key that is uniquely yours that is

16. 16
sent along with your message text to the encryption
algorithm. Again, the encryption algorithm uses your
plaintext along with your unique key to scramble
(encrypt) the message so that it is securely sent over
the network (the Internet) and to the end process (the
Amazon ordering site, in our example).
We’ll discuss more of the details in subsequent sections
and chapters in this book. There are a lot of variations
in how encryption works on an Information System, but
this general description will get you started with how
the process generally works.
Now, let’s talk about what happens after the system
encrypts your message by using your key. The result is
the cipher that is discussed in the next section.
THE CIPHER
The result of your message and unique key that is sent
to the encryption algorithm is the cipher. The cipher is
literally a “disguised way of writing.” I don’t know if you
remember Cracker Box candy (maybe I’m dating
myself). Anyway, Cracker Box came with a small toy and
when I was young, I would buy Cracker Box mostly for

17. 17
the small toy that was found in a small package at the
bottom of the box of caramel popcorn and peanuts.
While the product is quite tasty, from my recollection,
mostly the cool toys were my attraction. One of the toys
that were included was an encryption ring. I’d use it to
send notes to my brother that he could read (he also
had an encryption ring). We sent notes back and forth
so that my sister couldn’t read them. (not that my sister
was a bad person at all – it was just that my brother and
I were, well, a bit nerdy and thought we were pretty
cool send scrambled messages back and forth that only
we could read).
Fast forward, what my brother and I were actually
sending to each other were cipher text messages (that is
disguised messages). The message that we each wanted
to send (the plain text message) required us to use the
ring (the key) in a particular way so that we could
scramble the original message into a cipher message.
Of course, on the other end my brother needed to use
his ring to decipher the message or, in InfoSec terms, he
needed to decrypt the message.

18. 18
By the way, have you thought of the origin of Encryption
or Decryption? As a little tidbit of information, the root
word of encryption and decryption is – crypt. A crypt is
an underground vault. It is also a burial place. A crypt is,
as such, a place where you want to store something that
you want to keep buried. Interesting? ☺
Let’s talk about decryption or moving what you wanted
to keep save in the crypt (encrypt) to a state where you
can now read the message.
DECRYPTION
Decryption, as you’ve probably already know by now, is
converting the cipher text into readable form. My
description about my brother and I using a ring to
encrypt and decrypt messages that we hid from our
sister holds with this definition of decryption. But
there’s a twist here. Both my brother and I had identical
rings (other than the fact that I decided to paint my
ring). The ring that he used and the ring that I had were
used to both encrypt and decrypt messages. If we’re
using the same key to both encrypt and decrypt a
message, this is known as a symmetric key. Later, we’ll
discuss what an asymmetric key is, but first, let’s

19. 19
discuss what a symmetric key is in greater detail and as
it relates to data security.
SYMMETRIC KEY ENCRYPTION
First, let’s clarify a few terms. The term symmetric
essentially means to mean the “same” when you are
speaking about the general properties between two
items. For example, if we were talking about symmetry
(the “sameness”) of two parts of an item, if these two
parts were identical, we would say that a diagram (or
graph) that contains two parts is symmetrical (both
parts of the graph – the left side and the right side, as an
example – look the same). If a reflection of an object (a
building, perhaps) is perfectly symmetrical, the
reflection and the building would be identical. In reality,
this would be almost impossible to have a symmetrical
building and reflection since there are so many
variables. Or, in the example of our decoding rings, my
brother and I had the ‘same’ rings – or symmetrical keys
(same keys) to encode or decode messages. Keep in
mind that symmetrical is equivalent of “the same.”
Encryption is generally the scrambling of a message (or
a string of data) so that data can be hidden from

20. 20
another party. The scrambling of data is done generally
by the sending party using a key that is applied to the
message with a resulting scrambled message as the
output. Again, the scrambled output is commonly
known as cipher text. How this is applied in encryption
is that both sides of a symmetrical encryption share the
“same” key.
ASYMMETRIC KEY ENCRYPTION
Now, this is where things get a bit more complex – on
purpose! First, let’s define asymmetric and then discuss
some general features about asymmetric key
encryption.
First, anything with an “a” in front of a term actually
means “not.” So, when people said I was an atypical kid,
I really didn’t know what they were saying when I was,
for example, 8 years old. But what they were saying is
that I was “not” typical. Hmmmm. was that a
complement or … I’ll leave it as is.
Anyway, when we speak of asymmetric key encryption
that would essentially mean “not” symmetrical. If my
brother and I were using asymmetrical encryption (and

21. 21
the resulting decryption), that would mean that I’d have
a different key (ring) than my brother would have. Our
rings would be different. But, while I could encrypt a
message that I was sending to my brother (thus hiding
the message from my sister), he could decrypt
(unencrypt it) using a different key. How can that be?
So that we don’t get stuck with the details of talking
about physical items and asymmetric keys, let’s switch
to a bit of theory. Oh yes, I thought I’d get that cringe
when I mentioned theory, but let’s break down how
asymmetric key encryption and decryption generally
works. Again, take a special focus on asymmetric
encryption in this section. Quite a lot of security (not all,
mind you) is based on asymmetric encryption and
decryption in the computer and information security
world. This is very commonly known as Public Key
Encryption or Public Key Cryptography (the crypto
thing is back!).
PUBLIC KEY ENCRYPTION
As noted in the prior paragraph, we’re switching into a
bit of theory. But this theory is actually applied in
networking security, database security, and other

22. 22
aspects of computer and information security at large.
Note that asymmetric encryption (aka Public Key
Encryption) are the same.
What confused me at first when I heard the term Public
Key Encryption was that I knew it meant asymmetric
encryption? Asymmetric key encryption meant that
both the sender and the receiver had different keys. So
why was it referred to as Public Key Encryption?
Well, the bottom line is that while we are still speaking
of the sender and the receiver having different keys to
encrypt or decrypt messages, the emphasis with the
term (and the term only) is that the public key is one of
the 2 keys in asymmetric encryption that can actually be
publicized. I can place my public key on Facebook, send
it with each email, post it on the bathroom wall…
anywhere. It will still keep an encrypted message secure
even if everyone had the public key available. The
asymmetric message will still be scrambled! To either
scramble or encrypt a message that uses an asymmetric
algorithm, not only do you need the plaintext message,
you also need both a public and private key (think
asymmetric keys) to encrypt and decrypt a message.

23. 23
So, before we continue with more detail in the
explanation of how this works, let’s recap a few things.
First, we have the clear text (plaintext) message that is
encrypted. In asymmetric encryption, the two sides (the
sender and receiver) have unique keys. One of the keys
is a public key (that you can post of Facebook, or
wherever) and the other key, a private key, you’ll want
to keep secret.
Now, let’s add a bit more detail so that we can get down,
as my grandpa used to say, “… to brass tacks.” Let’s add
some more detail about how asymmetric key
encryption (Public Key Encryption) is applied in the real
world.
First, the public key and the private key are
mathematically linked. Sometimes this is referred to as
a key-pair. Generally, the public key portion is used to
encrypt the message (plaintext) between sender and
receiver. Each sender and receiver will also have a
private key that they’ll keep secret and will use do
decipher/decrypt a message. That is, both sender and
receiver will use the public key along with their unique

24. 24
individual private keys to encrypt and decrypt
messages.
Before we get into more details about this, let’s think of
an analogy. If I go into Home Depot for paint, let’s say
that I pick a yellow color as my base paint (you wouldn’t
normally do that, but for this example, let’s say our base
color is yellow). So the yellow paint is the plaintext
message that we want to send. Now, I know that my
receiver has a public key (think of blue) and if I mix it
into the yellow, the paint will turn green. But, if
someone were to intercept the ‘green’ message, if they
knew the publically available key of blue that my
receiver posted on Facebook, they could derive the
‘yellow’ message.
So what if I not only mixed in the public key (blue paint)
along with my private key (let’s say red paint) which
resulted in a purple-ish color paint? Anyone
intercepting the purple-ish paint (that is, if paint colors
could be pulled apart), would need to know both the
public (available) and private (not available)
keys/colors to determine the right mix to get back to
the initial plaintext color (yellow, in our case).

25. 25
On the receiver side, the receiver has the shared key
(public key) and their own unique private key. Again,
the sender and receiver’s private keys are unique and
are not ever shared anywhere. However, they are
mathematically related. So when the receiver of the
message receives the encrypted message, they can
apply the public key along with their uniquely and
mathematically related private key to the message
which will result in the plaintext (yellow) message.
This mathematical relationship, just so you roughly
know, is based on what is termed as “modulus
arithmetic.” I mention this since it may be noted in
other information and computer security texts and for
those who wish to delve into the mathematics of
asymmetric encryption. However, for the CISSP, CISM
and CCNA-Security exams and for general knowledge
about information security, you don’t need to know the
mathematical details of how “modulus arithmetic”
allows us to mix two encryption keys (public and
unique private key) on one end and to decrypt using the
public and an altogether different (but related) private
key on the other end.

26. 26
ENCRYPTION STRENGTH
One of the primary issues around the strength of
encryption centers around the key length (remember
private and public keys from the prior section?). The
strength of the encryption (and ease of decryption), in a
significant part, rests on the key length. Let’s say if I had
a combination lock on my bicycle. And let’s say that if I
park my bike and tie it up to a pole right out of
Starbucks where I sometimes get a morning cup of
coffee. If my combination lock only had 2 cylinders that
each tumbled from 0 through 9, it would take someone
seconds to figure out the combination. My ‘key space’ is
defined by the number of tumblers (2) and the number
of numbers on each tumbler (10: 0 through 9). From
this small key space, I can mathematically calculate that
I’d have 10 (total possible numbers on the first tumbler)
times 10 (total possible numbers on the second
tumbler) for a maximum possible combination numbers
of 100. That would take someone a minute or two to
break in to. And off goes my bike.
Now if I had 5 tumblers, the number of possible
combinations, each of 10 possible numbers, the total

27. 27
number of combinations goes up to a point where it
would take someone hours and hours, making stealing
my bike improbable (assuming they don’t have, of
course, a bolt cutter).
If this was digital, we know that computers can churn
numbers extremely quickly. That’s what they’re
designed for. So, the larger the key space that we
provide to encrypt (lock up) our data, the longer time it
will take a computer to try all combinations.
Whether it’s a bike thief attempting to steal your bike or
a computer attempting to crack into an encrypted file,
the longer the key length, the more impractical it is for
the bike thief or the hacker to steal your stuff.
Keep in mind that encryption is useful for one purpose -
- keeping information hidden from those who you don't
want to see it. The type of information can be
confidential information that a governmental agency, a
financial institution or a private individual wants to
keep secret. Data in the form of transaction information
(from Amazon purchases) to emails and even entire
files can be encrypted and kept private. Encryption

28. 28
ensures privacy and will prevent misuse, abuse or
tampering (modification) of data.
In addition to the key length, the strength of an
encryption system is dependent upon other factors
including the algorithm used and how that algorithm is
implemented. Further, several information and
computer security experts have noted that there are no
shortcuts that should be implemented into encryption
algorithms to derive the plaintext from cipher text.
As of late, there has been quite a lot of discussion about
the possibility that the NSA has influenced the design of
various encryption algorithms. There is a suggestion in
the information and computer security communities
that NSA has not only allowed but required certain
encryption schemes to have a “back door” whereby
security (encryption) is short circuited and decryption
can be readily accomplished by various security
agencies. I’m not sure if this is pure conjecture or is
based on reality. Investigate this on your own, if you are
willing to do so. However, the point is that from a
designer’s perspective, pure encryption and decryption
should never have any shortcuts (nor backdoors).

29. 29
Also, in terms of being able to decrypt encrypted
messages (or files), the designed algorithm should not
be vulnerable to brute force attacks where a hacker
essentially will throw all possible numbers at an
encrypted file in order to break in. In the earlier
scenario of the bike lock, if the bike lock was our
encrypted file with a possible 100 combinations, a brute
force attack would be to try each and every possible
combination from 0-0 to 9-9 in order to gain access (to
the bike or to the data).
Also, as you dig into data security a bit deeper (where
studying for the CISSP, CISM or CCNA-Security, or if you
plan on deeper study into the InfoSec field) there is
quite a bit of discussion about “Minimal Key Lengths
For Symmetric Ciphers.” We won’t go into that in this
book, but suffice it to say that the designers of many
encryption algorithms have noted weaknesses with
their algorithms based on smaller key sizes. And, as
we’ve discussed in this section, smaller key sizes leaves
you (and your data or your bike) susceptible to theft or
tampering.

30. 30
SYMMETRIC KEY ENCRYPTION METHODS
In this section of the chapter, let’s briefly discuss a few
symmetric key encryption methods that you’ll see
frequently as you move deeper into this field.
ONE-TIME PAD
The one-time pad symmetric key encryption can be
viewed as a disposable key, thus the “one-time” name.
A one-time pad encryption method uses a generated
key that matches the length of the information to be
encrypted. Each character of the message is shifted by
the value of the matching value in the key. This method
(assuming the key can be successfully randomly
generated) has been proven to be theoretically
unbreakable, but there are a few important difficulties
associated with the use of a one-time pad.
The first difficulty with a one-time pad is in generating
the key itself. Since there is no fixed key length because
the length varies dependent on the length of the data
being encrypted, there is a problem with the true
randomness of the key. To secure encryption, security
relies on not only the length of the key, as noted earlier,
but on the uniqueness of the key. For example, if we had

31. 31
long keys for our encryption and decryption, but these
keys were not unique, we’d open ourselves up to data
theft or other nefarious acts.
This reminds me of a story where one of the automobile
companies in the 1980s had a key set whereby the
possible number of key possibilities for their physical
keys were around 30,000. Considering that they had
produced nearly a million automobiles with this
particular key set, the probability of having a similar
key was about 0.3%, which statistically is high. Could
you imagine having this sort of percentage that you’ve
used for an encryption method that you’ve secured
sensitive data with? Given the speed of today’s
computers, you’ve opened yourself up to risk.
And, as a result of uniqueness, keep in mind that the
longer the data set being encrypted, it is more likely
that a pattern will emerge within the random number
series. In other words, duplication can occur in a one-
time pad allowing for what is known as “cryptanalytic
attacks.”

32. 32
The second major difficulty with one-time pad
encryption (and one that is shared with other methods
of symmetric encryption) is in the way that keys are
distributed. The essential question is that once a key is
calculated and used to encrypt a file, how do we get the
key to another user so that they can decrypt the data?
This problem is compounded if we have encrypted a
file, sent it across state or the country, and need to get
the key to the receiving end so that the receiving end
can decrypt the encrypted message. You do not want to
send the key in the same way that the encrypted
message was sent. If someone captures the encrypted
file on a given network and you also send the key on the
same network, they will more than likely capture the
key as well, risking your data. Often, we send the key in
another way. If we are sending an encrypted file over a
particular network, as an example, we will often design
and use another method (or network) to send the key.
This is often termed and “out-of-band” method.
Finally, a one-time pad encryption key will be at least as
large as the data it is intended for used with. That’s
what I consider an “interesting” fact about the one-time

33. 33
pad! Even if you are using a one-time pad, for example,
to encrypt files locally, storing the keys will at least
double the storage requirements for each and every file
or document you wish to encrypt.
However, there are ways to get around this by using
something that is called a pseudo-random system. We’ll
discuss pseudo-random and random numbers in the
next section. But suffice it to say for this section that
random numbers generally involve the entire possible
set of all numbers (the whole enchilada of numbers
possible – which is, well a heck of a lot of numbers) to
derive the randomization. Pseudo random numbers, in
contrast, takes a very large set of possible numbers (a
very large set of numbers in contrast to ALL possible
numbers) from which the randomization is done.
RANDOM VS. PSEUDO-RANDOM NUMBERS
The one best thing about computers is that they can
work with numbers – and they do it quickly. When we
use random or pseudo-random numbers to define a
key-space for an encryption algorithm, essentially what
we’re saying is that we’re going to use the number
space (random or pseudo-random number space) to

34. 34
define a key. A purely (true) random number is pulled
from all possible numbers. Imagine that! But a
computer will certainly reach its computational limits.
However, to provide boundaries around this unlimited
true random number set, we’ll often used what is
termed as a pseudo-random number. The definition of
pseudo is essentially “not real” or “fake.” What we’re
essentially saying when we create a pseudo-random
number space is that given the size of the number space,
we have something that approximates pure
randomness. Let me put it in another way. If you think
about dice – maybe 1 di, to keep our discussion to the
point – you have six possibilities in this pseudo-random
number space. That’s a pretty small set of randomness
and probably won’t be a good representation of how
true randomness is handled. However, we know that
there’s a 1:6 possibility of rolling a particular number
on di. Taking this to another item that we know well – a
deck of cards. Typically (if a card is not missing) we
have 52 cards. So our pseudo-random number space is
larger. We have a 1:52 possibility of selecting a given
card. Bigger, but not too solid in terms of using this
pseudo-random number space. A small pseudo-random

35. 35
number space is easily hack-able by today’s hacker
tools. However, if we make our pseudo-random number
space 100 million numbers or larger, we’re getting
closer to approximating what pure randomness is and
also narrowing the possibility of some hacker
determining what our encryption keys are for a
particular file or service that we have encrypted. So,
computer scientists will develop algorithms that will
take in a seed value into a process that will create a
fairly large pseudo-random number space that a
computer can readily handle and that will more closely
approximate a true random number space.
STREAM
Whenever I think of a stream cipher, I think of a stream
of water flowing in the mountains where I hike in the
summer time. The analogy of a mountain stream with a
stream of continuous flowing data holds. A stream
cipher operates similar to how a one-time pad
functions. A stream, however, uses a smaller key, called
a seed, rather than a unique key built off of the entire
file. The seed is used to generate pseudo-random

36. 36
numbers with which to perform the one-time pad. So
the seed provides a boundary, if you will, to the set of
numbers used to derive the encryption key. Each
element of the plain text in the stream of data is
combined with a pseudo-randomly generated element
to produce the cipher text related to the plaintext
element.
This form of encryption is quite fast and relatively easy
to implement. It is often implement on networks, for
example. However, there is a risk. If the same seed is
used a second time, steam encryption becomes
vulnerable to a cryptanalytic attack due to the fact that
the same seed will create the same size pseudo-random
space from which the encryption key is derived.
Additionally, by using a pseudo-random set of numbers,
as noted earlier, there is a possibility (though somewhat
remote, depending on the pseudo-random space) that
the encrypted bit stream is not truly random, creating a
somewhat inherent weakness in stream encryption
techniques. One example of the weakness that shows up
is the wireless WEP (Wired Equivalent Privacy) is a
standard, though not used frequently anymore, within

37. 37
the IEEE 802.11 wireless standard. The 802.11 standard
is what we will use when we connect to a wireless
network, for example, at our favorite local coffee shop.
The WEP standard was an early “privacy” (encryption)
standard that was easily hack-able and if you’re using it
now, be sure to change it to WPA2 (a more robust
protocol). The problem with WEP is (was) that it used
the Stream cipher, as we discussed earlier. The issue
was that the pseudo-random number space was 24 bits,
which as we discussed, is not a large enough pseudo-
random number space and given the processing power
and speeds of computers in today’s world, WEP can be
readily cracked in a few seconds by tools that are
commonly found on the Internet.
BLOCK
A block cipher takes in a chunk (block) of plaintext data
and encrypts that block using a key. Algorithms such as
DES (Data Encryption Standard), 3DES (Triple Data
Encryption Standard), and AES (Advance Encryption
Standard), to name a few, fall. Each of these algorithms
takes in a block of the plain text, and encrypts that block

38. 38
using a key. The next block of data can then be
encrypted, either with the same key, or a modification
of that key. The processing is determined by which of
these three (and their variants) you decide to use when
encrypting files, network traffic, etc.
The block method is generally considered to be the
most convenient secure method. While very secure, it is
not as secure as a one-time pad. But it is far easier to
implement. With block cipher encryption algorithms, as
mentioned before, the main issue is how do we get the
keys distributed in the system without someone
capturing the keys as well as the data? While this was
briefly noted before, let’s speak to this. Essentially,
whenever you are sharing keys for encrypted files, it is
optimal to share these keys in an ‘out of band’ way. That
is, if you are sending your encrypted data on a given
network, you’ll want to send the keys on a totally
different network, thus preventing a hacker from
capturing both your encrypted data and your keys from
the same location, if you will.

39. 39

40. 40
CHAPTER 2. INTRODUCTION TO
SYMMETRIC KEY ALGORITHMS
As we noted in the prior chapter, there are several
encryption algorithms that have been or are currently
in use for symmetric encryption. The earliest
recommended encryption algorithm was the Data
Encryption Standard (DES) which is a block encryption
algorithm designed to use 40 or 56 bit key length plus
an additional 8 bits for error checking. The DES
encryption standard was originally adopted as a FIPS
(Federal Information Processing Standards) standard in
1977 and is in use for some limited applications even
today. The key length received criticism as being too
short, as it is susceptible to hacking. There are also
continued questions about NSA’s involvement in its
development, since there are reported back-door
methods to readily hack into DES encrypted files.
DES remained the suggested encryption method
through the 1990’s and even as late as 2003 (and can be
found in some limited use today). FIPS, in 1999, stated

41. 41
that 3DES (Triple DES) is preferred as an encryption
standard. But, prior to the updated FIPS
recommendation, DES had already been successfully
hacked using brute force methods in a series of
competitions designed to demonstrate the
ineffectiveness of DES as a secure encryption algorithm.
As a note about FIPS, since you’ll continue to see FIPS
mentioned in this and any other book on information
security: FIPS is a set of standards, including encryption
standards, that non-military and governmental agencies
and contractors must adhere to. So, if you are doing
business with the government (as a contractor or have
been awarded a grant), you and your organization will
need to adhere to the FIPS standard – thus the often
mentioned FIPS in information security texts and
documentation.
I mentioned 3DES earlier. Let’s take some time to
describe what 3DES is. 3DES is oftentimes called Triple
DES. When it was noted that DES was hack-able, a quick
and interim solution to improve the strength of the DES
encryption before a newer encryption algorithm was
developed was to essentially run DES 3 times (thus the

42. 42
3DES notation). This is basically a tripling of the DES
algorithm; the result of the first DES encryption is fed
into the algorithm an additional 2 times, which
effectively creates a 168 bit encryption mechanism. This
provided a much larger and more secure key. However
the 3DES method has its own difficulties. Because of the
tripling of processing required and the growing keys
with each iteration, 3DES involves a much higher
computational complexity, and uses far greater
resources to accomplish the encryption task. Again, I’m
using 3DES in present tense since it is used on a limited
basis. However, after an interim period, a more robust
replacement was introduced and is, in a large part, in
use today.
The Advanced Encryption Standard (AES) was the
result of a search for an updated encryption standard to
replace both the hack-able DES and the clumsy 3DES.
The competition was completed in 2001 and was later
noted as the de-facto standard for FIPS (also noted in
2001). The algorithm is somewhat similar to the DES
standard in that it is also a block cipher. However, it
uses a larger block size as well as larger keys resulting

43. 43
in keys that are more resilient to hacking. AES can be
used with any of a 128, 192, or 256 bit key length. It is
projected by information security researchers that
these much longer key lengths will allow for a relatively
long term encryption security lifetime for AES. That is,
unless there are some unforeseen leaps and bounds in
computing technology, as we have experience before, or
if cryptanalytic weaknesses are discovered with the AES
standard. At present, AES seems to be holding its own
and is, by and large, the current standard.
KEY SHARING
Recall that keys will unlock encrypted files. So we’ll
need to distribute the keys in symmetric encryption.
Also recall that symmetric encryption uses the same key
on both sides used by the sender and recipient of the
encrypted data. With both sides needing the same key,
there is an implied trust that the key was not shared
either intentionally or unintentionally to a third party
by either the sender or receiver. Because of the key
sharing trust issue, it is noted by information security
experts that the key sharing is the most difficult item to
handle.

44. 44
A direct physical transferring of the key is the most
secure method for sharing keys. There is no third party
involved in transferring the key. As an example, if we
were commonly transferring data between 2 servers in
our network and were using a symmetric encryption
algorithm, the network administrator could physically
place the key on his/her flash drive and ensure that it is
installed on both servers for encryption and decryption.
This probably will work fine in some smaller
environments, but it is not a practical solution for larger
environments where servers are located miles or even
thousands of miles away from each other. Also, what
happens if the key value changes?
Another solution that is predominantly used is to have a
trusted third-party distribute keys. In information
security, there are a few variants of how a trusted third-
party is implemented. We’ll discuss a few.
One such trusted system for distributing symmetric
keys over a network is to simply use an asymmetric
public key encryption to distribute the symmetric key. A
second solution for distribution of symmetric keys is to
use another variant for key distribution known as the

45. 45
Diffie-Hellman key exchange. In summary, Diffie-
Hellman is a way of exchanging cryptographic keys and,
while it was developed in 1976, this method for key
exchange is still readily used. For example, if you’re
studying for the CCNA-Security exam or the CISSP, this
is a vital part of the VPN setup that you’ll need to
understand and know. While this is an introductory
book on information security, I’ll continue to note a few
items that you will run into later in your studies.
The third solution for key distribution will be examined
a bit more in the next section is the Kerberos system
that was designed by the Massachusetts Institute of
Technology (MIT) in the 1980’s and 1990’s which is still
in use in many production level products (like Microsoft
Server products, for example). We’ll look at Kerberos
next.
KERBEROS
Kerberos is a name derived from Greek mythology.
Kerberos is the three-headed dog that guards the entry
to Hades. I suppose that the MIT researchers had a bit of
a sense of humor. But, we’ll see how the three aspects of

46. 46
Kerberos serve to protect the key exchange in the up-
coming paragraphs.
First and foremost, Kerberos is a system designed to
enable the use symmetric key encryption over a
network without relying on public key encryption for
the delivery of those keys to remote users. Instead,
Kerberos uses what is termed as tickets to allow servers
and notes to communicate over a largely more non-
secure network.
Before we get started with the details, let me give you a
general analogy of how Kerberos works. We’ll describe
the details in a second.
When we go to the movie theatre, we purchase a ticket.
When we purchase a ticket, we are authorized for, let’s
say, a student, adult, or senior citizen ticket (some
verification by student id or your driver’s license may
occur). Suffice it to say that you are then authorized, by
the means of getting a ticket, into the theatre. Once you
enter into the theatre, you’ll (typically) hand your ticket
to someone who verifies that you purchased a ticket
and that the ticket is for a current show (why would it

47. 47
be any different?). However, keep in mind that you have
another party checking the ticket that you just
purchased form the front window. Nevertheless, the
movie ticket verifier will point you in the direction of
the theater that is showing the movie that you wanted
to see (as noted on your ticket).
Now, back to Kerberos. Kerberos servers act as a
trusted third party key generator and distributor that is
used with symmetric key encryption.
First, before we get back to relating our movie ticket
buying with the Kerberos process, to use the Kerberos
system on our secure servers, we’ll need to set up a
facility on each of the servers that we want to use
Kerberos with. This is termed as Kerberizing your
servers (I didn’t make this up).
The general process for using Kerberos is:
1. The user logs into a “client” machine using a
name and password. So far -- not different from
anything we’ve seen before…
2. The “client” then takes the password and creates
a symmetric cipher. There are a couple of ways

48. 48
to do this, but for our discussion, let’s keep this
fairly general in terms of the Kerberos process.
3. Next, the “client” sends a clear text message that
contains the user id to what is called the
Authentication Server (AS). Of course, the AS
authenticates that the user id is valid for the
Kerberized system.
4. If the AS determines that the client is valid on its
AS database, the client will return 2 messages
back to the requesting client (remember, the
client is requesting access to the system – much
like when we buy a movie ticket, we are
requesting access to see a particular movie).
What is returned, again, are 2 messages
containing:
a. A first message: Client appended to a
“Ticket Granting Service (TGS)” Session
Key that is encrypted using the secret key
of the client/user.
b. A second message: A Ticket-Granting-
Ticket (TGT) that includes information to
reference back to the TGS (like the client
id, network address, and the TGS session

49. 49
key) as well as how long (the validity
period) that the TGS can use.
If we think back to the analogy of buying the movie
ticket, if our movie ticket was purchased to see a movie
(let’s say we’re in a movie theater that is showing the
oldies and we purchased a ticket for “Gone with the
Wind”), the ticket grants us (TGS) to the service of
seeing the movie. If it’s a high tech ticket, perhaps the
ticket also allows using the ticket for duration of time
(rather than one movie). Perhaps the ticket also has on
it our name as well as the duration that we can use this
ticket to see “Gone with the Wind” – perhaps over a full
day instead of a particular instance.
Now once the client has the ticket (TGS and TGT), the
client can now request services. If the client’s ticket
contains information so that the client can access the
production payroll database, the client can request
services from the payroll database, in general terms. So
the client will attempt to authorize with the Kerborized
payroll server. It’s like the movie theatre analogy –
when we walk into the theater, someone inside
authorizes us to a given movie. So, the client service

50. 50
authorization is similar and when access is wanted, the
access is verified by the combination of the TGS and the
TGT. This, in effect, is the server asking: “Do you have
authorization to use this payroll service?”, “How long is
your access?”, “Who are you?” etc.
This is the general process. There are some more
specifics about this that you’ll further study in your
CISSP, CISM or CCNA-Security books. However, keep in
mind that there is a carefully planned exchanged of keys
as well as authorization that goes on with Kerberos.
Also, note that the Kerberos protocol (or process, if you
will) itself does not specify an encryption algorithm that
must be used. Instead, different Kerberos
implementations will support differing encryption
technologies including DES, 3DES, AES, and other
symmetric key algorithms.
As a recap, remember that Kerberos was designed to
assist with privacy and secure use for services in an
organization. Further, Kerberos is designed to be
implemented on multiple servers (keep in mind the
Kerberized server). Also, a central server in the

51. 51
Kerberized system acts as an authentication agent (the
Authentication Server), while services that a client is
interested in accessing are hosted on the varying server
instances (think about the access to the payroll server
that we discussed before). The way that Kerberos is
designed with multiple layers adds security to the
Kerberized system. However, while the security is fairly
robust on a Kerberized system, since it involves the AS
and other hosted servers; this does increase the
complexity for implementation.
CONCLUSION
As we’ve seen so far, organizations wanting to protect
their data have several choices among symmetric
encryption algorithms that will help to keep their data
safe. But while the many symmetric encryption
algorithms available today are assumed to be fairly
robust and secure, the primary factor that presents a
stronger encryption key is basically the key length.
In summary, the key length required to keep data
secured will be dependent at least partially on how long
a user wants that data to be secure. The general rule of
thumb with key lengths is that the longer the time

52. 52
frame is required for secure data, the longer the key
length should be. Though, it may seem best to choose
the longest key length for a file or transmission, the
weighing factor is that longer keys take a longer time to
decrypt and encrypt. This can certainly have
performance implications, especially on a network.
Keep in mind that smaller keys have a lower
computational cost but an inversely higher risk. So
there is a balance that must be obtained, especially in
network applications, between key size (security) and
performance (time to process an
encryption/decryption).

53. 53
CHAPTER 3. MALWARE
The world of malware is teeming with various breeds of
software, each with their own behavioral presentations.
It is imperative that users develop an understanding of
the major categories of malware, and their signature
behaviors, in order to devise appropriate strategies of
prevention and defense. The following pages endeavor
to present the reader with a general survey of malware,
describing their presentations as well as standing
current techniques of handling instances of the
malware. These categories of malware are used to
describe how the software behaves within a system, or
how it propagates amongst users.
Information technology has become an
increasingly used tool with developed applications in
nearly every field of society. As the world of information
systems has developed to its current level of
sophistication, so have the methods of malicious
attackers and users who compromise security. Let’s
look at several categories of malware that are used to

54. 54
propagate malware. These include techniques of viral
propagation including networking worms and Trojan
Horses. Also, techniques for distribution of malware
include the use of rootkits, bots, and spyware.
ROOTKITS
Generally, there are two primary forms of rootkits that
use different methodologies to compromise a computer
system. These are the binary-level rootkits and kernel-
level rootkits.
Binary level rootkits operate in ways that modify data
upon finer levels of system processing. Essentially,
binary-level rootkits tamper with user-level processes.
In contrast, Kernel level rootkits work with a more
atomic level of the system. Kernel-level rootkits work
within the kernel of the operating system and tamper
with system-level processes and system-level calls.
Both rootkit types are type of Trojan file that ‘live’ upon
the essential levels of a system that are installed in
order to grant a malicious user access control, or
otherwise tamper with a system in some time in the

55. 55
future. A rootkit is a feasible means of malicious
processing that a user can invoke after he has gained
access to a system, since they have reached the kernel
level of the system. Once the rootkit is in place on the
victim’s system, it acts as a backdoor that allows a
hacker to gain entry to the system or its root at a later
time.
Both general forms of rootkits pose their own serious
threats to a system. Unfortunately, there are only a few
methods in handling or detecting kernel-level rootkits.
Potential methods for binary-level rootkit detection
include signature analysis, and cryptographic
checksums. These methodologies are typically
employed by “automated solutions”, such as software
packages built to detect and manage rootkits. Mostly,
these automated solutions employ the typical reactive
methodologies wherein the software observes the
system and identifies already known patterns of typical
rootkit behavior within a system.
While kernel-level rootkits are among the newest of this
type of malware, it is more than just a lack of experience
and exposure that leaves the computer world

56. 56
vulnerable to these kinds of attacks. The very nature of
a kernel-level rootkit allows it access to a system’s
memory management, its file system, and system calls;
allowing a malicious user unmitigated access and
control over the modification and employment of the
system kernel functions. There are levels in which these
rootkits actions regularly lose their invisibility, such as
the system call table. In order to detect and handle
kernel-level rootkits, an automated system can be
arranged such that it can save the state of the system
call table at regular intervals, and store these states as a
reference that can be used to recover the system later.
Upon recognizing irregular system pattern calls, the
system and user can consequently be made aware of the
tampering of a kernel-level rootkit, and handle the
issue.
TROJANS
The intrusion architecture that makes up Trojan
infections generally comes in several forms. The main
forms are:

57. 57
1. Direct masquerade: A direct masquerade
Trojan is one in which the Trojan masks the file
as an existing system process in the machine. For
example, the Trojan can run as process with a
name such as Explorer, imitating the file
management system of Windows. Trojan files
that employ the simple masquerades take to
resembling a process that is perceivably more
legitimate than itself, such as the names of
existing executables.
2. Slip masquerade: Trojan files which employ slip
masquerade techniques form system processes
on a machine that could resemble a legitimate
process; for instance, it may take the name of a
critical system process and modify it by a mere
character, such as taking ‘Explorer’, and
rewriting its own process name as ‘iExplorer.’
3. Environmental masquerade: The
environmental masquerade technique hides
malicious functionality within an existing
process and relies upon a form of execution from
that process in order to begin its operations;
these can hide in functions as simple as login

58. 58
operations. While these fields of categorization
for Trojan intrusion are general, it is necessary
to note that the very nature of Trojan horses is
that their methods of concealment are vastly
diverse, their presentations are constantly
evolving to hide within a system in new ways; as
such, some presentations of Trojan malware are
likely to cross the borders of these categories.
Ultimately, a Trojan attack does not describe the
architecture of the injected malware, or even
necessarily the behavior that ensues upon infection;
Trojan horses are simply used to describe the forms
of malware that employ techniques of insertion and
concealment under the previously described
categories. Trojan infections can be viewed as a
conglomerate of two definite components. These
are:
1. Trojan component: in instances of a Trojan
attack, the malware enters the system attached
to an inconspicuous piece of seemingly
legitimate software. This component, best
known as the payload, is the batch of malicious

59. 59
functionality that uses the package it is attached
to invisibly make entry into a computer.
2. Dormancy component: after a Trojan malware
package infects a host machine, the dormancy
component is responsible for maintaining the
malware’s position in the host machine.
It is important to note that Trojan Horses do not deliver
a specific set of actions, but are rather defining of the
method wherein malware infects a system. The issue
that a Trojan Horse poses is not necessarily how the
mechanism itself affects a user’s system, but how it
exploits vulnerabilities of systems to deliver malicious
functionality. With that in mind, defense against an
intrusion via Trojan Horse is difficult to arrange in a
proactive manner. Commonly, the best defenses a
potential victim may have are a set of best practices to
follow as to avoid allowing any potential infections into
their machine. Likewise, Internet security packages may
offer reactive protection to Trojan Horse attacks, by
forming libraries of common sites or files where Trojan-
delivered malware has been known to be distributed
from or as.

60. 60
VIRAL MALWARE
This category of malware is often the most misused in
order to label instances of malware. It is often times
used to identify an existing instance of malware that
does not fit the constraints of its definition. Amongst the
earlier forms of malware, viral malware infections can
be the most troublesome to purge from a system, as
they are defined by their ability to reproduce
themselves rapidly within a local machine. As viral
malware has had much time to evolve, these infectious
pieces of software see various levels of sophistication
and employ a great many methodologies in their
propagation. Often times, modern viruses do not simply
multiply upon a system, but evolve themselves
periodically with further generations as a method of
defense against detection or eradication; meaning that
most viruses increase their affects upon a system at
something of an exponential rate. Like many of its
malware cousins, viral infections have a great many
architectures that determine its function, method of
evolution, propagation, and its many other traits.
However, viruses generally share a handful of common

61. 61
techniques in order to remain hidden or obscure to
detection by the system or user. Four methods that a
virus may employ to prevent its detection are as
follows:
1. Encryption: Generally the simplest approach
that viral malware takes to hiding itself within a
system, viruses may deploy itself as an
encrypted piece of software with its own paired
system for decryption. However simple,
encryption enables a virus to constantly mutate
its presentation upon a system. The simplicity to
this scheme is both this format’s strength as well
as its weakness; as well as this schema
consistently provides the literal data of a virus
with unique identities, the decryption
mechanism is also capable of working towards
the system in decrypting an uncovering all
generations of the virus.
2. Polymorphism: Much like the basic encryption
method described above, polymorphic
presentations of viral infections use an
encryption pattern to be decrypted by a

62. 62
provided decryption mechanism. However, this
technique essentially addresses the weakness of
simple encryption based computer viruses in
that each generation of a computer virus
develops its own decryption algorithm. Thus,
adding a level of complexity when addressing the
issue, as the host now has several batches in
each generation to address; rather than the
singular batch that could be addressed uniformly
under the same decryption key.
3. Metamorphism: In response to defense
techniques identifying the virus body to handle
the malware, malicious users devised computer
viruses that would modify their own body
alongside encryption schemes. This enabled the
software to change its methodology in delivering
its payload, and ultimately evade detection
techniques that relied upon identifying specific
behaviors. Several methods that would ensure
that a computer virus’ operation integrity would
remain intact whilst undergoing metamorphosis
are as such:

63. 63
• Register usage exchange: in this technique,
the execution code simply exchanges the
registers used each generation, accessing
different locations in memory to operate than
the previous generation.
• Permutation: while viruses change
generations, subroutines are reordered, such
that functionality that is not order-critical is
executed in different patterns than that of
other generations.
• Useless Instructions: Meaningless
instructions are stuffed between virus-
critical functionality in order to confuse the
user or system, giving each generation the
illusion of wholly different execution.
• Substitution: With this more complex
technique, new generations of a virus
generate or change sets of instructions for
equivalent sets of instructions. This provides
similar anonymity as the insertion of useless
instructions, but restructures more critical

64. 64
portions of code to offer a more robust safety
from detection.
4. Viral Construction Kits: As a great many
viruses are written in assembly language, the
development of viruses (in this paradigm) was
typically laden with complications. However,
techniques and tools were developed to enable
swifter development of unique infectious
software. Viral construction kits were devised to
bypass the time cost and complexity of
engineering new malware to deploy, further
taxing the defensive technique of cleaning up
previously identified malware.
As the techniques of robust viral infections have grown
on computer systems, however, so too have defensive
techniques to counter the rapidly multiplying malware.
The four common techniques to defend against the viral
variety of malware include (1) pattern recognition, (2)
‘exact and exact’ identification methods, (3) malicious
code emulation, and (4) adaptive tools to identify future
threats.

65. 65
Producing unique viruses becomes more difficult as
resources such as viral construction kits are exhausted,
methods that employ pattern recognition from known
viral signatures become more reliable, and a stronger
first line of defense. These pattern-based scanners
operate by interpreting bytes that are members of
known viral signatures, allowing a system to identify
previously handled infections. As time passes, the
databases or libraries that are responsible for
maintaining known virus signatures expand, leaving
less room for the possibility for unique infections to
enter the host machine.
The second line of defense uses similar scanning
techniques as basic pattern recognition antivirus
software, with added benefits of several more tools to
account for any mutations that the virus may have
undergone. This method, known as ‘nearly exact
identifications’ employs the user of double strings,
cryptographic checksums, and hash functions in order
to swiftly and accurately sift through and identify
mutated viral bodies.

66. 66
Antiviral programs may also employ the use of CPU
emulators that viral infections are essentially distracted
to, allowing the malware to make attacks upon a faux
processing system. This technique does not just distract
malware, but also enables the antivirus software to
identify the unencrypted forms of the virus as the
malware must decrypt itself in the process of execution.
This grants the system a window to recognize the
malware and handle the instance without making its
CPU vulnerable to the attack. This technique can be
cumbersome, however, and loses its practicality if it is
run too long.
Last, heuristic analysis of viral instances uses fragments
of known viral code and performs analyses upon
potential threats. While these tools are intelligent and
can often identify previously unknown viruses, it is also
known to often recognize a normal system process as a
viral infection.
Viral infections consequently share very similar traits
with another form of self-replicating malware: Worms.
Their presentation and handling shares many traits of
viral infections. However, it is important to note their

67. 67
objective in spreading. The distinction between worms
and viruses is in the systems in which they replicate and
propagate. While viral infections focus upon a single
system, Worms operate with the explicit intent to
spreading to other machines upon the network,
focusing upon specific weaknesses of a system and its
network to spread.
BOTS
While bots are software systems that can be
constructed to serve benign purposes upon a system,
this type of software has also been utilized to be the
core architecture of many forms of malware.
Distinguishing itself by its behavior, bots are instances
of software that are placed upon a machine to perform
automated tasks in the stead of its malicious user.
Normally, modern bots infect collections of computers
that become a part of a network of computers with a
similar instance of the bot; this web of infected
computers becoming part of the botnet. Normally, bots
that take over systems give the distributor of the

68. 68
malware control over the machine; however, in great
numbers, bots are not typically used to control a
singular machine. Instead, they are used to send out
general, mass instruction to each infected node; these
members of the infected network otherwise known as
zombies. Botnets can span anywhere between tens of
computers, to hundreds of thousands of computers in
their network of control.
Normally, bots exploit computers with network
vulnerabilities, though may have access to machines
through an innumerable mass of methods. Once upon a
machine or collection of machines, bots have been
known to have a large number of consequences. Bots
have been commonly known to distribute spam, viruses,
spyware, and a multitude of other malicious software to
a botnet’s zombies. In addition, botmasters have utilized
the control over an infected machine to retrieve
personal information such as credit card numbers, bank
credentials, and similar personal information; and even
perform Denial of Service attacks, compromising the
security of servers, and machines that ultimately

69. 69
renders the system unusable or unreachable for their
intended users.
The circumvention of bots on system relies upon the
same techniques that handle viral infections on
machines, with added prevention methods that a user
can employ as a part of their operating system’s tools.
Aside from antiviral software, internet options allow for
levels of operating-system-dictated security standards,
which ensure users keep their traffic within safe
bounds.
SPYWARE
Within this class, there are a number of formats of
malware that are responsible for directly or indirectly
enabling a malicious user to monitor and direct the
activity of a system that has been compromised by
Spyware. The general forms that Spyware may take
are:
1. Cookies/Web Bugs: Cookies offer small spaces
to save state information to individual clients,
enabling websites to store user-specific

70. 70
information about traffic, usage and preferences
specific to their site. However, as many sites can
often cross systems (such as using common ad
providers), a potential side effect of this
relationship enables third parties to access the
information stored in the cookies of associated
sites. This presentation of Spyware is not
directly a consequence of malicious coding, but
an exploitable side effect of web architectures.
2. Browser hijackers: Spyware can take the
presentation of hijacking Internet traffic to the
infected system. The results will vary depending
upon what the malicious user intends to achieve;
potential outcomes may include: forcing a user
to a specific homepage, or even locking certain
Internet traffic at ransom (also known as
Ransomware). Normally, the hijacking
mechanism takes the form of an extension to the
browser, but can infect a system through deeper
means such as modifying system registries.
3. Keyloggers: Not always present as malicious
software, Keyloggers are programs capable of
observing near every activity upon a machine.

71. 71
Capable of monitoring and logging individual
keystrokes, to noting all network activity in and
out of a machine, keyloggers are capable of
reporting anything a user (malicious or
otherwise) would like to monitor.
4. Tracks: Used as a label for information stores
that represent a multitude of user activity, tracks
are not particularly malicious upon their own.
The stores that contain tracks, such as browsing
history, can be exploited by Spyware; providing
malicious users with a centralized location to
data mine personal information from a user.
5. Adware: An ambiguous form of Spyware,
Adware posts advertisements in an infected
user’s browser, changing in the content
conveyed depending upon the traffic upon a
machine. As a consequence, Adware gathers
together menial pieces of information to return
to the malicious user.
CONCLUSION
The pages above have presented the broad forms of
malware that exist in the world of information

72. 72
technology. Each given field defines a set of strategies
and behaviors presented by malicious software. The
research has shown that, while these forms and
techniques of malware propagation and execution can
be applied in parallel, they have essential weaknesses of
predictable, definable makeup. With each category of
malware clearly defined, and rudimentary defensive
techniques posed for each form, a user has the essential
information to prevent, handle, or devise solutions in
any potential instance of infection.

73. 73
CHAPTER 4. FIREWALLS
The internet like any untrusted network can be a scary
place. Every day, new vulnerabilities are being
discovered and also exploited. When a flaw is discovered,
it needs to be patched. While this is easy to do for one
system, it becomes complicated when many systems are
involved, and only gets worse when those systems
employ different software and setups. While this is
recommended but difficult, it can be done with host
based security. However, this can be impractical for the
large scale. An alternative to this is the firewall.
The first line of defense for most networks is the
firewall. What exactly is a firewall and how do they
work? The term firewall has been used for things other
than computer security; in cars the firewall separates the
engine from the passengers keeping them safe from the
engines heat, in buildings the firewall is a barrier meant
to help prevent the spread of fire. Basically keeping out
something that was not wanted, in these cases
dangerous levels of heat. At the simplest level this is

74. 74
what a network firewall does as well, it keeps out
attackers by blocking their access to network resources.
In the late 1980's firewalls began to make their
appearance as advanced packet filters. As attacks grew
in the 1990's so did the capability and complexity of
firewalls. Today firewalls have advanced from
something that was just for a few large networks, to
something that can be installed locally on just about any
PC. Firewalls are now an integral part of network
security.
TYPES
There are three types of firewalls. The first type of
firewall is the packet filter which has a fairly basic
security method. After packet filters came stateful filters.
Stateful filters are more aware of the network data and
provide a higher level of security than packet filters. The
final type of firewalls is gateway firewalls, also known
as proxies.

75. 75
PACKET FILTER
Packet filters are aware of the packets data is
transferred in and the basic parts of each packet. The
parts a packet filter knows about are the source and
destination IP addresses, the port numbers, and the IP
protocol field. Packet filters work by allowing or
blocking packets based on a set of rules related to the
packet information they understand. If a packet does not
match a rule then there are two possible default actions
they may take.
The discard default policy blocks any packet that is not
allowed by a rule, while the default forward policy
allows any packet not blocked by rules to pass. The
default discard policy is more secure but it may hider
users more until rules to allow specific traffic are added.
Packet filters are simple which makes them fast, but they
can be difficult to configure correctly and they provide
no authentication for use of the connection.
STATEFUL FILTER
The solution to the problems of a packet filter is the next
type of firewall, a stateful filter. Astateful filter knows

76. 76
more about packets and their contents along with higher
level protocols. This advanced knowledge makes them
more secure and easier to configure than packet filters. A
stateful filter has knowledge of the higher level protocol
TCP. Astateful filter uses the fact that TCP works via
connections to increase security. The filter can tack
outgoing TCP connections and allow incoming data on
them, as well as allow incoming TCP connections based
on similar rules to a packet filter.
Some stateful filters add additional security by knowing
about even higher level protocols on top of TCP, such as
SMTP and FTP. While the security does up in stateful
filters with the more information they have the speed
goes down because more processing of the data is
required. Although they have higher security then packet
filters stateful filters are not perfect. “An attacker could
generate a packet with a header indicating it is part of an
established connection, in hopes it will pass through a
firewall.”
GATEWAY

77. 77
The final type of firewall is the gateway. There are two
types of gateways, they application gateway and the
circuit level gateway.An application level gateway
provides security by using authentication before a user
can send data through. After a user is authenticated they
c a n only send data using a protocol the gateway
understands. This means that a gateway must know its
supported protocols fully and provides top level security
for each. Another benefit of knowing the protocol is that
it allows for full logging of all the network activity. The
drawbacks of an application level gateway are the
processing of a lot more data and the multiple
connections to be managed between external and
internal machines.
Acircuit level gateway has multiple connections like an
application gateway but it works on a lower level. The
circuit level gateway does not know about the high level
protocols and only manages connections. It is faster
than an applications gateway because of its low level but
it does not provide the same level of security.
There are three types of firewall basing. Bastion hosting,

78. 78
Host based, and person firewalls are all different ways
of deploying a firewall.
1. A bastion host is a system identified by the
firewall administrator as a critical strong point in
the network's security. In general, crucial
application gateways are run on some kind of
bastion host. Each bastion host may run multiple
gateways that support different protocols. These
machines run on a hardened operating system
that contains only the basic software to run the
gateways and support wanted protocols.
Generally these systems will run with writing to
the disc disabled. This prevents malware from
saving itself so if a system is infected with
malware it can be restored by a simple restart
which will wipe the ram and the malware.
2. A host based firewall is a software firewall on an
individual host, commonly a server or
workstation. Usually the software of a host based
firewall is part of an operating system or a low
level add-on. Host based firewalls allow for a
configuration based on the needs of the specific

79. 79
host and they offer an extra level of protection
when combined with bastion host firewalls.
3. The third and final basing is the personal
firewall. This is a software firewall made for
personal computers. They are less complex than
bastion or host based firewalls. The main
methods of security for personal firewall is port
blocking, which by blocking ports that no known
application uses, enhances security. Acommon
additional feature of personal firewalls is the
monitoring of outgoing traffic for malware. This
feature helps to prevent the spread of malware
i n a network if one of the machines becomes
infected.
CONFIGURATIONS
Firewalls are a central point in the network where all
network traffic passes through. Because of this they are
a continent point for network management, and an
integral point in network security. This allows firewalls
to be configured to perform some advanced network
management, allowing additional features to be easily
added into the firewall.

80. 80
DEMILITARIZED ZONE (DMZ)
Say there is a network that needs to have dedicated
servers that need access to the internet or another
untrusted network, and those servers may be
susceptible to attack. While at the same time the rest
network those servers reside on need to be well
protected. Then there is a case for a DMZ. The DMZ will
allow the servers to operate normally with the
maximum level of protection, while at the same time the
rest of the network is safely protected by its own
firewalls.
The most common network configuration has two
firewalls, an external firewall and an internal firewall.
Between these firewalls is what is known as a DMZ. This
area of the network is usually where services that need
external network access are places. General the security
policies within the DMZ are set to allow external
incoming connections. This allows services such as
WEB servers, EMAIL, and DNS to function properly with
both the external network and the local network,
without compromising the network protected by the
internal firewall. The purpose of the external firewall is

81. 81
to protect the DMZ from attack, while the internal
firewall guards against the consequences of a
compromised external firewall. Such as rootkits, bots,
or other malware that has been lodged inside the DMZ.
Either or both of these firewalls will protect the
network from an attack. Additionally multiple firewalls
can be used to protect the internal networks from each
other.
VIRTUAL PRIVATE NETWORK (VPN)
Imagine there is a company with two buildings that are
separated by some distance need have a need to share
network resources. The distance between these
networks is great enough that it is impracticable to run
cabling to directly connect the networks. But these
building have both have access to an untrusted
network. Then someone has the bright idea to connect
the two buildings networks through the untrusted
network. But what if someone were to snoop on this
traffic? Well the answer to this scenario is to simply use a
VPN.
Most firewalls already have integrated virtual private
network (VPN) functionality, and most firewall vendors

82. 82
are now integrating gateway virus scanning, intrusion
detection/prevention, and Web/application security.
VPN's are a secure way to remotely connect into your
network. They act as a tunnel that connects the remote
systems and a secured network. VPN's use encryption to
ensure that the data being moved between the
networks is secured. This bundled with proper
authentication for a secured distributed computing
environment.
AVPNs' encryption can be the weak point in network
security. Intrusion Detection and Prevention Systems
(IDPS) cannot detect attacks within encrypted traffic;
attacks from across t h e VPN can be almost as
dangerous as attacks from within the secured network.
If the VPN tunnel is implemented after the IDPS in a
separate box, the IPDS has no way to detect what kind
of traffic is being moved. For this reason it is
recommended to have the firewall and VPN in the same
box, this allows for an implementation where the VPN
traffic is decrypted and checked by the IPDS at the same
time.
DISTRIBUTED FIREWALLS

83. 83
What left is the case where a system administrator has
many systems with different firewall requirements?
These systems can be vastly different from one another,
internal email external email, web server, multiple sub-
networks, and possibly the need to be able to
dynamically add new systems or networks, each with its
own set of requirements. At the small scale this isn't
that big of an issue. At about ten systems a single
technician could easily administrator each device
independently, at one hundred it that same technician
would be heavily worked but it might be manageable, at
a thousand or more it becomes a major problem. Sure
more technicians could be hired but then there is the
issue of what if one system is configured incorrectly.
That one system could then potentially make the entire
network insecure. This is where distributed firewalls
come into play.
Distributed firewalls decentralize the firewall, allowing
LAN attacks to be distributed to many different
firewalls. This allows the attack to be pushed to a
firewall that is nearer to the source thus cutting the
attack off at an earlier point. This means that the

84. 84
firewall can cooperate with each other to enforce a
higher level of security. While initially this doesn’t
sound like a big deal, one only has to look back at a VPN
to see how this could be highly beneficial. Say there is
an attack from with a VPN to a subnet within the
network. Adistributed firewall can easily block the
attack at the earliest firewall, thus cutting off the entire
network. This not only prevents this attack, but prevents
the attacker from switching to another VPN within he
network or subnet and continuing the attack.
Distributed firewalls have many other advantages, such
as log aggregation and analysis, firewall statistics, and
fine-grained remote monitoring of individual hosts. This
is possible because of the nature of how distributed
firewalls work. While a firewall by its self can do all of
these, it can only do it for traffic that passes through the
firewall. This can b e a problem if a network is
connected at many points to untrusted networks. In
general you would want all traffic to pass through one
point the firewall; this would weaken the firewall to
attacks such as DDoS. Because Distributed firewalls
communicate with each other they can pass data to

85. 85
each other, this allows for centralized administration,
and a single database for the firewalls logs.
CONCLUSION
Firewalls are an integral part of network security.
Firewalls keep out attackers and unwanted traffic. As
central point in the network they can easily have
additional features added to enhance the network,
including advanced monitoring and VPN. Without
Firewalls larger networks like the internet could not
function. They are the first and often best defense
available.

86. 86
CHAPTER 5. DENIAL OF SERVICE
ATTACKS
In today’s society, the Internet is more prevalent than
once was envisioned. The Internet is continually
pressing forward and becoming integral into multiple
facets of our daily personal and business lives. People
rely on the services provided on the Internet for
everything from personal entertainment and banking,
to working in an organizational environment. In fact, as
an example, many jobs that were once brick-and-mortar
physical presence jobs are done via telecommuting.
Think of all the distance learning schools that have
‘virtual’ faculty. Also, as another example, there are
some very large organizations who report that over
60% of their technical staff (programmers, database
analysts, networking engineers, etc.) work virtually.
From a business perspective, it is a requirement that
even smaller more unique (boutique) as well as the very
large organizations require some level of work with the
Internet. Further, governmental agencies also have

87. 87
implemented many ‘front-facing’ websites and services
to connect with their constituents.
The Internet age has spawned malicious activity that
has prevented organizations and governments from
offering services via technology means through DDOS
(Denial-of-Service) attacks. Attackers can bring services
people rely on to a halt, disrupting business operations,
and causing great problems for the networks that are
attacked. Millions of dollars are lost annually due to
DDOS. Further, DDOS attacks are now more widespread
than ever, can come from anywhere in the world, and
are getting harder to trace due to advanced techniques
used by hackers.
In this section, we will discuss the different types of
DDOS attacks, the different methods for DDOS detection
and prevention that are currently being used, and make
an assessment of what one can do to protect themselves
against DDOS attacks.
OVERVIEW OF DDOS ATTACKS
A Denial of service (DOS attack) occurs when a target
machine is flooded with malicious traffic until resources

88. 88
are exhausted which causes the system to go offline.
Expanding on the DOS-attack concept, the Distributed
denial of service (DDOS attack) works much the same
way, except in this particular instance, the attack is
amplified by enlisting other machines and computers in
the attack. Most large-scale DDoS attacks rely
on botnets. DDOS attacks all share four basic elements.
These elements are:
1. The attacker.
2. Compromised hosts, known as handlers, capable
of controlling multiple agents that spawn an
attack.
3. Attack daemons or zombie hosts, responsible for
generating packet streams towards the intended
victim.
4. The victim or target host(s).
The machines (the compromised hosts and attack
daemons) responsible for the attack are usually
external to the victim’s network to avoid efficient
response from the victim, as well as external to the real

89. 89
attacker’s network to avoid liability if the attack is
traced.
Preparing a DDOS attack involves selection of agents
that have a vulnerability that can be exploited for a
hacker to gain access. The compromised machines also
need to have the resources that will enable them to
generate powerful attack streams. This used to be a
manual process but has been made easier by freely
available scanning tools, which can automate this
process. Once the agent machines have been selected,
the hacker installs code on the machines, commonly in
the form of self-propagating worms, which is
undetectable by the compromised machines and allows
them to be controlled by the hacker. The hacker is able
to communicate with the agents to see which agents are
online at any given time. The agents are configured in a
manner that instructs them to communicate with
multiple handlers to create the most powerful attack
possible.
All this communication can be done through common
protocols such as TCP, UDP, or ICMP. Once the hacker
has configured all the agents the actual attack can take

90. 90
place. The hacker commands the attack, selecting the
victim, the duration of the attack, as well as the type of
attack and port numbers to be attacked. The hacker can
adjust packet properties creating a variety of different
packets making the attack harder to detect. Creating a
DDOS attack not only exploits the victims network but
also exploits the machines involved in the attack, which
have no knowledge they are being used maliciously.
DDoS attacks are most powerful when the hacker has
exploited a sufficient number of compromised hosts to
send the greatest amount of useless packets to the
victim at the same time.
DDOS ATTACK TYPES
There are many different types of DDoS attacks, but
they all share a common goal and that is to attempt to
prevent the legitimate use of a service. A distributed
denial-of-service attack differs from a DoS attack as it
deploys its attack from any number of different
computers, or bots that can be widely distributed. DDoS
attacks can be classified into two categories: direct
attacks and reflecting attacks. Direct attacks send a
large number of attack packets directly towards a

91. 91
victim with spoofed source addresses so the response
goes elsewhere. Reflecting attacks use innocent routers
and servers as reflectors. An attacker sends packets that
require responses to the reflectors with the inscribed
source address of the packets set to victim’s address.
Here is a quick overview of eight of the most common
attack types:
• UDP Flood: A UDP flood attacks random ports
on the victim or target machine flooding the
ports with packets that cause them to listen for
applications and report back with an ICMP
packet.
• SYN Flood: A SYN flood attack sends repeated
spoofed requests from a variety of sources to a
target server. The server responds to the
requests with ACK packets to complete the TCP
connection, but instead of closing the connection
the connection is allowed to timeout. With a
strong enough attack the victim’s resources are
eventually exhausted and the server will go
offline.

92. 92
• Ping of Death: Ping of death is a denial of
service attack that manipulates IP protocol by
sending packets larger than the maximum byte
allowance. Packets are divided across multiple IP
packets and once they are reassembled they
create a packet larger than 65,535 bytes, the
maximum allowable size, causing the victim
servers to reboot or crash.
• Reflected Attack: A reflected attack is where an
attacker creates forged packets that will be sent
out to as many computers as possible. When
these computers receive the packets they will
reply, but the reply will be a spoofed address
that actually routes to the target. All of the
computers will attempt to communicate at once
and this will cause the site to be bogged down
with requests until the server resources are
exhausted.
• Peer-to-Peer Attacks: Peer-to-Peer attacks
exploit peer-to-peer server to route traffic to the
target website. People using the file-sharing site
are instead sent to the target website until the

93. 93
website is overwhelmed with traffic and sent
offline.
• Nuke: Corrupt and fragmented ICMP packets are
sent via a modified ping utility to the target until
the target machine goes offline. This attack
focuses on comprising computer networks and is
an old distributed denial of service attack.
• Application Level Attacks: Application level
attacks target system applications that have
more vulnerability. Rather than attempt to
overwhelm the entire server, an attacker will
focus their attack on one or more applications.
• Multi-Vector Attacks: Multi-vector attacks are
the most complex form of a DDoS attack. Instead
of utilizing a single method, a combination of
tools and strategies are used to overwhelm the
target and take it offline. Multi-vector attacks can
target applications on the target server, as well
as, flood the target with a large volume of
malicious traffic. These types of DDoS attacks are
the most difficult to mitigate because the attack

94. 94
comes in different forms and targets different
resources simultaneously.
DEALING WITH THE DDOS PROBLEM
There is no easy solution to dealing with DDoS attacks.
Currently there are many different strategies of how to
deal with these attacks. There are three lines of defense
against a DDoS attack:
• Attack Detection and Filtering - during the attack
• Attack Prevention and Preemption - before the
attack
• Attack Source Trace-back and Identification -
during and after the attack
The best solution to dealing with an attack would
combine all three of these defense mechanisms.
DDOS DETECTION METHODS
DDoS attack detection is a very complicated problem.
Because of the many different types of DDoS attacks and
the rising sophistication of attack methods, there has
yet to be a single method perfected for attack detection.
There are currently many different methods for DDoS

95. 95
attack detection. We will discuss some of the common
methods used to detect attacks, and look at a method
that may improve on the current methods being used.
Here is an overview of commonly used attack detection
methods:
1. Soft Computing: Soft computing is a common
method used for attack detection. Soft computing
is a general term for describing a set of
optimization and processing techniques that are
tolerant of imprecision and uncertainty. This
method uses neural networks, genetic
algorithms, and radial basis functions because of
their ability to classify intelligently and
automatically.
2. Knowledge Base: Knowledge base detection
methods check incoming network traffic and
events against predefined rules or patterns of
attack. General representations of known attacks
are formulated to identify actual occurrences of
attacks.
3. Statistical: Using statistics gathered from a
network is another common way of DDoS attack

96. 96
detection. Statistical properties of attack
patterns can be exploited for detection of DDoS
attacks. A statistical model for normal network
traffic is determined, and then tests are applied
against the model to see if new network traffic
conforms to the model. Traffic that does not
conform to the model is classified as an anomaly
and potential attack.
4. Machine Learning: Machine learning
techniques use preventive and deterrent
controls to remove system vulnerabilities on
target machines. Adaptation techniques are used
to launch protocol anomaly detection and
provide corrective intrusion responses.
Enforcing dynamic security policies tailored for
protecting network resources can be especially
useful for detecting DDoS attacks. There are
many automatic tools available and being
developed that attempt to learn specific patterns
of network attacks to protect the target systems
resources.
DDOS ATTACK PREVENTION METHODS

97. 97
Many attack prevention methods have been developed
to protect and keep servers up and running. These
systems monitor incoming and outgoing traffic between
servers and are deployed as a barrier between the
Internet and a server. The attack prevention methods
exist in firewalls, intrusion detection systems, and
security enhanced routers. Some of the fundamental
technologies used to prevent attacks include traffic
analysis, access control, packet filtering, redundancy,
and address blocking.
An intrusion detection system logs incoming network
traffic and is able to create and analyze traffic statistics
to provide valuable information about traffic and usage.
This can be used to identify peak usage times and create
traffic profiles to be compared against a baseline to
identify abnormal patterns, which could potentially be
DoS attacks.
Firewalls are able to inspect and filter unwanted
packets. They can “allow or deny packets according to
their protocols, ports, IP addresses, payloads, and
connection states.” Routers also can employ similar

98. 98
defenses like firewalls do but are able to keep malicious
activity further away from a targeted network.
We will provide an overview and briefly discuss
commonly used attack prevention techniques that are
currently deployed.
INGRESS FILTERING
Ingress Filtering will drop traffic on a network if it does
not already have previous knowledge of an IP address
that does not match its own domain prefix. An ISP is
able to reduce spoofing and can locate the source of an
attack if it has implemented ingress filtering. Ingress
filtering is not able to prevent all illegitimate uses
though. A user can forge their host’s source address
with another that has a permitted domain prefix.
EGRESS FILTERING
Egress Filtering is a filter that filters outbound traffic. It
makes sure that only IP addresses that have been
assigned an address within the IP address space are
allowed to create outbound traffic. This type of filtering
is able to protect other Internet domains from an attack
from an unknown user of a system. However the

99. 99
domain’s precious network resources are used to
enforce this.
ROUTE BASED DISTRIBUTED PACKET FILTERING
This type of filtering works on the principle that there is
only a finite source of IP addresses that legitimate web
traffic can be generated from. Spoofed IP addresses will
have their flows of IP addresses blocked from reaching
their destination.
HISTORY BASED IP FILTERING
A database of IP addresses is built and only incoming IP
addresses are accepted from this list. A user may be
able to invade the system by tricking the server to
include their IP address in the database.
Secure Overlay Services
Secure overlay services are able to provide
“exceptional” protection at the cost of slowing down the
client’s system. Hash routing is used and user traffic is
authenticated via SOAP. Traffic is routed through a
small number of nodes called as servlets to the victim.
But because of the cost of slowing down a client, this
method is not recommended for public servers.

100. 100
LOAD BALANCING
ISPs can increase the bandwidth provided to “critical”
connections in order to prevent them from being
affected by an increase in traffic (legitimate or not).
Implementation can be costly and complex. However
normal performance can improve in multiple server
architecture because of this load balancing.
HONEYPOT
An attacker is lead to attack a honeypot instead of the
actual system. Because of the implementation of
honeypots, an attacker believes they are attacking the
actual system. If the signature of an attack is detectable,
records of the attacker are able to be traced and stored
including the software and type of attack used.
DDOS TRACE BACK AND IDENTIFICATION
DDoS Trace back is a response that takes place after a
victim has been attacked. The IP address of the attacker
sending the packets is traced without using actual
source information from the packets. Routers are set to
record information about seen packets and their
destinations. This method is not very effective, as the

101. 101
actual destination of packets cannot always be traced
back due to NATs (network address translations) and
firewalls. This method is also completely ineffective in
reflector type attacks. The one benefit of DDoS trace
back is that it can be helpful for law enforcement to
trace the source of DDoS attacks that have taken place.
IMPACTS OF DDOS ATTACKS
DDoS attacks continue to grow in frequency and impact.
While we mostly hear about massive DDoS attacks in
the news, there are a growing number of smaller DDoS
attacks aimed at poorly defended websites. These
smaller attacks are well planned and can cause lasting
damage. More and more companies are starting to
invest in some sort of DDoS protection, but most are
still relying on firewalls and other traditional solutions.
The amount of successful attacks was drastically
reduced when some sort of DDoS mitigation service was
used. Relying on firewalls and routers to keep your
network safe is no longer a sufficient method of defense.
One of the major impacts of a DDoS attack is the
financial repercussion it can have on a company. When

102. 102
a company’s website is attacked the downtime of the
site, along with customer complaints, and mitigation
costs can be huge.
The costs associated with DDoS attacks can be
extremely costly to a company. Companies need to be
aware of the risks that DDoS attacks pose to the business.
CONCLUSION
DDoS attacks come in many forms with varying levels of
complexity, which are always evolving. The current
solutions for detection and prevention that we have
discussed have proved inadequate in protecting
systems from the ever-growing threat of DDoS attacks.
There is more research needed in this area, which will
have to be ongoing to keep up with evolution of DDoS
attack types. Currently the best way to protect a system
from DDoS attacks is to use a comprehensive solution,
which includes detection, prevention, and DDoS trace
back.

103. 103
CHAPTER 6. CRYPTOGRAPHIC TOOLS
Cryptography involves the enciphering and deciphering
of information so that the information is then only
understandable by the intended receiver. Typically the
information is to be sent for communication between
persons or devices. Cryptography is used in providing
accountability, fairness, accuracy, and confidentiality,
which is applied in a number of ways including:
prevention against fraud in electronic commerce,
validity assurance of financial transactions, showing
proof of identity, and protection of anonymity. The field
of cryptography is very deep and demands much
consideration. Many areas of mathematics comes
together to form cryptography, including number
theory, complexity theory, information theory,
probability theory, abstract algebra, and formal
analysis.
Cryptography is a constant game of cat and mouse
between those working to protect data for its owners
and those trying to take data for themselves. The nature

104. 104
of the problem lies in that it is an uphill battle where the
good guys have to provide an impenetrable defense
while the bad guys only need to find a single flaw to
break the entire system. Making the battle even more
difficult is that the defenders are fighting with one hand
tied behind their back, appeasing users who don’t want
their convenience hampered by something that they
don’t want to have to deal with. These factors add
together to produce a multi-billion dollar industry that
is constantly pushing the boundaries of technology and
mathematics.
Cryptography has been an essential part of warfare
since the days of Julius Caesar and possibly even earlier.
Until the advent of the business class electronic
computer, cryptography was almost exclusively utilized
by governments for military use in issuing orders
among commanding figures. The Caesar Cipher, German
Enigma Machine, and other coding schemes (such as the
use of the Navajo Native American language in WWII as
a radio cipher) were used for relaying military tactics
over dispersed squadrons/forces. At their time, these
ciphers were highly effective. The Caesar Cipher was a

105. 105
simple substitution cipher that shifted letters down the
alphabet. Perhaps a reason the cipher was strong for the
time was that those who may have intercepted
encrypted messages were illiterate or believed the
message was written in a foreign language. In time,
accompanied with increasing numbers of literate and
intelligent individuals, the cipher inevitably would not
maintain its secrecy. In the 1500s, Blaise de Vigene`re -
a French cryptographer and diplomat - developed a
polyalphabetic cryptosystem (as opposed to the Caesar
Cipher mono-alphabetic cryptosystem), which was
much more difficult to break.
Another example of cryptography in warfare is the
development and use of the German Enigma Machine
during World War II. This electromechanical device
used a series of rotating cylinders and reconfigurable
keyboard mappings in predefined configurations to
generate a rolling cypher to protect all German military
transmissions. Every time a letter was typed, the
cylinders would rotate, allowing for different letters to
be encrypted as the same one, making frequency
analysis completely useless, unlike in the past. However,

106. 106
the devices strength also corresponded to its greatest
weakness.
No letter of the alphabet could map to itself after being
encrypted. It was this fundamental design decision that
allowed British mathematician Alan Turing to
spearhead work on the bombe machine. This
electromechanical device allowed Allied code breakers
to determine the day’s Enigma configuration using logic.
The machine would be programmed with a probable
translation of an encrypted message and make
assumptions about the configuration. When a logical
fallacy was detected (e.g. one letter on the plug board
needing to be mapped to two different letters at once),
all deductions relating to that assumption were known
to be false. Since the development of the bombe
machine, cryptographic algorithms have only become
more and more complex and more heavily scrutinized
for such possible weaknesses or flaws.
As digital computing advances, security needs to be
developed and researched at an increasingly rapid pace.
This is a recurring theme and is still applicable today.

107. 107
Since systems built today will be used for years ahead,
they must be able to stand firm in the midst of what the
future brings; The evolution of attackers, computational
power, and incentives to undermine a widespread
system. With the spread of interconnected devices
across the globe, malicious parties have even more
targets and opportunities to probe systems’ security
and exploit vulnerabilities. This has led to widespread
use of cryptographic technologies online.
It is the rise of network traffic and online transactions
that has created a need for securing channel
communication. Shopping, banking, and personal
communications are all protected with modern
encryption standards. With each of these activities
being tantalizing to potential thieves, strong protection
is a must. With the ever increasing need for security,
digital encryption standards only improved over the
years leading to the creation of standards such as the
Data Encryption Standard (DES) and the Advanced
Encryption Standard (AES), hash functions like Message
Digest (MD5) and the Secure Hash Algorithm (SHA), and
the public key cryptography work of Diffie-Hellman and

108. 108
RSA. All of these technologies are (or were) used in one
way or another to form the backbone of the modern
Web.
The main issue seen in the advancements of these
technologies is the slow rate at which old, insecure
technologies are no longer supported. Despite the
widespread adoption of the Secure Sockets Layer (SSL)
3.0 and Transport Layer Security (TLS) 1.0, in 2006,
many web servers still supported the outdated SSL 2.0.
In addition to the deprecated protocol, a majority of
servers also still allowed connections to be encrypted
with DES-64 or worse, not requiring at least 3-DES. The
good news about cryptography is that we already have
the algorithms and protocols we need to secure our
systems. The bad news is that that was the easy part is
that implementing the protocols successfully requires
considerable expertise. When providing a server for
customers to connect to, it is the responsibility of the
person who runs the server to make sure that the
connection is as secure as possible. This de facto
responsibility is due to the fact that most users have no

109. 109
idea what algorithms and protocols their machine is
using, they just want it to work and be safe.
In terms of providing security for the future, there have
been many inquiries into and explorations of the
security of AES, but none so far have shown any
significant flaws. This is encouraging, showing that
security researchers are staying ahead of their
competition to make practical encryption as difficult to
defeat as possible.
All modern encryption is based on the concept of
“practical security” as opposed to “perfect security”.
Perfect security is something that can never be
defeated, no matter how long you try to break it.
Practical security relies on the concept that some
encryption algorithm can be so difficult to defeat that it
is not practical. This can be due to raw computing
power necessary, that the information would no longer
be relevant by the time it was retrieved, or even
because it would take longer than a person’s lifespan
with available resources. It’s the restriction on time and
resources that provides a barrier to the attackers. While

110. 110
these restrictions place a hamper on attackers’
advances, the natural progress of technology plays into
their hands with improvements in processing power –
smaller scale fabrication processes that now reach
down into the 16nm range -- and also in availability (e.g.
cloud computing clusters and services with massive
parallel computing power that can be rented by
anyone). The ease of access to these newer technologies
starts to tip the scales in favor of the attacker who can
now call on massive amounts of computing power
cheaply and on demand.
The most difficult aspect of practical security that needs
to be considered is that it will be used by everyday
people on an everyday basis. What this means is that it
must be fast enough that it does not impede a user’s
actions with time consuming processes while still being
robust enough to stand up against the constant barrage
of those who want to break it. This balance of easy to
use and hard to break has led to the concept of a “one-
way trapdoor” function. These are used in the Integer
Factorization Problem (which the RSA cryptosystem
has as its fundamental problem), Discrete Logarithm

111. 111
Problem in Finite Fields, and the Elliptic Curve Discrete
Logarithm Problem. The trapdoor doesn’t make the
problem easier; Attackers would still need to tackle the
problem the usual way which would take an unfeasible
amount of time. In modern research and use, Elliptic
Curve Cryptography (ECC) has taken center stage for
online security. For years, RSA has dominated the online
landscape as the preferred method of key exchange
services used by Transport Layer Security and the
Secure Sockets Layer, and is now being replaced with
ECC in order to future proof systems. While RSA has not
yet been broken, it is has been used for a long time
(technologically speaking) and many fear that it will
soon not be secure enough. With recent discoveries of
how far governments are willing to go when it comes to
electronic security and surveillance, many online
content providers have begun to see the necessity of
proactive protection in order to protect their users and
save face by preventing any breaches from occurring.
The main problem with online security, in some ways,
can be traced back to the fact that the web was never
built with having security at its core. Once researchers,

112. 112
designers, and developers started to realize how
widespread and varied the use of the web had become,
unforeseen uses of the technology all but required the
use of secure communications to be practical. In order
to make systems secure, cryptography needs to be
incorporated from a system’s conception to installation;
Cryptography is not simply an additional component
that can be tacked onto the system as an afterthought.
As development of web technologies picked up in pace,
security concerns began to be built in to the heart of
protocols being designed and implemented, falling more
in line with Schneider’s philosophy. Unfortunately, the
nature of the web itself lends to insecurity as it is just an
interconnecting and conglomeration of different
protocols, some of which were not meant to be used in
networked environments. This eclectic nature of
networks allows attackers the ability to compose their
attacks across these different protocols. Composition is
a key issue for protocol security. There are many layers
of security throughout an interworking system much
the same way as software architectural layers, but
require careful scrutiny, watching for the not so obvious
holes that attackers may find across the different

113. 113
dimensions of the system. While individual protocols
may be secure, the ways in which they interact may be
vulnerable to interception, injection, or other
vulnerabilities.
Aside from encryption, using secure protocols also
allows for servers to authenticate themselves through
certificates to the end user. Due to the sheer scope that
the internet now encompasses and the ease with which
someone can set up their own server presence on the
web, the new problem of “spoofing” or electronic
impersonation emerges. This new threat has led to the
use of previously developed encryption techniques to
be developed into means of authenticating one’s self
online. Such methods of authentication have become
core parts of protocols, such as SSL, that allow for users
to identify servers using asymmetric key cryptography
such as RSA and while simultaneously allowing users to
authenticate themselves using easily memorable
passwords as opposed to their own set of public and
private keys. Through the use of these authentication
mechanisms, phishing attacks and related malware
issues could be reduced, saving end users frustration

114. 114
and saving companies time and money. With the
average malware breach costing a company around $6.6
million, the costs of encouraging widespread
implementation of secure web connections seems like it
would be able to pay for itself.
CONCLUSION
Through this examination of security over the ages, it is
apparent that cryptography has only become a field of
ever expanding research, whether in the pursuit of
strengthening it or that of breaking it. With technology
and connected devices doing nothing but proliferating
through our everyday lives, keeping all of our data and
communications secure becomes more and more of a
pressing issue. Throughout the world, new ideas and
inventions are being created and implemented for
people to use for entertainment (communicating with
loved ones or sharing pictures), making our day to day
lives more convenient (sending money, electronic locks
on our houses), or even making them safer (connected
smoke alarms, collision detection systems). In all of
these areas, there will always be someone who wants to
get their hands on this information for one reason or

115. 115
another, whether it is to steal from us, impersonate us,
or just to watch the world burn. Yet, also in these areas,
there are those who defend us, who believe that we
have the right to safe and secure lives and keep these
dark forces at bay through ever evolving mathematical
and technological developments. In conclusion,
cryptography will be a concern for a long time to come.

116. 116
CHAPTER 7. WIRELESS SECURITY
In a first part, we discuss security and encryption. The
principles and purpose, securing and ensuring the
secrecy of a system, before discussing the difference
between symmetric (single key) and asymmetric
(public-key) encryption, to end with block and stream
cypher and some examples of encryptions protocols.
In a second part, we review some wireless network
technology architecture, after discussing common
attacks on wireless networks: man-in-the-middle,
eavesdropping, DoS and impersonation; and how do
detect such attack by monitoring the client, the access
point or the global traffic.
We follow by discussing best practices and policy which
will help minimize security risks. Attackers are
everywhere today and every technology has its
weakness. It is up to the administrators to do
everything in their power to secure their systems.
Then, we present how to implement strong security
architecture, using a VPN, a user authentication

117. 117
framework and a shared-key mechanism to ensure
protection.
To conclude, we perform an attack on a not secured
wireless network. By this attack, we prove how easy it
is for someone to access data on a not secure wireless
network, and the need for strong security mechanism.
OVERVIEW
Computer security represents today a very important
part of computer science, especially the network
security. Almost everything is today linked to a
computer network or another; internet or private
network, and computer are used for almost every
modern work. Ensure the security of such practice
became the priority for users and companies, as data
exchanged through networks were more and more
confidential, and the possible threat against network
were growing.
A large amount of effort has been put into research on
network security, in order to prevent data loss, identity
stealing, and every problem caused by lack of security.
In this section, we will focus on wireless network,

118. 118
security issues, impact, and protection mechanism
applicable on this large brand of networking
technology. We will describe encryption method used
today, the usual attack method used on wireless
network and how to detect them. Then, we will review
the architecture and weaknesses of popular wireless
technology currently in use today, before protection
solution and defining best practices for wireless
network. Finally, we will study a strong wireless
architecture, and perform a simple network attack on an
unsecured network to prove the need of security and
encryption.
SECURITY AND ENCRYPTION
In this part, we will present basic concepts of security
and encryption, such as symmetric/asymmetric
encryption, different methods of encipherment and
some examples of encryption algorithms. The main
purpose of security is to ensure the confidentiality of a
system. This purpose is based on 5 main principles:
1. Authentication: verification of the identity of
each party

119. 119
2. Confidentiality: only the person for which the
message is meant to can read it
3. Integrity: ensure that the data transferred have
not been altered in any way
4. Non-repudiation: ensure that no party can deny
having send a message
5. Reliability and availability: ensure the quality
of service for the system
SYMMETRIC AND ASYMMETRIC ENCRYPTION
Encryption is the conversion of data into a cipher text,
thus it is not readable. There is two main way for
encrypting data : symmetric encryption, using a single
key for both party, and asymmetric encryption, a more
complex system using a pair of key for each party : one
for encrypting, the other for decrypting. Both methods
are described below.
SYMMETRIC ENCRYPTION
As a recap from a prior section where we discussed
symmetric encryption, symmetric encryption uses a
single key, for both encrypting and decrypting data. The
schema is very simple: the text is enciphered using an

120. 120
algorithm and the key, and deciphered using the
reverse algorithm and the same key. Thus, both parties
share the same key.
This encryption system is the most used today. To be
efficient, we need to use a correct encryption algorithm
(Such as AES) and a key of a sufficient length, thus
preventing it to be cracked. The most common attacks
on such encryption are the cryptanalysis attack,
exploiting the
ASYMMETRIC ENCRYPTION
As we described in a prior section, asymmetric
encryption (aka Public Key Encryption) are the same.
Recall that the sender and the receiver having different
keys to encrypt or decrypt messages, the emphasis with
the term (and the term only) is that the public key is
one of the 2 keys in asymmetric encryption that can
actually be publicized. I can place my public key on any
public forum, send it with each email, post it …
anywhere. It will still keep an encrypted message secure
even if everyone had the public key available. Again, to
either scramble or encrypt a message that uses an

121. 121
asymmetric algorithm, not only do you need the
plaintext message, you also need both a public and
private key (think asymmetric keys) to encrypt and
decrypt a message.
BLOCK & STREAM CIPHERS
There are two methods for enciphering data, the block
cipher, and the stream cypher, presented below.
BLOCK CIPHER
The block cipher, as shown by its name, will take as
input a block of data / plaintext, to produce a block of
cipher data. Thus, all the data to be enciphered will be
cut down into blocks, in order to produce multiple
blocks of enciphered data.
They usually are more susceptible to noise during
transmission resulting in a loss of all the data contained
in the block. However, they can provide integrity and
authentication protection.
STREAM CIPHER
Stream cipher differs to block cipher, as it takes in input
our plaintext bit by bit. It has two main components: a

122. 122
key stream generator, the main unit in the stream
cipher, and the mixing function, usually a TOR function.
To start, we need an Initialization Vector, which will be
used to generate the other vector and generate the
enciphered data.
Stream cipher is faster than block cipher, but they are
more difficult to implement correctly and more subject
to user error resulting in a lack of security.
Finally, block cipher are better when the amount of data
to encrypt is known, such as files, where stream cipher
work best for continuous stream of data, for example on
a network.
WIRELESS NETWORK, GLOBAL ARCHITECTURE AND
WEAKNESSES
The next section presents the global architecture of the
most used wireless technologies, and their weaknesses.
COMMON ATTACKS ON WIRELESS NETWORKS

123. 123
Let’s start by presenting the most common attacks
against a wireless network, and how they are
performed.
SURVEILLANCE - EAVESDROPPING
On unencrypted networks, the attacker could read the
data stream which is sent from and to this network.
From encrypted network, such as those using WEP, the
attacker could use a crack software in order to break
the key.
DOS ATTACK
A DoS attack can be performed on network layer 1 and
2. The layer 1 attack consist in emitting a strong signal,
stronger than the one attacked, in order to increase the
noise on the channel used and unable any user to
access the legitimate network. The layer 2 attack will
consist in a flood of the network and attached client
with malicious packets.
IMPERSONATION
After the surveillance, one is able to identify MAC
address of the users of the network. Even if network is

124. 124
encrypted using WEP for example, stealing a MAC
address can be used in different purpose, as accessing a
network only allowing a certain range of MAC address.
MAN IN THE MIDDLE
This attack is made in two times. First, the attacker has
to put down the legitimate Access Point (AP), using a
DOS attack for example, and then set up a bogus AP with
the same SSID than the first to allow the victim connect
to it. Then, it can read and/or modify every packet
before sending to the legitimate AP.
DETECTING AN ATTACK
There are several ways to detect an attack on a wireless
network. There are presented below.
1. Monitor the access point: Monitor every packet
sent by every known AP on the network. If there
is a new AP coming, one getting down, or any
change which is not supposed to happen in the
network, an attack could be occurring.
2. Monitor the clients: It can be possible to
monitor the client, with mechanisms such as
black-listing, detecting potentially harmful

125. 125
packets from a client (such as flood), re-use of
the same IV vector for generating a WEP key
(see the WEP explanation below) and checking
for the IEEE 802.11 header of the client for
change (if its MAC/IP address has been stolen).
3. Monitor the global traffic: Monitor the global
traffic can be used to detect flood attack, using
de-authentication, de-association, authentication,
association, and bogus authentication. Failure to
authenticate and associated to the network can
also be monitored.
WLAN 802.11 FAMILY ARCHITECTURE
802 Based networks are very common and are used
in public areas such as coffee shops and hotels,
and private areas like offices, homes and
industrial warehouses. Security issues arise
because these LAN networks broadcast on radio
frequency networks (RF).
Global architecture
The 802.11 standard is structured as follows:

126. 126
Standard Data
Rate
(Mbps)
Frequency
(MHz)
802.11 1-2 2.4
802.11a 6-54 5
802.11b 1-11 2.4
802.11g 20+ 2.4
AUTHENTICATION
WLAN authentication consists of:
1. Service Set ID’s (SSID’s): Service Set ID’s
distinguish one network from another. The client
must have the correct SSID in order to connect to
the network.
2. Open Authentication: Open authentication is null
authentication and any device will be authorized to
connect to this network. It is used in areas where
devices cannot run complex authentication
algorithms or need to connect quickly. The device
will need to know the correct SSID in order to
connect.

127. 127
3. Shared Key Authentication: In shared key
authentication, a client can connect to a WLAN that
uses a Wired Equivalent Privacy (WEP) protocol.
It works in the following steps:
802.12 The client sends an authentication request
to the access point.
802.13 The access point sends an authentication
response with a challenge text.
802.14 The client uses a WEP key to encrypt the
challenge text and sends an authentication
request.
802.15 If the access point can decrypt the
authentication request and retrieve the challenge
text then an authentication response is sent that
grants the client access.
4. MAC Address Authentication: Although it is not
part of the 802.11 standard, it is supported by
vendors like CISCO. The procedure compares the
client’s physical MAC address to a local list of
allowed devices.
5. WEP Encryption: WEP Encryption is employed
with the goals of confidentiality, access control

128. 128
and data integrity. It can be either 64 bit or 128
bit encryption.
Weaknesses and Common attacks
Each one of the authentication methods described above
has its weakness.
● SSID’s are stored in plain text and can be found
using network sniffing.
● Open authentication has no security measures.
● In Shared Key Authentication, the challenge text
is exchanged over a wireless network and is
prone to a man in the middle attack. Packet
sniffers can capture the challenge text and the
response.
● Mac Address authentication can be tricked when
an attacker “spoofs” an address using a protocol
analyzer.
● Encryption is prone to:
○ Key attacks
○ Secret Key Problems
○ Confidentiality attacks
○ Integrity attacks

129. 129
○ Authentication attacks
MITIGATION MECHANISMS
It is recommended to use WEP encryption wherever
possible to circumvent the lack of security offered by
SSID’s and open authentication.
WPAN 802.15 - BLUETOOTH, ZIGBEE & NFC
The following section represents the 802.15 wireless
technologies. These technologies use a short-range
connectivity, which can be Low Rate (LR), with a low
data speed transfer but long life battery level, and High
Rate, with high data speed transfer. The most common
of them are Bluetooth, ZigBee and Near Field
Communication (NFC).
GLOBAL ARCHITECTURE
WPAN can be divided into two global architectures: low-
rate and high-rate architecture. Low rate will use low
radio frequency, where high-rate will use high radio
frequency.
LOW RATE ARCHITECTURE

130. 130
In this kind of topology, there are two types of devices:
Full Function Device (FFD) and Reduced Function
Device (RFD), and two types of network topology -- star
network and peer-to-peer topology.
• Star Topology: In a Star Network Topology,
composed of PAN and several FFD and RFD
devices, every communication goes through the
PAN coordinator.
• Peer-to-Peer Topology: A Peer-to-Peer
Network Topology works as an ad-hoc, self-
organizing and self-healing network. Any device
can communicate with any other, even if the
network is organized around a PAN coordinator.
HIGH RATE ARCHITECTURE
HR-WPAN network is called piconet, and networks
nodes are known as Devices (DEVs). One node will
assume the role of Piconet Coordinator (PNC), providing
synchronization service between the nodes. The
network is ad-hoc, which allow node to leave and enter
the network very easily. There are 3 types of Piconets
topologies. These include:

131. 131
1. Independent Piconet: An independent piconet
is formed with a network coordinator and
several network nodes.
2. Parent Piconet. The parent piconet controls the
functionality of one or more Piconets.
3. Dependent Piconet. The dependent piconet is
divided into child (or neighbor) piconet. Child
piconets are created by parents to extend the
network, coverage and/or provide additional
resources to the parent.
WEAKNESSES, COMMON ATTACKS AND MITIGATION
MECHANISMS
Weakness and common attacks depends of the
technology considered. We can find the common
attacks (DoS, eavesdropping, impersonation, etc.) on
almost every technology, but the way to perform it and
to defend against it change for everyone. We will
present threats and mitigation mechanism for some
very common technologies.
BLUETOOTH

132. 132
Bluetooth enable two or more user to exchange data on
a short range. Before exchanging data, a device has to
be discovered by another, and a matching between the
devices has to be done. Then, a device will act as the
master and the other as slaves. All communication
is managed by the master. Before being paired, devices
exchange a link-key allowing recognizing the device
afterward. Bluetooth is sensible to several attacks:
• Bluejacking, sending unwanted data to a
Bluetooth device, using for example the
BlueChat protocol (chat protocol)
• BlueSnarf, allowing the attacker to access
phone data without authentication
• BlueBump, weakness in the key
management allowing devices which are no
longer granted authorization to access the
phone anyway if they are still paired
• BlueSmack, a DoS attack, very similar to the
Ping of Death attack
• BlueDump, resetting the link-key storage,
thus allowing eavesdropping during the new
key exchange.

133. 133
Some countermeasure can be used to prevent such
attacks. First, when defining the PIN code between two
devices, do not to it in a public area, as it can be
eavesdropped during the pairing process. Do not re-
enter the PIN code every time a pairing is wanted, use
the old one. Also, turn your device into a non-
discoverable mode every time your transmission is
finished thus is preventing it from being discovered and
potentially attacked.
Finally, never pair with someone you don’t know for
sure the identity.
ZIGBEE
ZigBee is a Low Rate WPAN, low cost and very low
power consumption, using a two-way communication.
ZigBee is vulnerable to several attacks:
1. Jamming, sort of DOS attack. As ZigBee systems
often use only one channel, it is easy to send a
lot of information on this channel in order to
disable the device.
2. Collision attack, especially using
acknowledgment frames, which is very effective

134. 134
and difficult to detect.
3. Route disruption, sending false association
request to the coordinator, running him out of
capacity for any legitimate association. A
compromised coordinator can also attract some
target and perform attacks against them once
they are associated.
4. It is also possible to send a packet to a non-
existent packet. No verification is made, and the
packet will be sent again and again as no
acknowledgment is received.
It is possible to protect against such attacks. For
acknowledgement frames, a solution should be to check
if an acknowledgment frame is needed, to prevent the
use of out-of-scope address. Also, the key management
is centered to the trust center. Thus, for large network,
key are carried by the entire network and this can be
dangerous. To mitigate this problem, a hierarchical or
distributed key management should be considered.
NEAR FIELD COMMUNICATION

135. 135
NFC is a wireless using very small distance
communication, often when two devices are very close
(a few centimeters). The shortness of the
communication gives a certain security aspect to the
communication. However, data are not encrypted,
certain attacks can be performed.
• Eavesdropping attack, using an antenna.
• A simple DOS attacks, making noise on the used
communication channel, preventing the user
from receiving any message.
Data insertion, when an attack will send a response
before the legitimate responder could. To protect
against such attacks, establishing an encryption is the
best method mechanism which can prevent
eavesdropping and data insertion.
WMAN - 802.16
Specification 802.16 consists of wireless broadband
communication standards for Metropolitan Area
Networks (MAN). It is designed to cover a larger area
than WLAN networks and use a tall antenna to make
this possible.

136. 136
GLOBAL ARCHITECTURE
The security architecture is laid out as follows:
• Security Associations: Security associations are
set of security information used to establish
communication between the base station and
the subscriber stations.
• Certificate Profile: X.509 Digital Certificate used
for identifying the subscribing stations.
• Privacy Key Management (PKM): Responsible
for the authorization, periodic reauthorization
and reception or renewal of keys for subscriber
stations.
Communication between base stations and subscriber
stations takes place in three steps:
a. Subscriber Authorization
b. xchange of Key Material
c. Encryption of Data Stream and Key
Management
WEAKNESSES AND COMMON ATTACKS
WMAN faces some threats that are common to wireless
networks.
• Properly positioned radio receivers can intercept

137. 137
messages sent over the wireless channel
• Properly positioned radio transmitters can write
messages to a wireless channel
• An attacker can use interference and distance to
his/her advantage by forging communication
between two parties by reordering and
selectively forwarding frames (Man in the
Middle).
Other physical level attacks include:
• Water torture attack: The attacker drains the
receiver’s battery by sending a series of frames
• The attacker jams a radio spectrum and denies
service to the network
MITIGATION MECHANISMS
In order to prevent the inception or writing of messages
by unauthorized parties, confidentiality mechanisms
and data authenticity mechanisms need to be in place.
To prevent an attacker from communicating with two
parties, replayed frames need to be detected.
Jamming attacks can be prevented by increasing the
power of signals using high gain transmission antennas

138. 138
or increasing the bandwidth by using spreading
techniques. Currently, the police are responsible for
preventing physical attacks on networks.
WIRELESS WIDE AREA NETWORK (WWAN) - UMTS-
3G SECURITY REVIEW
WWAN is a very large brand of wireless network;
include networks used by mobile phone like GSM,
UMTS - 3G, 4G and Cellular Digital Packet Data (CPDP).
Due to the large brand of protocol available, and in the
difference the security is handled in every one of these,
we choose to study a particular protocol, UMTS. UMTS
is one of the bases for the 3G network, widely used
today.
GLOBAL ARCHITECTURE
The 3G protocol is based on its predecessor, GSM, but is
nonetheless very different.
The user’s phone will first communicate with the NODE-
B, which is the base station equipment. The Node-Bs
will then communicate with its RNC. The RNC manage
multiple Node-B, allowing resources and capacity for
data calls.

139. 139
The Core network is directly inspired from GSM. There
are two signal and transport domains available, both
communicating with some databases, Circuit Switched
(CS) and packet-switched (PS). The databases are
usually regrouped into the Home Service Subsystem
(HSS) and the CAMEL Service Environment (CSE)
The CS domain contains the Serving MSC (MSC) and the
Gateway MSC (GMSC), connecting the Node and the
RNC to the rest of the Core. The VLR is the database
containing every user identity. For the PS domain, there
is the Serving GPRS Support Node (SGSN) and the
Gateway (GGSN).
SECURITY CONCEPTS IN THE UMTS-3G
PROTOCOL
3G have multiple features to ensure a strong security all
other the protocol, all that including a compatibility
with the GSM network.
SIM BASED AUTHENTICATION
This security principle is inspired from what it was in
GSM. 3G have an authentication system using a
symmetric key shared between the SIM card and the
authentication center. This key is only dependent of the

140. 140
operator issuing the SIM card, limiting the impact of a
compromised device. If a device is hacked, only the
operator issuing the card might be impacted, leaving all
other users safe.
MUTUAL ENTITY AUTHENTICATION
UMTS provide entity authentication for both the user
and the network, ensuring security for both the
subscriber of the network, and the network itself against
illegitimate user.
DATA INTEGRITY
Data integrity is ensured using some main features:
integrity algorithm agreement and integrity key
agreement, allowing checking the data integrity
between the receiving and sending entity.
USER DATA CONFIDENTIALITY
Confidentiality of the user data is done by making an
agreement for the algorithm and key to use between
sender and receiver, allowing encrypting every data
sent and received.
USER IDENTITY CONFIDENTIALITY

141. 141
To allow confidentiality for the user identity, a
temporary identity is associated to this user every time
he or she enters a certain zone. Once the user leave the
given zone, the identity is given to another user,
preventing anyone to know exactly for which user is
which temporary identity.
NETWORK AND APPLICATION LAYER SECURITY
UMTS use some network and application layer security.
First, an IP based protocol is used to sectioning the
network into security domains. Also, SS7 (What is SS7?)
is used for communication and operators may add more
security features.
WEAKNESSES
When reallocating the Temporary Mobile Subscriber
Identity (TMSI), it may happen that the SN or VLR fail to
associate the TMSI to the International Mobile
Subscriber Identity (IMSI). In such case, the IMSI is
requested directly to the user. It may allow an attacker
to pretend a SN to request the permanent user identity.
Also, the IMSI request this way is transmitted
unencrypted on the radio path, allowing
eavesdropping.

142. 142
Firewall protects the network against external attacks,
but not against a compromised mobile device with
access to the network.
Data are transmitted from the mobile device to a
gateway, before being transmitted to the server. The
data are secured between the mobile and the gateway,
but not between the gateway and the server, which may
lead to insider attacks.
PROPOSED PROTECTIONS
To avoid the use of IMSI directly on the network, it is
possible to use 2 TMSI instead of one. Thus, if the first
TMSI is compromised or fail to give an IMSI, the second
one is used. If both fail, the user is not attached to the
network.
It is also possible to enable the use of an end-to-end
VPN for data transmission. Thus, the data will go
encrypted directly from the user end to the server-end,
without the need to be decrypted and eventually re-
encrypted on the network.
POLICIES AND BEST PRACTICES

143. 143
It is necessary to have best practices and usage policies
in place in order to minimize the threats described in
this section. Following are steps that be taken to ensure
that administrators have performed everything in their
power to prevent unauthorized actions.
• Change the manufacturer’s SSID to a secure
SSID: Changing the default SSID from “tsunami”
or “Linksys”, for example, will make it harder for
attackers to access the Wireless Application
Protocol (WAP). The new SSID should not
contain any identifiable information about the
company and should be a lengthy collection of
random characters including letters, numbers
and symbols.
• Encrypt passwords: The SSID password and
WEP key stored in the registry file should be
encrypted to thwart perpetrators.
• Enabling all security features: Since embedded
security features are disabled by default, it is
beneficial to deploy all security options
available. Strong authorization and encryption

144. 144
should be in place. For businesses, this means
that either 802.11i or a VPN should be used.
Application encryption such as SSH or SSL
should be used along with WEP to minimize the
threat of network sniffing.
• Dynamic Host Configuration Protocol (DHCP)
should be disabled: DHCP provides the IP
address to anyone regardless of whether they
are authorized or not. Static IP addresses should
be used instead.
• Employ a closed network: The SSID should be
invisible on network lists and should be typed in
by users wanting to connect.
• Controlling/Dismantling Rogue Access
Points: Rogue Access Points are installed
without the knowledge of the administrator.
Surveys of the site should be conducted
routinely to track AP’s. AP’s should be kept away
from interfering electronics such as elevators
and microwaves. They should be placed in a
place where access is strictly controlled.
NETWORK MONITORING

145. 145
The network must constantly be monitored for unusual
happenings. A Network-based Intrusion Detection
System (NIDS) should be in place along with an anti-
virus software. All threat detection and prevention
systems should be constantly updated and logs should
be analyzed.
BACKUP DATA
Regardless of how many safety measures are in place, it
is always important to have data backed up.
EFFICIENT SECURITY ARCHITECTURE
In this section, we will try to describe what could be
some current efficient security architecture. First, we
will discuss an open network with internal VPN
architecture, followed by user- authentication
architecture, to finalize with a shared-key mechanism
architecture.
OPEN NETWORK WITH VPN
In this situation, we assume that all data on the network
are untrusted, and neither authentication nor
encryption is done before anyone access the network

146. 146
(i.e. we consider anyone can access the network). Inside
this network is our LAN, with sensitive information.
This architecture as some advantages, very simple,
cheap, and the security principle is very easy: no traffic
is trusted.
Considering such architecture, there is three main ways
to protect our network. Using VLAN tagging to isolate
traffic (VLAN tagging allow every packet to be tagged
with an ID in order to identify the VLAN they belong to)
but require that the entire network support VLAN
tagging in order to be effective.
It is also possible to completely isolate the LAN,
dropping every packet from the network trying to
access it, using a firewall or a router. Finally, it is
possible to use a separate internet connection along the
network. This is the most simple and secure solution,
but also very expensive.
This type of architecture is very general, but also much
spread. Using these basic principles should prevent
major threats, but specific mitigation mechanisms

147. 147
depending of the particular architecture remain
necessary in order to prevent a very efficient protection.
USING USER AUTHENTICATION - WPA2-ENTERPRISE
One of the most recent system, it allows the network to
authenticate every client using a unique username and
password using an LDAP, a protocol used to look for
information on a server (What is LDAP?), or Active
Directory, a special purpose database.
WPA2 propose a strong security today, even if its
implementation is complex.
USING SHARED-KEY MECHANISM - WPA2-PSK
As discussed in the best practices, using a shared key
mechanism can prevent unwanted traffic to come on
the network. The idea is to give every authorized client
a key (preferably a WPA2-PSK, which is the most
secure, but avoid WEP which is not secure. Then, only
allow a traffic which use the keys, and drop any other
traffic.
The disadvantage of such method is the difficult key
management, and the problem caused by a lost or
stolen key, enabling outsider attacks.

148. 148
AN ATTACK PERFORMED: EAVESDROPPING
In order to prove the danger of non-encrypted LAN
network, and non-secure website connection (e.g.
without HTTPS), we tried to perform a Man in the
Middle attack on a Wi-Fi network. We wanted to prove
that it is possible for an attacker to steal a login and
password from someone when using an unencrypted
Wi-Fi.
ATTACK ENVIRONMENT
Our attack was very simple. Our Victim (V), was surfing
on the Internet using an unencrypted public Wi-Fi, and
wanted to create a discussion forum to discuss about
network security matters.
Our Attacker (A) was monitoring all the Wi-Fi traffic in
the area using Wireshark, and was able to see the traffic
of V. As the Wi-Fi was unencrypted, and the website
unsecured, A was able to see all the internet traffic of V.
ATTACK RESULT
The attack allowed us to discover the password and e-
mail used to create the forum. As both the Wi-Fi and
website connection were unencrypted, we were able to

149. 149
read the packet containing the FORM data used to send
the forum creation request.
It is easy to eavesdrop data from a Wi-Fi connection
when Wi-Fi is unencrypted, such as most public Wi-Fi
available in restaurant and other places. Especially, this
attack shows the importance of using a secured
connection on internet, and using an encrypted
connection every time valuable data are transmitted on
the network.
CONCLUSION
In this section, we have looked at various wireless
technologies from smaller wireless local area networks
to extensive wireless wide area network. Each
technology has its own weaknesses and administrators
need to know the ins and outs of the technology used in
order to thwart attackers and ensure network security.
Laxness in security can lead to devastating
consequences for individuals and business entities
since almost all tasks performed today are over the
internet.

150. 150
Merely relying on the minimal default security provided
by manufacturers is not enough and administrators
need to go above and beyond to properly moderate risk

151. 151
CHAPTER 8. OPERATING SYSTEM
SECURITY
The field of operating system security is complex and
requires constant renewal. We detail the recommended
procedures for system administrators in securing
endpoints when they are added to the network and in
the future, as well as tools to help in this process, with
the goal being to reduce the amount of time any given
end user system remains unprotected. We then discuss
the methods of building an operating system with
security in mind. A system can be used to enhance
kernel survivability in the event of a compromised
application attack. We conclude with remarks on this
approach, as it pertains to security and future viability.
The practice of information security, though commonly
thought to only deal with preventing access to sensitive
data, actually encompasses many other fields of
computer science and software engineering. Similarly, it
is not only about protecting key informational assets
such as databases, servers, and websites; it is also
concerned with securing any entry point into the

152. 152
organization. User systems, the personal computers and
other devices (which are often referred to as endpoints)
play a critical part in the security of an organizations
information because they are ubiquitous, heavily used,
and are not under the complete control of the
administrators at all times.
Indeed, securing endpoints can be very difficult, as their
position as end user systems means administrators
must carefully balance the needs of the organization to
have secure data against the needs of employees to
efficiently do their jobs. A high security policy may
simply be to prevent all network access to end user
systems, but this makes it nearly impossible for those
users to accomplish their jobs in a timely manner in
today’s vastly interconnected workplace. Conversely,
allowing any endpoint unmitigated access to any
resource may allow all employees extremely simple
access to needed resources, it also exposes all resources
to any person using any computer, a critical
vulnerability. Operating system security is about
providing both qualities in the necessary amounts for
the organization.

153. 153
Operating system security can be approached from
several perspectives: from that of a systems
administrator using commercial or open-source
operating systems to create functional end-user
distributions, and from that of an operating system
developer/vendor, creating a product that is secure out
of the box. While the systems administrator must ask
the question, “How can we configure the operating
system and its applications to be secure for the
organization’s needs?” the operating system developer
asks “How can we build our operating system to ensure
that it is secure from exploits regardless of how it is
used?” We will discuss the specific issues and
techniques used by both.
OPERATING SYSTEM SECURITY FOR SYSTEMS
ADMINISTRATORS
The process that systems administrators must
undertake to ensure that all endpoints are secure can be
separated into two major periods: ensuring security
when configuring new machines to be added to the

154. 154
organization, and maintaining security of existing
systems over time.
General procedures for ensuring new systems are
secure before delivering to the user:
1. Install the operating system and patch it. This
is the most vulnerable period for an endpoint in
this procedure; the installation disk or image
must be fixed in time, and generally only
includes the most recent major service release, if
any patches at all. The patching process can take
several hours, during which the machine must be
connected to the internal update server if it
exists or to the internet so it can download the
patches from the vendor.
2. Configure the operating system to maximize
security. This consists of several steps:
a. Removing any bundled software which is
not needed by the user to perform their
responsibilities, which reduces the
possibilities of unused software
presenting a vulnerability that should not
exist;

155. 155
b. Setting up any user accounts needed, as
well as assigning appropriate privileges,
in order to prevent users from having
access to resources they shouldn’t; and
c. Setting up other access controls not
covered by user account settings, to
maintain the principle of least privilege.
3. Install additional security software. While
most operating systems ship with some form of
firewall or antimalware suite, these products are
generally intended for personal use and are
either not sophisticated enough or not licensed
for use in a large, possibly commercial,
organization. They may not be updated as
frequently or tuned to counter the right threats,
and they may not be able to be configured and
managed separately. Replacing these with
enterprise-grade products as soon as possible
aids in integrating the system into the greater
network.
4. Test the final build. It is advised that systems
administrators test the build with modern
security tests to ensure that it has been

156. 156
configured appropriately. It is far easier to fix a
hole on one machine than on every machine in
the organization, and testing ahead of
deployment prevents the chance that end user
data is on the machine if it is compromised.
Additionally, it is highly important to plan any
installation procedure, in order to help prevent issues
or inconsistencies in machine configuration.
Both authors also propose similar procedures for
maintaining endpoint security over time. These
processes must be performed regularly by systems
administrators, and the specific techniques must be
kept up to date in order to ensure maximum security:
1. Keep the operating system up to date. Create
policies to ensure the operating system
automatically installs patches, usually after
review by the systems administrator. Vendors
produce patches in order to fix vulnerabilities
discovered by internal security teams or by
hackers, and leaving endpoints unpatched

157. 157
increases the risk that security may be
compromised.
2. Backup data regularly. User data and system
configuration can be lost for many reasons, and
minimizing time during which a user is not able
to do their job is critical to information security.
To that end, regular backups of user data should
be taken and stored securely, generally in
multiple places to increase the chance that data
will survive even severe disasters.
3. Continue to test systems for vulnerabilities.
Even though the OS vendor may produce patches
to fix vulnerabilities they find, these patches are
by no means comprehensive. In many cases,
security testing suites may be able to detect
vulnerabilities before vendors can, and in some
cases can lead to reporting those vulnerabilities.
These tests can also reveal vulnerabilities related
to configurations, which patches may not be able
to fix.
4. Monitor system logs. Suspicious or even
malicious behavior can reveal itself
inadvertently through logged activity. Regularly

158. 158
collecting and analyzing logs from endpoints can
reveal ongoing or attempted attempts to gain
access to the network. This can be an important
last line of defense for administrators.
These steps are general, and can be applied to any
operating system in use in an organizational setting, but
they do not provide a comprehensive overview of
specific steps to take. Many guides exist for securing
specific operating systems; “Security Highlights of
Windows 7,” “Mac OS X Security Configuration”, and
“Guide to Secure Configuration of Red Hat Enterprise
Linux 5” are examples of product-specific guides to
taking advantage of specific security settings and
provisions present in those operating systems. It may
also be a good practice to create and maintain
organizational guides with specific information for
colleagues or future administrators.
In addition, there exist several tools and techniques to
help automate this process. Imaging software, such as
DeployStudio or Symantec Ghost, enable the
administrator to set up one machine and then capture

159. 159
its image and store it. Clients can boot over the network
and download these images. When the system boots for
the first time, it will be fully patched and secured. Using
Sysprep, these images can even be made hardware-
agnostic, allowing for large-scale rollouts across
organizations. Centralized configuration such as group
policy enables administrators to change the settings of
every endpoint at once by requiring them to check with
the active directory server at boot or login. Similarly,
roaming profiles can centralize user accounts
themselves, allowing end users to have all their
documents and personalization settings on any machine
they log into, while simultaneously ensuring user
permissions are in sync throughout the organization.
In general, it is important to remember that the security
of organizations end-user computer systems is an
ongoing process that should itself be kept up to date.
Ensuring that all systems are protected according to the
most recent practices minimizes the likelihood of users
compromising data security from inside or outside
attackers doing the same.

160. 160
OPERATING SYSTEM DEVELOPMENT
Building an operating system has its own concerns with
regards to security. The operating system is often the
most complex piece of software running on a computer,
and the only software with components that have full
permissions and access to hardware. While there are
many sub-divisions of operating system security that
must be paid attention to in order to produce a secure
system, security of the kernel is perhaps the most
critical, because an exploited kernel can exploit any
application running on the system trivially.
The importance of kernel security is a result of the
kernel’s need to run with full access to all system
resources. While most kernels implement a ring model
of security which grants the least amount of privileges
required, the kernel runs in ring 0 which is fully
privileged. The result is that, even though an exploited
application may not be able to do what an attacker
wishes, if that application can exploit the underlying
kernel with which it must interact, the attacker has
gained full access.

161. 161
This interaction takes place in the form of system calls,
which applications invoke in order to do many
functions such as access IO devices, talk to other
processes, or modify kernel memory. Due to its open-
source and community-based nature, the Linux kernel
has been the focus of much security research in the
computer science field (although it is unknown just how
much security research is performed at Microsoft on the
NT kernel.) Researchers and developers have faced
many challenges due to the original design of UNIX—
Dennis Ritchie has been quoted as admitting that “UNIX
was not developed with security… in mind”—as well as
the POSIX standard which Linux, though it does not
comply fully, maintains ties with in order to increase
compatibility with other UNIX operating systems.
As it turns out, a focus on system calls enables a method
of enhancing kernel “survivability”—that is, the ability
for the kernel to function normally in the event of an
attack.
There are common methods of exploiting a kernel. They
note that these exploits include (1) the buffer overflow,
(2) the integer overflow, and (3) the format string

162. 162
vulnerability—all involve the use of system calls to use
an already compromised application on the system to
exploit and take over its kernel. The problem with
conventional fault-tolerance routines, they note, is that
these processes involve replaying operations that lead
to the fault after isolating the actual hazard. In the case
of a security attack, even if the fault is isolated, the
processes cause the attack to be repeated.
Instead, the authors propose a three-part system
designed to roll back the kernel without replaying the
attack. In order to detect that an attack on the kernel is
being performed, the authors allocate a number of bits
for every word in kernel memory to be “write protect”
bits. Memory is then configured such that each buffer
where data is to be written is surrounded by write-
protected memory words. If a write operation attempts
to exceed these bounds, the operation will try to write
to protected kernel memory, and an exception will be
raised.
To isolate this attack, the handler for the raised
exception will be able to use kernel checkpoints
(described below) to bring the kernel back to a known

163. 163
good state. Rather than just replaying the actions,
however, the offending process will be terminated, and
another process will be retrieved from the scheduler
and assigned to run in its place. This prevents the attack
from being replayed, while minimizing the amount of
time the kernel spends in recovery mode; since there
are other processes waiting and the offending process
won’t be allowed to execute any more (it is considered
compromised,) scheduling some other process and
continuing as normal is feasible.
To recover from the attack, a system of checkpoints will
need to be in place. These checkpoints are created just
as a system call is invoked, before that call is handled
and results returned. The contents of the checkpoints
involve the state of the kernel as it relates to the process
making the system call, as with each call there exists a
chance the process will attempt to use the call for
malicious purposes. When the exception is thrown,
these checkpoints can be used by the handler to restore
kernel state and to identify the compromised process,
so that it may be terminated.

164. 164
For future work, the authors discuss the fact that,
though the checkpoints were successful in preventing
the mentioned exploits from bringing the system down,
the sophistication of the survivability modifications
must be greatly enhanced, to cover a wider variety of
situations. Specifically, the authors mention that a
similar scheme could be applied to I/O operations. The
authors also mention applying these modifications to
kernels other than Linux in the future.
CONCLUSION
This research represents an infinitesimal fraction of the
greater field of operating system security. Securing an
operating system is a difficult process; it requires the
cooperation of several parties and a constant routine of
maintenance. While operating system vendors are
responsible for many aspects of the security of their
products, it is impossible for them to guarantee
security. Systems administrators must play an equally
large part in securing end user systems, by establishing
policies both technical and organizational in nature.
Even the end users themselves must be careful not to
breach security, even inadvertently. Once an attacker

165. 165
has a path into an organization, they can defeat many
security policies and procedures and compromise the
security of information. Though new techniques are
constantly being developed at all levels, it will be years
or even decades before these ideas are ready to be
shipped with mainstream software, if they ever get
there. Only through proven techniques and careful
application can an organization ensure their
information is kept confidential, uncorrupted, and
available to those who need it.

166. 166
CHAPTER 9. DATABASE SECURITY
This section outlines the various security mechanisms
that are available to protect databases, and explores
them in detail. New threats emerge in the security field
every day, and as a database administrator, or security
analyst for a company, it is up to them to delve into
these technologies and ensure that the data is getting
the appropriate security. Specifically, we will look at
seven methods in which to secure data. Let’s discuss
technical overview into each security mechanism, and
in some cases will provide visual examples of code and
diagrams. Each of these methods will have their
corresponding threats, solutions, advantages, and
disadvantages associated to them. It is important to
know what tools are available when dealing with
threats as well as how to assess risk. Planning for an
attack and minimizing the loss plays a vital role in
security. We will also discuss the basics of disaster
recovery, and the tools available to ensure that a
company’s information is not vulnerable to malicious
behavior from both users and hackers.

167. 167
Also, we will discuss in detail some of the vulnerabilities
that affect database security and how those
vulnerabilities are dealt with in today’s society.
Databases are generally designed to promote open and
flexible access to data. Companies use databases to
dynamically create their websites, and with ever
growing information access it are crucial for businesses
to have strict database access, or specialized client
software to view data. However, the design traits that
make databases so appealing can also be the greatest
vulnerabilities. Various new information procedures
and technology are created daily, and for every new
product and procedure vulnerability arises. It is
important for a company maintaining a database to be
prepared for any threats to their systems, and have
mechanisms in place to mitigate the impact of these
threats in addition to having a disaster recovery system
in place. The topic of database security is very broad,
and entails such things as moral and ethical issues
imposed by society, and legal issues such as how to
protect stored information for loss or unauthorized
access, theft, or destruction.

168. 168
An interesting and relevant situation that affects many
companies and organizations that use databases is:
“Should users in a multiuser database system be
allowed to grant database privileges to other users, and
if they do, what happens to these privileges if the first
user quits or has their own privileges revoked?” A
smaller database would make the issue trivial, as each
user could be traced and revoked as connected to the
source. But how difficult does this process become on a
large hundred or thousand user multi user database
system?
One of the first ideas might be to implement a password
scheme, and allow the creator of the database to
selectively distribute the password to the users that
need specific data privileges. Unfortunately, this method
can be compromised by brute force password guessing,
and in the event of revoking any specific employee or
member’s rights, the password would have to be
changed and redistributed to the list of permitted users.
This is impractical, and a different approach is
necessary.

169. 169
The solution to the authorization problem comes in the
form of two tables in the database, SYSAUTH and
SYSCOLAUTH. SYSAUTH contains the UserID, table
name, and type (whether a table is a relation or view)
along with columns for each grantable privilege such as
read and insert. One specific column worth noting is the
GRANTOPT column that shows if a user is allowed to
grant the privilege to others. Each table that has users
performing actions has up to 2 rows in SYSAUTH- one
for grantable privileges and one for non-grantable
privileges.
In the Update column of SYSAUTH, the value may either
be ALL, NONE, or SOME to indicate which privileges
may be updated. The SYSCOLAUTH indicates which
columns may be updated in the event of the SOME field
being filled. By issuing a grant command, a new row is
inserted into SYSAUTH that records the privileges that
have been transferred.
The REVOKE command is used in order to remove
privileges that have been previously granted. Suddenly,
the two tables of SYSAUTH and SYSCOLAUTH are
insufficient in remembering who has granted each

170. 170
privilege to a user. The immediate and obvious problem
that occurs is when a user that grants a privilege loses
the privilege themselves and the receiver of the
privilege must also be revoked. A further problem is if
that receiving user has been granted the privilege by a
different user- the system must know whether to retain
or remove the privilege.
For the sake of brevity in this topic for the section, the
solution comes in the form of a revocation algorithm
that seeks and checks privileges if they have been
granted by other sources before being removed.
Another part of the solution involves assigning labels to
the grants in order to distinguish and find them on
demand. An authorization module is used to check
whether a user has particular access authorization
before a command is issued.
The issue of managing database permissions and access
rights across users is an important issue in major or
large scale database ventures. As employees or users
often leave the registered area of database usage, access
rights must be revoked for security purposes. This is a
major issue in database security. Users can be granted

171. 171
database access privileges that exceed the requirements
of their job function, these privileges may be abused for
malicious purpose. This is a problem of larger scale
operations where the systems administrators do not
have the time to define and update granular access
privilege control mechanisms for each user, and as a
result, all users or large groups of users are granted
generic default access privileges that far exceed specific
job requirements. There are other problems that extend
to smaller databases as well, however, such as
encryption issues.
DATABASE VIEWS
In addition to the method in granting and revoking user
privileges, there is another layer of security for
database users called views. These views are merely
queries that are assigned to specific users or groups of
users. When a user in one of these restricted groups
queries a database the view dynamically created a
virtual table. The view represents a subset of the data
contained in the base table restricting access, and
limiting the degree of exposure the user gets to the data
depending on their level of access. Rather than creating

172. 172
sub-tables in the database these query based views
provide a level of security and utility to a database. They
can be used to simplify multiple tables into a single
virtual table, or hide the complexity of a database from
users. From a security standpoint an administrator
could easily prevent delicate information from being
viewed or changed, while allowing the intended use of
the tables.
DATABASE ENCRYPTION
No matter what size a database may be, there is a strong
possibility that important information is being stored,
such as credit card information, user credentials for a
sensitive system(online banking), or mass listings of
personal contact information. Placing data into a
database does not make the data safe- it only gives it
space for storage.
Database encryption is a necessity to shield data from
prying eyes that could intercept data transactions
through various spying and intruding techniques. The
encryption is utilized at the Database Management
System (DBMS), and can vary between the different

173. 173
types of DBMS. One well known type of database
encryption is called transparent data encryption (TDE)
and is used by the Oracle DBMS.
Transparent data encryption enforces data-at-rest
encryption in the database layer. It functions as a key-
based access control system using a single master key
that encrypts all encrypted columns. Table keys are
encrypted using the master key, and are stored in a
dictionary table within the database. The master key is
kept in a secure location within an external security
module that only the security administrator may access.
In transparent data encryption, data is taken from the
involved tables as clear text, and goes through the
external security module containing the master key that
encrypts the data into cipher text, which when read,
would give inaccurate symbols and will securely mask
data. The decryption process mirrors the encryption
process, again utilizing the external security module
and the protected master key.
Another method of database encryption focuses on the
multi user database. This method encrypts the entire

174. 174
database and does not provide the
encryption/decryption key to the service provider. This
means that the user must download the tables from the
database and then decrypt them on their own before
being able to utilize the results. The database needs to
function in its encrypted form.
The user queries the encrypted database, which is
executed server-side and returns the encrypted results
for the user to decipher. The database owner may enjoy
the safety of having all their data encrypted while
letting the user client assume the responsibility of
decrypting the query responses.
A systems administrator might want to implement
whole disk encryption on vital information and servers
can help prevent information from being easily readable
in the event of the physical device being stolen weather
it is from a server room, or a company laptop while
traveling. This type of encryption only protects the data
while the device is powered off, once powered on the
device will prompt the user for a decryption key, or
password. Once the password is validated all of the data
on the machine is then available. This method of

175. 175
encryption is highly effective at mitigating theft and
loss, and physical data theft. As with most security there
can be a drawback in terms of speed, and accessibility.
It can take a little longer to write to a disk that has
whole disk encryption implemented. Also if the
password gets lost then the encrypted data is lost with
it.
Database encryption is necessary in the current
technological age where vital and important
information must be protected from malicious users
and thieves. Database encryption is a form of defense
against intrusions, with one example of intrusion being
SQL injection.
SQL INJECTION
The topic of SQL injection is known to many individuals
who specialize in either web programming or security.
SQL injection is an exploit that can read sensitive data
from database, modify database data
(insert/update/delete) execute admin operations on
the database including shutting down the Database
Management Systems (DBMS). The attacks are

176. 176
performed using user input fields within a program on
the web. It can affect any entry fields that require user
input into a database.
An SQL injection attack can involve a system that
extracts information from the input boxes and places
them into queries. This sort of attack can be used to
trick the system and gain access without having proper
information. This problem occurs when software is not
intelligently designed to either parse the input,
removing certain symbols (such as =). SQL injection can
be prevented by parsing out symbols, and
parameterizing queries.
Parameterizing queries is a good coding practice that
programmers should naturally adopt and use when
dealing with database input and queries.
Parameterizing queries requires developers to define all
SQL code before passing in each parameter to the query
at a later point, allowing the database to make a
distinction between code and data, despite whatever
user input was given.

177. 177
An example of parameterized queries in Java would
look something like:
String custname =
request.getParameter("customerName");
// This should REALLY be validated too
// perform input validation to detect
attacks
String query = "SELECT account_balance
FROM user_data WHERE user_name = ? ";
PreparedStatement pstmt =
connection.prepareStatement( query );
pstmt.setString( 1, custname);
ResultSet results =
pstmt.executeQuery( );
(Source: OWASP)
As seen above, the customer name field is
parameterized before entering a dynamically
constructed query. This would successfully protect the
system from an attempted SQL injection attack.

178. 178
Another option in averting SQL injection is the use of
stored procedures. Stored procedures are very similar
to parameterized queries in terms of effectiveness, and
they eliminate the use of dynamically constructed
queries. Stored procedures involve the developer pre-
preparing SQL statements before passing in parameters.
The procedure is stored within the database and then
called by the DBMS, allowing security by not allowing
any tampering with the procedure.
PHYSICAL DATABASE THREATS
While it is important to focus and neutralize virtual
threats on the virtual database system, one must not
forget that the database is physically stored on a server
that can be prone to damage, whether through
intentional malicious behavior, or natural damages
from the elements. This section will address the
physical threats against database security, as well as
counter-measures and prevention tactics that can help
prevent or mitigate physical server damages.
RAID, or Redundant Array of Independent Disks, is a
data management technique that utilizes multiple disks

179. 179
to house data so that if one disk fails, the data will not
be lost without recovery. RAID commonly uses five
different distinctions and each offer unique benefits.
These RAID types are:
1. RAID 0: RAID 0 provides data striping (a process
that spreads out blocks of each file across
multiple disks) and does not contain data
redundancy, improving performance but does
not offer fault tolerance.
2. RAID 1: RAID 1 provides disk mirroring.
3. RAID 3: RAID 3 is similar to RAID 0 however
reserves a dedicated disk for error correction
data, providing good performance and a
moderate level of fault tolerance.
4. RAID 5: RAID 5 allows data striping at the byte
level as well as stripe error correction
information, giving excellent performance and
good fault tolerance.
5. RAID 10: RAID 10 is a combination of RAID 0
and RAID 1.
The RAID system is a good way to protect information
in the event of electrical damage to one or more disk

180. 180
drives, or in the event of data corruption (through
either virus or physical injury). RAID offers trade-offs in
terms of security versus efficiency, as data access times
may become longer depending on how spread out the
data is stored.
In more general ways of protecting information, there
are two techniques that can preserve original data in
the event of failure. Data backup is a standard
procedure of periodically copying the contents of a
database and storing the log file in an offline form of
storage media that can be accessed and copied from if
the original data is lost. Data journaling involves
maintaining a log file (journal) of changes that have
been made to a database to allow for recovery in the
event of failure. Journaling can provide automatic
‘replays’ of previous committed updates in a journal file,
and can identify processes that are active and may be
damaged when the system failed.
DATABASE USERS
Even with all of these security mechanisms and
recovery mechanisms in place it is important that the

181. 181
users of these systems get the proper training needed to
perform their duties in a secure manner. Even at the
database administrator level the admin can
paradoxically pose the greatest risk to information
security. For example, malicious software from poor
browsing habits could compromise the login
information of a database administrator. Security
training is common among most companies of varying
size. It teaches best practice in the industry. Every
company who uses technology is at risk of threats from
the outside. Having an untrained staff can put a
company’s databases and other systems at risk. Security
awareness in the workplace covers many topics
including social engineering, email best practice, secure
password generation, and a number of others.
Employees are the weak link in your network security,
and introducing them to security topics will help
reinforce a business’s first line of defense.
DATABASE SECURITY: CONCLUDING THOUGHTS
It is important for a database administrator of any scale
to know what it is that they are protecting, and why
they are protecting it. Implementing security can be

182. 182
costly, and depending on the methods used can take
away efficiency of the systems in question. It takes a
user time to type in a password, and it takes a system
time to encrypt the data, and depending on the volume
of data being encrypted it could take a long time. Is it
worth the extra time to ensure the data is secure? In
some cases it is worth accepting some risk, because
threats to your database are inevitable. The
implementation of security mechanisms must match the
value of the data. It is also important to know, and
understand the enemy, knowing what threats are
present in the security field and what solutions are
available to a business to prevent these vulnerabilities
can make all the difference. In most cases technology
isn’t the issue - it is the users. They are part of the
solution and a major cause for the problems. Proper
security training and disaster recovery techniques can
ensure that any malicious behavior will not cause long
term damage to a company's integrity.

183. 183
CHAPTER 10. COMPUTER AUDITING
Security auditing is important within businesses to
ensure that sensitive information stored within the
system is kept safe. This should be a very important
consideration to any organization, especially with the
huge developments in computers and related
technologies. Security auditing is the process of
recording, analyzing, and reproducing any or all
security-related events.
To help ensure that organizations have practices in
place to keep their computer systems secure, there are
regulations such as the Sarbanes-Oxley Act as well as
compliance auditing. Compliance is also necessary to
create good relationships with other businesses as well
as customers because they know that a minimum
standard is met.
Auditing aims to keep people on the inside and outside
from gaining access to data that is outside of their
normal viewing capabilities. There are several ways
that this can be tracked, some of which include checking

184. 184
log in attempts, tracking normal use times and
durations, and alerting the security personnel when
someone wanders outside of their prescribed area of
work. (Anderson, 1980)
THREATS
A threat is the possibility that an unauthorized user
could access a system’s information and/or change it. If
an unauthorized user tries to access a system, an attack
has occurred, and if they are successful, then the system
has been penetrated. The possibility that information
could be leaked due to an unknown problem in the
system is a risk. Similarly, a vulnerability is due to a
known problem with the system.
There is always the threat that a computer system may
be attacked. Computer auditing helps us to prevent this
by attempting to detect suspicious or unwanted
behaviors. This could happen by two types of users:
external and internal. An external user is a person who
is not affiliated with an organization or an employee
who does not have computer privileges who tries to
access computer resources. An internal user is someone

185. 185
who has at least some computer privileges and tries to
misuse computer resources.
The biggest threat to an organization’s computer
system comes from the inside. This is a problem
because most computer security systems are not able to
detect misuse from internal users because the system
sees the user as legitimate whether or not it is true.
There are three types of internal users: masquerader,
misfeasor, and clandestine. The masquerader is one
who logs in as another user and pretends to be someone
else. A misfeasor is a legitimate user who misuses the
privileges given to them. And a clandestine user is one
who finds access to supervisory privileges and is able to
escape detection by the system.
To detect a user who is trying to penetrate the system
several measures can be used to identify unwanted
activity. External users may be detected through
unsuccessful attempts to login to the system. To detect
internal users, masqueraders may be found through
comparing use patterns to what is normal by creating
rules for what is considered normal and flagging any
user who breaks any of them. Lastly, a clandestine user

186. 186
may be found through monitoring any changes made to
the auditing system or privileges. Also tracking
computer activity through monitoring CPU, disk and
memory may be useful.
COMPUTER USE
Monitoring computer use is the foundation of a security
audit. Anderson establishes the basic unit of computer
use as a session or job, which is defined by four
parameters. These include the user identifiers, the
program and data files that are accessed, time a job or
session is initiated, and its duration. In some cases, it is
more useful to monitor files, devices, or programs; the
parameters used to monitor this are the user identifiers
and programs that access a particular resource, the
records read and written to, and whether or not a
program is being executed or being read. These audit
logs allow for a statistical analysis of which user
accounts were accessing which system resources, as
well as when and for how long. Once a baseline for
normal use is established, the audit trail enables the
detection of anomalies that could indicate a potential
intrusion.

187. 187
A more modern standard for defining and monitoring
basic computer use is explored in the 1995 NIST
Handbook. As stated in this publication, audit data can
be broken up into two categories: event logs and
keystroke monitoring. Keystroke monitoring is a
powerful tool in limited applications, such as
determining what an intruder inputted into a system
after the fact, or determining when a legitimate user is
misusing the system. Audit trails established by event
logs are sorted into three different categories: system
level trails, which usually monitor items like logons,
timestamps, and accessed resources or applications;
application level trails, which monitor items such as
data files accessed, modifying or reading records, or
printing; and user trails, which monitor items such as
direct user commands, accessed files and resources, and
logon or authentication attempts.
SURVEILLANCE
Collecting audit data to monitor computer use is merely
the first step in Anderson’s proposed form of
surveillance. The data analysis is what allows the audit
data to be useful. A pattern of normal behavior can be

188. 188
established by compiling audit data on individual users
or on user sets. Anderson suggested that determining
baseline behavior is more useful when gathered from
user sets, because the presumption is that the session or
job referring to the same file sets can be considered to
belong to the same population and similar statistical
properties. With normal use established, individual user
audit trails can be analyzed for deviation from that
norm. Deviations can either be determined by
predetermined criteria of abnormal use (i.e. arbitrary
deviations), or they can be discovered when data for a
given parameter is too far outside the average value for
the parameter -- determined by the standard deviation
and the mean.
Once the idea of using audit data to detect abnormal
and possibly dangerous behavior became an accepted
security tool, people began to look for a better way to
implement such analysis. Early audit data analysis was
cumbersome due to the large amount of raw data and
the lack of automated systems to sift through the
information, and couldn’t detect problems in real time.
Much of the analysis had to be done by the system’s

189. 189
security officer, whose job was to flip through huge
printouts of audit trails looking for problem areas. The
quantities of data were too big for a human to
effectively process, especially since most of the data was
collected for accounting purposes rather than security.
This problem spawned a great deal of research into
what would come to be called intrusion detection
systems (IDS), which continuously monitor data to
detect problems in real time.
SYSTEM DESIGN
Essentially, there are the main parts of a computer
auditing system: a security surveillance subsystem and
trace subsystem. The surveillance subsystem looked for
unwanted or abnormal behaviors and returns reports
based on what was found. The trace subsystem allows
one to search a user’s activity based on a given
timeframe. These functionalities continue to be present
in intrusion detection systems.
Computer auditing techniques generally fall under two
categories: intrusion detection systems (IDS) and
intrusion prevention systems (IPS). An intrusion

190. 190
detection system is designed to detect unusual activity
and/or suspicious packets on the network. An intrusion
prevention system, on the other hand, is supposed to
detect and block unusual activities. This may be done
through combining IDS with a firewall. A firewalls job is
to stop data that could be harmful to the system.
While there is a great deal of variety in how various
intrusion detection systems work, there are some
elements of design that are common to most of them.
The process of intrusion detection begins with the
collection of audit data, which is stored prior to
processing. The processing step is the major detection
step, when the IDS actively analyze the audit data, using
whatever detection strategy is implemented in the
system. In systems with multiple detection strategies,
there are independent processing elements for each.
The configuration data is how the IDS are controlled,
determining items such as what data is analyzed and
what kind of response is made to detected problems.
The reference data is where the system holds items
such as normal use profiles and intrusion signatures,
and is what the processing references to determine if

191. 191
something is a problem. The active/processing data is
the data currently being processed at any given time.
The alarm is the part of the system that reports the
results of the processing stage to the relevant parties.
INITIAL DEVELOPMENT
Implementation of the idea of using audit trails as a
security tool began in the early 80’s. In ‘83, Dr. Denning
and SRI International worked on a project that analyzed
audit data from government computers to create user
activity profiles, which subsequently led to both SRI’s
development of the first functional IDS, called IDES, and
to the publication of Dr. Denning’s “An Intrusion
Detection Model”, which became a basis for ID.
IDES (Intrusion-Detection Expert System) was designed
with the goal of providing real-time monitoring and
analysis to detect potential problems immediately,
using pre-established rules of automatically suspicious
behavior as well as abnormal behavior detection. The
IDES model is composed of the following components:
1. Types of information and their positions in the
audit record must be known in advance so that

192. 192
information is processed properly by the
intrusion detection mechanism.
2. Profiles: Profiles are used to characterize
expected normal behavior on a computer
system. Typical types of information in these
profiles are login activity and file access.
3. Anomaly records: Alarms that are created
whenever certain behavior that is observed does
not match the profiles.
4. Activity rules: These are programs that describe
what action should be taken when an alarm is
triggered.
A significant weakness of the early intrusion detection
systems was that, as observed with the Haystack
project, “there [were] very few known recorded
instances of system penetration; most scenarios used
for testing have been generated by software developers
based on their own understanding of system
weaknesses”, making the accuracy and effectiveness of
early systems difficult to determine.
COMMERCIAL EXPANSION

193. 193
Marking the beginning of the commercial expansion
period was the commercial release of Stalker in 1989,
which was an incarnation of the military IDS Haystack.
Haystack was designed “to reduce enormous quantities
of generally obscure audit data to short summaries of
interpreted information for further investigation”;
unlike IDES, it did not provide real time analysis.
Several other systems, such as the Computer Misuse
Detection System (CMDS) and the Automated Security
Measurement System (ASIM), were released in the early
90’s, and the growing number of viable systems led to
the commercial success of the intrusion detection
market in the late 90’s, which in turn led to rapid
growth in the field.
This period of growth developed concurrently with
research into new systems and methods of data
analysis. One such idea was the application of early
artificial intelligence to learn sequential patterns of user
behavior that appear erratic to standard statistical
analysis and develop more accurate rules about
suspicious behavior. Another route of investigation was
the use of neural networks, which have more flexibility

194. 194
than the rules-based expert model used by IDES or the
standard statistical analysis method in developing in
creating user profiles. Model based reasoning, i.e. using
models of predicted intrusive behavior to predict which
pieces of audit data are relevant to which suspicious
actions, was another avenue being explored in the early
90’s.
MODERN TECHNIQUES
Intrusion detection systems are now a staple of
computer security, and have a wide variety of
classifications and detection techniques. There are two
general ways of classifying IDS: by location (host-based
vs. network-based) or by general detection philosophy
(signature-based vs. anomaly-based). Within these
categories are subspecies of IDS made distinct by their
intrusion detection paradigms.
One of the broadest ways of categorizing modern
intrusion detection systems is by their location: an IDS
is either host-based, in which the system monitors a
single computer (the host), network-based, in which the
system monitors network traffic within a network, or a

195. 195
composite, in which both network-based or host-based
monitoring is used. Host-based systems have the
advantage of providing more personalized protection
and provide more information on the effects of an
attack, but require more storage, are not easily ported
between computers, and must wait until a computer is
infected to detect an attack. Network-based systems
have the advantage of early detection, space efficiency,
and security, because they only have one instance
within the network and can prevent intrusions before
they reach computers within the network.
Signature-based detection is the current commercial
staple for IDS. They use a library of known malicious
traits, i.e. signatures, that are then compared to the
packets, programs, or files that a computer or network
is accessing. Poston notes that the advantages for such
systems include "the relative ease of creation, low false
positive ratio, [and] absolute identification", plus the
monetary rewards for creators from users needing to
buy constant library updates. Disadvantages include the
amount of memory they use, constant updating, and
vulnerabilities to undiscovered malware. The four

196. 196
primary signature-based techniques include pattern
matching, which look for specific sequences, stateful
pattern matching, which use the same fixed sequences
but allow the sequences to be broken up between
packets, protocol-decode based analysis, which has a
list of function protocols that are checked for violations,
or contextual signatures, which use data from
attempted attacks to determine the nature of the
attacker.
Anomaly-based detection, while predominantly only
used for research, has many advantages, and a wide
variety of implementations. Anomaly-based IDS uses a
profile of what is normal for a system or computer and
flags items that don't fit within that profile, providing a
system with greater flexibility, less memory space, and
better responses to new threats. Unfortunately,
accurate profiles, false positives, and a lack of certainty
are a problem with these systems. The modern
anomaly-based detection techniques Poston discusses
can be summarized as followed:

197. 197
1. Cluster Analysis: This uses predetermined
attributes to group data based on similarities of
those attributes.
2. Stepping Stone Analysis: This assumes
hackers are using a chain of computers, and
analyzes the time delays between requests and
replies.
3. Statistical Analysis: Suspicious actions are
given a weight, as a computer operates, and the
total weight of suspicion is calculated and
compared to a threshold.
4. Non-Stationary Models: This is an expansion
of statistical analysis that uses assumptions on
the probability of an action occurring, based on
time elapsed since the last time the action was
performed.
5. Heuristic-Based Analysis: This uses algorithms
to determine if a set of actions indicates that the
system is currently being attacked.
6. Neural Networks: This uses a web linking
normal events to other likely events, and flags
sequences that don't fit within that web.

198. 198
7. Entropy-Based Analysis: This analyzes how
uniform a data set (actions, packets, etc.) is,
recalculating with each new item, and flagging
the ones that are not uniform.
8. Genetic Algorithm/Immune-based Analysis:
This technique mimics a biological immune
system that uses sets of positive and negative
detectors to determine abnormal use of the
system.
CONCLUSION
As we have seen there are many different ways that a
system can be compromised by unauthorized users.
There are also many techniques that have been to
prevent this as well as regulations in place to create a
minimum standard for organizations to adhere to.
Progress in the field continues to propose new solutions
that solve known weakness in the current approaches
and develops new tools to implement those solutions.

199. 199
SUMMARY
As noted in the introduction, this book was written in a
broad manner as a primer. This brief guide was to help
introduce InfoSec topics and (hopefully) will be the
doorway to future studies for the CISSP, CISM or CCNA-
Security realms. As a primer to InfoSec, this eBook does
cover many (not all) of the CISSP, CISM and CCNA-
Security aspects and also discusses many Information
Security (InfoSec) topics in general. Following this, you
should be well versed and prepared to dive into more
detailed InfoSec work.
If you are considering certification, my recommendation
is to get the Certification Vendor’s suggested book (for
example, if you plan on taking the CCNA-Security test,
get the Cisco book). Also, consider purchasing a test
engine with frequent downloads. While you can get
copies of tests for various certs online for free, many
have errors or some tests were completed with errors.
You don’t need to study errors ☺

200. 200
Good luck to you. And, if by chance I’ve made an error
or if a particular topic needs clarification or expansion,
please let me know. My plan, especially since this is an
eBook, is to provide continuous improvements to this
work.
Thank you, Ron

201. 201
REFERENCES
Anderson, J. P. (1980). Computer security threat
monitoring and surveillance.
Andress, J. (2011). Operating System Security. The
Basics of Information Security (pp. 131-145).
Waltham: Syngress.
Ayushi. (2010). A Symmetric Key Cryptographic
Algorithm. International Journal of Computer
Applications, 1(15). Retrieved November 10,
2013, from
http://www.ijcaonline.org/journal/number15/p
xc387502.pdf
Bhuyan, M. H., Bhattacharyya, D. K., & Kalitaya, J. K.
(2013). Detecting distributed denial of service
attacks: Methods, tools and future directions. The
Computer Journal, 56(12), 31-52.
Biermann, E., Cloete, E., & Venter, L. M. (2001). A
comparison of intrusion detection systems.
Computers & Security, 20(8), 676-683.

202. 202
Blaze, A., Diffie, W., et al. (1995) Minimal Key Lengths
for Symmetric Ciphers to Provide Adequate
Commercial Security.
Chang, R. (2002, Oct). Defending against flooding-based
DDoS attacks. IEEE Communications Magazine.
Douligeris, C., & Mitrokotsa, A. (2003). DDoS attacks and
defense mechanisms: Classification and state-of-
the-art. Computer Networks, 44(5), 643-666.
Fulvio, R. (2007). Kerberos Protocol Tutorial. Retrieved
December 2013 from
http://www.kerberos.org/software/tutorial.htm
l
Griffiths, P., Wade, B, (1976). An Authorization
Mechanism for a Relational Database System.
ACM Transactions on Database Systems (TODS),
3(1), 242 - 255.
Group, Lark. (2003, 17 Oct). Secure SQL Server:
Encryption and SQL injection attacks.
TechRepublic. Retrieved from
http://www.techrepublic.com/article/secure-
sql-server-encryption-and-sql-injection-attacks/

203. 203
Guttman, B., & Roback, E. A. (1995). An introduction to
computer security: the NIST handbook. DIANE
Publishing.
Harrison, O. & Waldron, J. (2008). Practical Symmetric
Key Cryptography on Modern Graphics
Hardware. In USENIX Security Symposium.
Innella, P. (2001). The evolution of intrusion detection
systems. SecurityFocus–2001.
Jiang, X., & Solihin, Y. (2011). Architectural Framework
for Supporting Operating System
Levine, J. (2004). A methodology to characterize kernel
level rook it exploits that overwrite the system call
table. Published manuscript, School of Electrical
and Computer Engineering, Georgia Institute of
Technology, Atlanta, Georgia, Retrieved from
http://users.ece.gatech.edu/owen/Research/Co
nference Publications/levine_secon04.pdf
Liu, J., Wang, X., Jiao, D., Wang, C. (2012). Research and
design of security audit system for compliance.
International Symposium on Information
Technology in Medicine and Education, 2, 905-
909.

204. 204
Lunt, T. F. (1988). Automated audit trail analysis and
intrusion detection: A survey. In In Proceedings
of the 11th National Computer Security
Conference.
Lunt, T. F. (1993). A survey of intrusion detection
techniques. Computers & Security, 12(4), 405-
418.
Loscocco, P., & Smalley, S. (2001). Integrating Flexible
Support for Security Policies into the Linux
Operating System. USENIX ATC, 2001, 1-62.
Retrieved December 2, 2013, from the USENIX
database.
Lupescu, G. (2013). Accelerating Encryption Using
Commodity Hardware. Retrieved
from:https://koala.cs.pub.ro/redmine/attachem
ents/download/1775/Prezentare_Lupec_Grigor
e_R1.pdf
Mahajan, D., & Sachdeva, M. (2013). DDoS attack
prevention and mitigation techniques.
International Journal of Computer Applications,
67(19).
Malayeri, A., & Abdollahi, J. (2009). Modern Symmetric
Cryptography methodologies and its

205. 205
applications. CoRR, 1092. Retrieved November
2013, from http://arxiv.org/pdf/0912.1092.pdf
Maniscalchi, Jag (2012). “The Benefits of Full Disk
Encryption.” DIGITALTHREAT. Received from
http://www.digitalthreat.net/2012/01/the-
benefits-of-full-disk-encryption/
Mirkovic, J., Prier, G., & Reiher, P. (2002). Attacking
DDoS at the source. Network Protocols, 312-321.
doi: 10.1109/ICNP.2002.1181418
Natarajan, Ramesh. (2010, Aug 10). “RAID 0, RAID 1,
RAID 5, RAID 10 Explained with Diagrams.” The
Geek Stuff. Retrieved from
http://www.thegeekstuff.com/2010/08/raid-
levels-tutorial/
Neustar. (2013). 2012 annual DDoS attack and impact
survey. Retrieved from
http://www.neustar.biz/enterprise/resources/
DDoS-protection/2012-DDoS-attacks-report
Neves, S. (2009) Cryptography in GPUs. (Master’s
thesis). Retrieved from
http://eden.dei.uc.pt/~sneves/pubs/
Oracle Database Advanced Security Administrator’s
Guide. (2012). Oracle. Retrieved from

206. 206
http://docs.oracle.com/cd/B19306_01/network.
102/b14268/asotrans.htm
Poston III, H. E (2012). A Brief Taxonomy of Intrusion
Detection Strategies. In Aerospace and
Electronics Conference (NAECON), 2012 IEEE
National (pp.255-263). IEEE.
Provos, N. (2003). Improving Host Security with System
Call Policies. USENIX Security Symposium, 12, 1-
30. Retrieved December 2, 2013, from the
USENIX database.
Saroiu, S. (2004). Measurement and analysis of spyware
in a university environment. (Master's thesis,
University of Washington)Retrieved from
http://static.usenix.org/events/nsdi0/tech/full_
papers/saroiu/saroiu_html/
Shulman, Michal (2006). “Top Ten Database Security
Threats.” Imperva, Inc.
Smaha, S. E. (1988, December). Haystack: An intrusion
detection system. In Aerospace Computer
Security Applications Conference, 1988, Fourth
(pp. 37-44). IEEE.

207. 207
Stallings, William & Brown, Lawrie, (2012). Computer
Security: Principles and Practice. New Jersey:
Pearson.
Szor, P. (2013). The art of computer virus research and
defense. In P. Szor (Ed.), The process of computer
virus analysis. Retrieved from
http://computervirus.uw.hu/ch15lev1sec4.html
Tariq, U., Malik, Y., Abdulrazak, B., & Hong, M. (2011).
Collaborative peer-to-peer defense mechanism
for DDoS attacks. Science Direct: Procedia
Computer Science, 5, 157-164.
Teng, H. S., Chen, K., & Lu, S. C. (1990, May). Security
audit trail analysis using inductively generated
predictive rules. In Artificial Intelligence
Applications, 1990, Sixth Conference on (pp. 24-
29). IEEE.
Thimbleby, H. (1999). A framework for modeling
Trojans and computer virus infection. Computer
Journal, (41), 444-458. Retrieved from
http://www-
users.cs.york.ac.uk/~pcairns/papers/Modelling
Trojans.pdf

208. 208
Todd, R. 2013, Fed 28. 12 types of DDoS attacks used by
hackers. Retrieved from
http://blog.rivalhost.com/12-types-of-DDoS-
attacks-used-by-hackers/
Trappe, W. (n.d.). Symmetric Cryptography:DES and RC4.
Unpublished Lecture Slides. Electrical and
Computer Engineering Department, Rutgers
University, New Brunswick, New Jersey United
States Department of Commerce (2001)
Advanced Encryption Standard(AES) (FIPS 197).
Retrieved November 2013, from
http://csrc.nist.gov/publications/fips/fips197/fi
ps-197.pdf
Qijun, G., & Peng, L. (n.d.). Denial of service attacks.
Unpublished manuscript, School of Information
Sciences and Technology, Pennsylvania State
University, University Park, PA, Retrieved from
http://s2.ist.psu.edu/paper/DDoS-Chap-Gu-
June-07.pdf
United States Department of Commerce (1999) Data
Encryption Standard(DES). (FIPS 46-3).
Retrieved November 2013, from

209. 209
http://csrc.nist.gov/publications/fips/fips46-
3/fips46-3.pdf
Vaccaro, H.S., Liepins, G.E. (1989) Detection of
anomalous computer session activity. IEEE
Symposium on Security and Privacy, 280-289.
Wing, W. (2004). Analysis and detection of metamorphic
computer viruses. (Master's thesis, San Jose State
University)Retrieved from
http://www.cs.sjsu.edu/faculty/stamp/students
/Report.pdf
Wood, C. (2011, July) Chaos-Based Symmetric Key
Cryptosystems. Paper presented at Rochester
Institute of Technology Symposium, Rochester,
New York.
Yang, J. , & Goodman, J. (2007, December). Symmetric
Key Cryptography on Modern Graphics
Hardware. AsiaCrypt 2007. Lecture conducted at
International Association for Cryptographic
Research, Kuching, Sarawak, Malaysia.
Yuan, J., & Mills, K. (2005). Monitoring the macroscopic
effect of DDoS flooding attacks. IEEE
Transactions on Dependable and Secure
Computin, 2(4).

210. 210
Zhang, X., Li, C., Zheng, W. (2004) Intrusion prevention
system design. The Fourth International
Conference on Computer and Information
Technology, 386-390. Guide to the Secure
Configuration of Red Hat Enterprise Linux 5.
(n.d.). National Security Agency. Retrieved
December 2, 2013, from

211. 211
ABOUT THE AUTHOR
Ron McFarland is a dedicated writer. He has written
for academic and technical journals. He has also
written several Information Technology books for
students of Information Technology, Computer
Security, and Computer Forensics. Additionally, he
has served as a technical editor for several technical
book publishers.
Most importantly, because of Ron’s love of the written
word, he has written hundreds of poems (several of
which are published in this book) and several short
stories.
His blogs (technical and fiction/poetry writings) are:
• Poetry and brief prose:
http://www.cowboyhaiku.com
• Fiction Writing (short stories, etc.):
http://www.rottonronnie.com
• A contemporary discussion of the Spirit:
http://www.buddahcat.com

212. 212
• Information Technology, Information Security,
and Digital Forensics articles, eBooks, etc.:
http://www.wrinkledbrain.com
Please stop by, read and comment. He would love to
hear from you.

213. 213
OTHER BOOKS BY RON MCFARLAND
TECHNICAL BOOKS
• How to start a Computer Forensics Business:
A Small Business Success Guide:
http://amzn.to/2gZEjwR
• Information Security Basics: Fundamental
Reading for InfoSec Including the CISSP,
CISM, CCNA-Security Certification Exams:
http://amzn.to/2gTCcMk
• Introduction to Software Development: A
Prelude to Creating Applications:
http://amzn.to/2glZSbg
• Personal Information Security: An Introduction
for the Individual and Small Business Owner:
http://amzn.to/2gA63Ls
• An Introduction to Using BitCoin and other
eCoin Options: The Revolution of Electronic
Currencies: http://amzn.to/2gTCNNV
• How to Create a Makerspace: A Real-World
Case-Study: http://amzn.to/2iiKmxG
FICTION, NON-FICTION AND POETRY BOOKS

214. 214
• Happy, I am: Lessons from a Near Death
Experience: http://amzn.to/2gNmhyK
• Love and Silence: Selected poems of Ron
McFarland: http://amzn.to/2gzUnse

215. 215
One Last Thing...
If you enjoyed this book or found it useful I’d be very
grateful if you’d post a short review on Amazon. Your
support really does make a difference and I read all
the reviews personally so I can get your feedback and
make this book even better.
If you’d like to leave a review, then all you need to do
is click the review link on this book’s page on Amazon
here: http://amzn.to/2h5R5hl
Thanks again for your support!