The document provides an introduction to network security. It discusses common network threats like viruses, worms and trojan horses. It defines key security terminology related to hackers, attacks and security devices. It also examines different approaches to securing a network, including perimeter security, layered security and taking either proactive or reactive measures.

1. Introduction to Computer Security
INTRODUCTION TO NETWORK SECURITY
lOMoARcPSD|21360071

2. Contents
 Introduction
 The Basics of a Network
 Understanding Security Terminology
 Approaching Network Security
lOMoARcPSD|21360071

3. Introduction
 The growth of the Internet has brought many ways in which
networks can be compromised and data stolen.
 Legislators are working to prevent identity theft and ways
to reduce the effects of viruses and worms such as
MyDoom, MSBlaster, and others.
lOMoARcPSD|21360071

4. The Basics of a Network
 You need to understand the following:
 Basic network structure
 Data packets
 What does this mean for security?
lOMoARcPSD|21360071

5. Basic Network Structure
 The fundamental purpose of networks is for communication
 Part of the network structure includes:
 NICs, hubs, switches, routers, and firewalls
 Network architecture comprises the format in which these
devices are connected
lOMoARcPSD|21360071

6. Data Packets
 This is the package that holds the data and
transmission information
 IP data packets have a header containing an
IP address of origin and destination IP
address
 Ultimately formatted in binary
 Size ranges between 32 and 65,000 bytes
 Information included in packets:
 Source and destination (IPAddress) information
 Packet size (in bytes) and type (e.g. Ethernet)
 Data and other header information
lOMoARcPSD|21360071

7. Ethernet - is a family of wired computer networking technologies
commonly used in
• local area networks (LAN),
• metropolitan area networks (MAN)
• and wide area networks (WAN).

8. What Does This Mean for Security?
 There are two points of attack:
 The data packet itself
 The devices that connect the network
 These are also the points of security
 Protect the data (encryption)
 Secure the network devices
lOMoARcPSD|21360071

9. Encryption- websites that transmit credit card and bank
account numbers encrypt this information to prevent identity
theft and fraud.

10. Assessing Likely Threats to the Network
 There are two perspectives in relation to security:
 First, there is no real threat
 Second, all hackers are experts and out to break into my network
lOMoARcPSD|21360071

11. Assessing Likely Threats to the Network cont.
 No real threat:
 Fosters a laissez-faire attitude toward security
 Promotes a reactive approach to security
 Security measures are not put in place until after a breach has
occurred
 This approach must be avoided at all costs
lOMoARcPSD|21360071

12. Assessing Likely Threats to the Network cont.
 Expert hackers out to get me?
 Yes, they exist, but not to the extent publicized
 Lesser skilled hackers are more pervasive ( Widespread,
common).
 These target smaller companies
 Usually experts seek high profile networks
 Financial and ideological gain are the targets
lOMoARcPSD|21360071

13. Assessing Likely Threats to the Network cont.
 The only practical approach is the realistic one
 This approach is a moderate solution to the two extremes
 Assessment is a complex task
 Many factors need to be addressed
lOMoARcPSD|21360071

14. Classifications of Threats
 Attacks can be classified by function:
 Intrusion
 Blocking
 Malware
lOMoARcPSD|21360071

15. Classifications of Threats cont.
lOMoARcPSD|21360071

16. Intrusion-type Attacks on Security
 Intrusion
 Gain unauthorized access to a system through a breach in the security of that
network or machine on the network.
 Blocking
 Prohibit legitimate traffic or access to the network resources. (e.g. DoS,
DDoS)
 Malware
 Software with a malicious intent that is installed on a machine includes all
viruses, worms, trojan horses, etc. This is the most common threat.
lOMoARcPSD|21360071

17. Intrusion-type Attacks on Security
 Social engineering
 A broad range of malicious activities accomplished through
human interactions such as phishing.
 Phishing is a type of social engineering attack often used to
steal user data, including login credentials and credit card
numbers.
 War-dialing
 Occurs when an attacker systematically calls a
sequence of phone numbers in order to find an
inadequately protected system on a modem.
 War-driving
 Attackers who wander through areas searching for wireless
capabilities
lOMoARcPSD|21360071

18. Malware
 Additional discussion is needed:
 Viruses
 A program that can damage computer system and self- replicated with human
assistance
 Worms
 A type of virus that is a malicious, self-replicating program that can spread
throughout a network without human assistance
 Trojan horses
 A program that looks benign but actually has a malicious purpose.
lOMoARcPSD|21360071

19. Malware
 Additional discussion is needed:
 Adware
 Advertising-supported malware, is a term used to describe unwanted
software that displays advertisements on your device
 Spyware
 Spyware can be as simple as a cookie used by a website to record a few brief
facts about your visit to that website, e.g. Cookies, Key loggers
 Spyware is software with malicious behavior that aims to gather information
about a person or organization and send it to another entity in a way that harms
the user—for example, by violating their privacy or endangering their device's
security.
lOMoARcPSD|21360071

20. Blocking-type Attacks
 Denial-of-Service (DoS)
 An attack meant to shut down a machine or network, making it
inaccessible to its intended users and it can be accomplished this by
flooding the target with traffic or sending it information that triggers a
crash.
 A denial-of-service (DoS) is a form of cyberattack that prevents
legitimate users from accessing a computer or network
 Dynamic Denial of Service
 Occurs when multiple systems attacked by DoS and sometimes
called Distributed DoS
 The different types of cyber-attacks are malware attack, password
attack, phishing attack, and SQL injection attack.
lOMoARcPSD|21360071

21. Likely Attacks
 Administrators should ask:
 What are the realistic dangers?
 What are the most likely attacks for our network?
 What are some common vulnerabilities?
 What is the likelihood of an attack?
lOMoARcPSD|21360071

22. Threat Assessment
 Three factors to consider:
 Attractiveness of the system (discussed earlier)
 The nature of the information on the system
 Traffic to the system (security devices in place)
lOMoARcPSD|21360071

23. Understanding Security Terminology
 Hacking terminology
 Security terminology
lOMoARcPSD|21360071

24. Understanding Security Terminology cont.
 Hacking terminology (people & activity)
 White hat hackers
 Often referred to as ethical hackers
 Specializes in ethical hacking tools, techniques, and methodologies to secure
an organization’s information systems.
 Black hat hackers
 Individual who attempts to gain unauthorized entry into a system or network to
exploit them for malicious reasons
 Does not have any permission or authority to compromise their
targets
lOMoARcPSD|21360071

25. Understanding Security Terminology cont.
 Hacking terminology (people & activity)
 Gray hat hackers
 Grey hats exploit networks and computer systems in the way that black hats do
but do so without any malicious intent.
 Often, a gray hat's real intention is to show off their skills and gain publicity
maybe even appreciation or what they consider a contribution to cybersecurity.
 Script kiddy
 A script kiddie (also known as a skid or skiddie) is an unskilled hacker who
breaks into computer systems by using automated tools written by others
(usually by other black hat hackers).
 Often a script kiddie will use these programs without even knowing how they
work or what they do. For example, imagine a child gets their first computer.
The child watches a movie about hacking and then downloads a copy of
Kali Linux. They begin playing with the various programs while searching for
online tutorials.
lOMoARcPSD|21360071

26. Understanding Security Terminology cont.
 Hacking terminology (people & activity)
 Cracker
 A hacker who intend to crack down the system usually password.
 Jailbreaking is a common example of cracking. Jailbreaking removes
restrictions a manufacturer sets in the phone's software. By bypassing the
restrictions, the user can perform more advanced functions on the phone or
use it on a different network.
 Phreaking
 An individual fascinated by the telephone system.
 Commonly, an individual who uses his knowledge of the telephone system to
make calls at the expense of another.
 For example, a phreaking attack may involve getting free long-distance calls,
gaining unauthorized access to phone networks, and creating hidden group
calls on the network's infrastructure.
lOMoARcPSD|21360071

27. Understanding Security Terminology cont.
 Security terminology (devices & policies)
 Firewall
 A firewall is a barrier between a network and the outside world. Sometimes a
firewall takes the form of a standalone server, sometimes a router, and
sometimes software running on a machine
 Proxy server
 Security device used with a firewall to hide the internal network’s IP address
and present a single IP address (its own) to the outside world.
 Some proxy servers are a group of applications or servers that block common
internet services. For example, an HTTP proxy intercepts web access, and an
SMTP proxy intercepts email.
lOMoARcPSD|21360071

28. Understanding Security Terminology cont.
 Security terminology (devices & policies)
 Intrusion-detection system
 IDS simply monitors traffic, looking for suspicious activity that might indicate an
attempted intrusion.
 Once an attack is identified or abnormal behavior is observed, the alert can be
sent to the administrator. An example of a NIDS is installing it on the subnet
where firewalls are located in order to see if someone is trying to crack the
firewall.
 Authentication
 The process of determining if the credentials given by a user or another system
(such as a username and password) are authorized to access the network
resource
 For example, a server would authenticate users using its own password system,
login IDs, or usernames and passwords.
lOMoARcPSD|21360071

29. Understanding Security Terminology cont.
 Security terminology (devices & policies)
 Auditing
 The process of reviewing logs, records, and procedures to determine if these
items meet standards.
 Examples of auditing evidence include bank accounts, management accounts,
payrolls, bank statements, invoices, and receipts.
lOMoARcPSD|21360071

30. Approaching Network Security
 Perimeter security approach
 Focus is on perimeter devices such as firewalls, proxy servers,
password policies, but network may still be vulnerable while the border
of the network is secured.
 Layered security approach
 Perimeter is secured and selected systems within the network are
also secured.
lOMoARcPSD|21360071

31. Approaching Network Security
 Proactive (dynamic)
 A dynamic or proactive defence is one in which steps are taken to
prevent attacks before they occur.
 Reactive (passive)
 A passive security approach takes few or no steps to prevent an
attack.
 Hybrid approach
 Encompasses multiple security paradigms that overlap or are
combined to tighten security.
lOMoARcPSD|21360071

32. Approaching Network Security cont.
lOMoARcPSD|21360071

33. Summary
 Most common dangers to networks:
 Viruses, worms, trojan horses
 Basic security terminology:
 Hacking terms: deal with people and activities
 Security terms: deal with devices and policies
lOMoARcPSD|21360071

34. Summary cont.
 Approaches to securing your network:
 Proactive vs. reactive
 Perimeter: focus is on perimeter devices, internal devices are still
vulnerable
 Layered: focus includes both perimeter and individual
computers within the network
 Hybrid: combination of multiple security paradigms
lOMoARcPSD|21360071