Drivers for Network Security

1
Drivers for Network Security
Network Security Professionals

2
Network Security Organizations
Network Security Organizations

 Three of the more well-established network security organizations are:

• Computer Emergency Response Team (CERT)
• SysAdmin, Audit, Network, Security (SANS) Institute
• International Information Systems Security Certification Consortium (pronounce
(ISC)2 as "I-S-C-squared")
 Cisco also has the Security Intelligence Operations (SIO)

3
Network Security Organizations
SANS Institute

4
Network Security Organizations
CERT

5
Network Security Organizations
CERT Cont.

6
Domains of Network Security
Network Security Domains

7
Domains of Network Security
Network Security Domains Cont.

• Domains provide an organized framework to facilitate

learning about network security.
 ISO/IEC 27002 specifies 12 network security domains.
• These 12 domains serve to organize (at a high level) the vast
realm of information under the umbrella of network security.
• The 12 domains are intended to serve as a common basis for
developing organizational security standards and effective security
management practices, and to help build confidence in inter-
organizational activities.

8
Domains of Network Security
Security Policy

 One of the most important

domains is the security
policy domain.
 A security policy is a formal
statement of the rules by
which people must abide
who are given access to
the technology and
information assets of an
organization.

9
Network Security Policies
Network Security Policy
The network security policy outlines rules for network access, determines
how policies are enforced, and describes the basic architecture of the
organization’s network security environment.

10
Network Security Policies
Cisco SecureX
The Cisco SecureX architecture is
designed to provide effective security for
any user, using any device, from any
location, and at any time.

Security architecture uses a higher-level

policy language that takes into account
the full context of a situation the who,
what, where, when, and how.

With highly distributed security policy

enforcement, security is pushed closer to
where the end user is working.

11
Network Security Policies
Network Security Policy Objectives

12
Viruses, Worms, and Trojan Horses

13
Viruses
Primary Vulnerabilities for End User Devices

A virus is malicious software that is

attached to another program to execute a
particular unwanted function on a user’s
workstation.

A worm executes arbitrary code and

installs copies of itself in the infected
computer’s memory, which infects other
hosts.

A Trojan horse is different only in that the

entire application was written to look like
something else, when, in fact, it is an
attack tool.
14
Computer Virus

A computer virus is a type of malicious code that attaches

itself to clean files and spreads throughout a computer
system, infecting files with malicious code.

Requires a host program or file to spread Modifies

other files or programs
Key Characteristics Can self-replicate
Activates when infected file is executed

Boot Sector Virus: Infects the boot sector of storage

devices
File Virus: Attaches to executable files
Common Types Macro Virus: Infects documents with macro code
Polymorphic Virus: Changes its code to avoid
detection

Slow computer performance Unexpected file

Symptoms modifications Corrupted files
Strange behavior of applications

15
Computer Worm

A computer worm is a standalone malware that replicates itself to spread to other computers through
network connections, without requiring a host program.

 Key Characteristics
 Self-replicating without host files Spreads through
network connections Can operate independently
 Often exploits network vulnerabilities

 Common Types
 Email Worms: Spread through email attachments Network
Worms: Exploit network vulnerabilities IRC Worms: Spread
through chat channels
 File-sharing Worms: Propagate through P2P networks

 Impact
 Network bandwidth consumption System slowdown
 Resource depletion Network congestion

16
 A Trojan Horse is malware that disguises
Trojan Horse itself as legitimate software to trick users into
installing iit butperforms malicious actions in
the background.
• Key Characteristics
• Appears legitimate Cannot self-replicate
• Requires user action to install Often used for backdoor
access

Common Types

• Remote Access Trojans (RATs): Provide

unauthorized remote access
• Banking Trojans: Steal financial information
Backdoor Trojans: Create system vulnerabilities
Downloader Trojans: Download additional malware
• Common Actions
• Data theft Keylogging Creating backdoors
• Disabling security software

17
Prevention and Protection
Technical Measures Best Practices
 Don't open suspicious  Install antivirus software
emails  Keep systems updated
 Avoid untrusted  Use firewall protection
downloads
 Regular system scans
 Use strong passwords
 Network monitoring
 Regular backups
 Security awareness

18
Quick Comparison

19
Viruses
Comparison of a Human Virus and a
Computer Virus

20
Worms
Worms Characteristics
 Worms are a particularly
dangerous type of hostile
code.
• They replicate themselves by
independently exploiting
vulnerabilities in networks.
• Worms usually slow down
networks.
 Worms do not require user
intervention, and can spread
extremely fast over the
network.

21
Worms
Worm Components
 Enabling vulnerability
• A worm installs itself using an exploit vector on a vulnerable
system.
 Propagation mechanism
• After gaining access to devices, a worm replicates and selects new
targets.
 Payload
• When the device is infected with a worm, the attacker has access
to the host, often as a privileged user.
• Attackers could use a local exploit to escalate their privilege level to
administrator.

22
Worm and Virus Exploit and Comparison
 Probe phase:
• Vulnerable targets are identified using ping scans.
• Application scans are used to identify operating systems and vulnerable
software.
• Hackers obtain passwords using social engineering, dictionary attack, brute-
force, or network sniffing.
 Penetrate phase:
• Exploit code is transferred to the vulnerable target.
• Goal is to get the target to execute the exploit code through an attack vector,
such as a buffer overflow, ActiveX or Common Gateway Interface (CGI)
vulnerabilities, or an email virus.
 Persist phase:
• After the attack is successfully launched in the memory, the code tries to persist
on the target system.
• The goal is to ensure that the attacker code is running and available to the
attacker even if the system reboots.
• Achieved by modifying system files, making registry changes, and installing new
code.
23
Worm and Virus Exploit and Comparison
 Propagate phase:
• The attacker attempts to extend the attack to other targets by looking for
vulnerable neighboring machines.
• Propagation vectors include emailing copies of the attack to other systems,
uploading files to other systems using file shares or FTP services, active web
connections, and file transfers through Internet Relay Chat.
 Paralyze phase:
• Actual damage is done to the system.
• Files can be erased, systems can crash, information can be stolen, and
distributed DDoS attacks can be launched.

24
Trojan Horses
Trojan Horse Concept
 A Trojan horse is a program
that appears, to the user, to
perform a desirable function
but, in fact, facilitates
unauthorized access to the
user's computer system.
 Trojan horses can appear to
be useful or interesting
programs, or at the very least
harmless to an unsuspecting
user, but are actually harmful
when executed.
 Trojan horses are not self-
replicating which distinguishes
them from viruses and worms.

25
Trojan Horses
Trojan Horse Classification
 Remote-access Trojan Horse - Enables unauthorized remote access
 Data sending Trojan Horse - Provides the attacker with sensitive data, such as
passwords
 Destructive Trojan Horse - Corrupts or deletes files
 Proxy Trojan Horse - User’s computer functions as a proxy server
 FTP Trojan Horse (opens port 21) - Security software disabler Trojan Horse
(stops antivirus programs or firewalls from functioning)
 Security software disabler Trojan horse - Stops antivirus programs or
firewalls from functioning.
 DoS Trojan Horse - Slows or halts network activity

26
Mitigating Viruses, Worms, and Trojan Horses
Buffer Overflows
 Buffer - An allocated area of memory used by processes to
store data temporarily.
 Buffer overflow - Occurs when a fixed-length buffer reaches
its capacity, and a process attempts to store data beyond that
maximum limit. This can result in extra data overwriting
adjacent memory locations, as well as causing other
unexpected behaviors.
 A majority of the software vulnerabilities that are discovered
relate to buffer overflows. Buffer overflows are usually the
primary conduit through which viruses, worms, and Trojan
Horses do their damage.

27
Mitigating Viruses, Worms, and Trojan Horses
Antivirus Software

28
Mitigating Viruses, Worms, and Trojan Horses
Worm Mitigation
 Worm attack mitigation requires diligence on the part of
system and network administration staff.
 There is a four phase process to mitigate an active worm
attacks.

29
Mitigating Viruses, Worms, and Trojan Horses
Worm Mitigation Cont.
 Containment Phase
• Limits the spread of a worm infection to areas of the network that
are already affected.
• Compartmentalizes and segments the network to slow down or
stop the worm to prevent currently infected hosts from targeting
and infecting other systems.
• Uses both outgoing and incoming ACLs on routers and firewalls at
control points within the network.
 Inoculation Phase
• Runs parallel to or subsequent to the containment phase.
• All uninfected systems are patched with the appropriate vendor
patch for the vulnerability.
• The inoculation process further deprives the worm of any available
targets.

30
Mitigating Viruses, Worms, and Trojan Horses
Worm Mitigation Cont.
 Quarantine Phase
• Tracks down and identifies infected machines within the contained
areas and disconnects, blocks, or removes them.
• This isolates these systems appropriately for the Treatment Phase.
 Treatment Phase
• Actively infected systems are disinfected of the worm.
• Terminates the worm process, removes modified files or system
settings that the worm introduced, and patches the vulnerability the
worm used to exploit the system.
• In more severe cases, completely reinstalling the system to ensure
that the worm and its by products are removed.

31
Mitigating Viruses, Worms, and Trojan Horses
SQL Slammer Worm
 The SQL Slammer worm used UDP port 1434.
• This port should normally be blocked by a firewall on the perimeter.
• However, most infections enter internally and, therefore, to prevent
the spreading of this worm, it would be necessary to block this port
on all devices throughout the internal network.
 When SQL Slammer was propagating, some organizations
could not block UDP port 1434 because it was required to
access the SQL Server for legitimate business transactions.
• Permit only selective access to a small number of clients using
SQL Server.

32