SlideShare una empresa de Scribd logo
1 de 96
Programs:
Certified Computer Security Officer (CCSO)
Certified Computer Security Analyst (CCSA)

             LSP Telematika

              Semi Yulianto
               Created By

               Shared By
          Linuxer@kaskus.co.id
Semi Yulianto
MCT, MCP, MCSA, MCSE, MCSA & MCSE: Security, MCTS, MCITP, CCNA, CCNP, CNI, CNA, CNE, CCA,
CIW-CI, CIW-SA, CEI, CEH, ECSA, CHFI, EDRP, ECSP, etc 
Independent Trainer and Consultant


 EC-Council Indonesia & Asia Pacific (Jakarta, Indonesia)
Current Roles:


    ITS2 (Riyadh, Saudi Arabia)
    Senior Technical Trainer/Security Consultant


    IshanTech (M) Sdn Bhd (Kuala Lumpur, Malaysia)

    Security Consultant (Web Application Pen-Tester)

    Security Consultant (ESET Anti-Virus & Smart Security)


semi.yulianto@flexi-learn.com and semi.yulianto2009@gmail.com
Contacts:

+62 852 1325 6600 and +60 14 9377 462
1. Network Security
Part I

2. Threats to Network Security
3. Security and People
4. Secure Network Infrastructure


6. Identity Services
5. Virtual Private Networks (I)


7. Anti-Virus
8. Access Controls
9. Firewalls (II)


11. Bastian Host
10. Intrusion Detection System (IDS) + Iprevention S (III)


12. Honey pot (IV)
1. Policy Management
Part II

2. Vulnerability Assessment


4. Patch Management
3. Encryption (V + VI)




6. Incident Handling
5. OS Hardening (VII)


7. Client-Side Attacks
8. Ethical Hacking and Pen-Test
9. Penetration Testing
10. IT Infra Threat Modeling
11. Do and Don’ts
12. Best Practices
Network security involves all activities that
    organizations, enterprises, and institutions
    undertake to protect the value and ongoing usability





    of assets and the integrity and continuity of
    operations.

    An effective network security strategy requires
    identifying threats and then choosing the most



    effective set of tools to combat them.
Today’s system/network administration should includes
    security related activities such as patch management, OS,
    host and device hardening and network vulnerability




    assessment.

    System/Network Administrators should be ready to
    perform those related activities to protect and prevent from
    malicious hackers, external and internal attacks.





    Responsibilities of the System/Network Administrators
    should not only limited to managing and administering the
    existing system/network, security should be added since it’s




    vital to protect the organization’s assets (data, information
    and IP).
Computer programs written by devious programmers
    Viruses

    and designed to replicate themselves and infect




    computers when triggered by a specific event.


    Delivery vehicles for destructive code, which appear to
    Trojan Horses Programs

    be harmless or useful software programs such as games.





    Software applications or applets that cause destruction.
   Vandals
   Attacks

      Information-gathering activities to collect data that is later
    ◦ Reconnaissance attacks

      used to compromise networks.


      Exploit network vulnerabilities in order to gain entry to e-mail,
    ◦ Access attacks

      databases, or the corporate network.



      Prevent access to part or all of a computer system.
    ◦ Denial-of-service (DoS) attacks
Involves eavesdropping on communications or
   Data Interception

    altering data packets being transmitted.



    Obtaining confidential network security information
   Social Engineering

    through nontechnical means, such as posing as a
    technical support person and asking for people's
    passwords.
Network Security Fundamentals
Network Security Fundamentals
Network Security Fundamentals
Network Security Fundamentals
None of the approaches alone will be sufficient to
    protect a network, but when they are layered
    together, they can be highly effective in keeping a





    network safe from attacks and other threats to
    security.

    Well-thought-out corporate policies are critical to
    determine and control access to various parts of the
    network.

Security is not only about the technology, it’s about
    people, processes and other related components
    linked together. Do not just depend on technology





    since they can change very fast and we may not be
    able to keep up.

    Human is the weakest link in the security chain.
    Educate people to reduce the threats and attacks
    (fact: 40% of the attacks are coming from the





    Insider).
Switches and routers have hardware and software
    features that support secure connectivity, perimeter
    security, intrusion protection, identity services, and





    security management.

    Dedicated network security hardware and software-
    tools such as firewalls and intrusion detection
    systems provide protection for all areas of the





    network and enable secure connections.
Virtual Private Networks (VPN) provide access
    control and data encryption between two different
    computers on a network.





    VPN allows remote workers to connect to the
    network without the risk of a hacker or thief
    intercepting data.

Network Security Fundamentals
Identity management or ID management is a broad
    administrative area that deals with identifying
    individuals in a system (such as a country, a network or




    an organization) and controlling the access to the
    resources in that system by placing restrictions on the
    established identities.

    Identity management or IDM is a term related to how
    humans are identified and authorized across computer
    networks. It covers issues such as how users are given




    an identity, the protection of that identity and the
    technologies supporting that protection such as network
    protocols, digital certificates, passwords and so on.
Network Security Fundamentals
Network Security Fundamentals
Anti-virus software is a necessary part of a good security program.
    If properly implemented and configured, it can reduce an
    organization’s exposure to malicious programs.





    Anti-virus software only protects an organization from malicious
    programs (and not all of them—remember Melissa?).




    Anti-virus software will not protect an organization from an
    intruder who misuses a legitimate program to gain access to a
    system.





    Nor will anti-virus software protect an organization from a
    legitimate user who attempts to gain access to files that he should
    not have access to.

Network Security Fundamentals
Network Security Fundamentals
Each and every computer system within an
    organization should have the capability to restrict
    access to files based on the ID of the user attempting





    the access.

    If systems are properly configured and the file
    permissions set appropriately, file access controls
    can restrict legitimate users from accessing files





    they should not have access to.
File access controls will not prevent someone from
    using a system vulnerability to gain access to the
    system as an administrator and thus see files on the




    system.

    Even access control systems that allow the
    configuration of access controls on systems across
    the organization cannot do this, to the access control




    system, such an attack will look like a legitimate
    administrator attempting to access files to which the
    account is allowed access.
Network Security Fundamentals
Firewalls are access control devices for the network
    and can assist in protecting an organization’s
    internal network from external attacks.





    By their nature, firewalls are border security
    products, meaning that they exist on the border
    between the internal network and the external




    network.

    Properly configured, firewalls have become a
    necessary security device.

Firewalls can be implemented in either hardware or
    software, or a combination of both.





    Firewalls are frequently used to prevent unauthorized
    Internet users from accessing private networks
    connected to the Internet, especially intranets.





    All messages entering or leaving the intranet pass
    through the firewall, which examines each message and
    blocks those that do not meet the specified security





    criteria.
A firewall will not prevent an attacker from using an
    allowed connection to attack a system.



    ◦ For example: if a Web server is allowed to be accessed
      from the outside and is vulnerable to an attack against the
      Web server software, a firewall will likely allow this attack
      since the Web server should receive Web connections.


    Firewalls will also not protect an organization from
    an internal user since that internal user is already
    on the internal network.

Firewall techniques:

   Packet filtering inspects each packet passing through the network and accepts or
 Packet filter


   rejects it based on user-defined rules. Although difficult to configure, it is fairly
   effective and mostly transparent to its users. It is susceptible to IP spoofing.


    Applies security mechanisms to specific applications, such as FTP and Telnet
    Application gateway

    servers. This is very effective, but can impose a performance degradation.





    Applies security mechanisms when a TCP or UDP connection is established. Once
    Circuit-level gateway

    the connection has been made, packets can flow between the hosts without further




    checking.


    Intercepts all messages entering and leaving the network. The proxy server
    Proxy server

    effectively hides the true network addresses.

Network Security Fundamentals
Network Security Fundamentals
Network Security Fundamentals
In computer security, a DMZ, or demilitarized zone is a
    physical or logical subnetwork that contains and
    exposes an organization's external services to a larger




    untrusted network, usually the Internet.

    The term is normally referred to as a DMZ by IT
    professionals. It is sometimes referred to as a Perimeter
    Network.





    The purpose of a DMZ is to add an additional layer of
    security to an organization's Local Area Network (LAN);
    an external attacker only has access to equipment in the




    DMZ, rather than any other part of the network.
Generally, any service that is being provided to users
    from an external network could be placed in the
    DMZ.





    The most common of these services are web servers,
    mail servers, FTP servers, VoIP servers and DNS
    servers.





    In some situations, additional steps need to be taken
    to be able to provide secure services.

Network Security Fundamentals
Network Security Fundamentals
Intrusion detection systems were once touted as the solution
    to the entire security problem.




    No longer would we need to protect our files and systems, we
    could just identify when someone was doing something
    wrong and stop them.





    Some of the intrusion detection systems were marketed with
    the ability to stop attacks before they were successful.




    No intrusion detection system is foolproof and thus they
    cannot replace a good security program or good security
    practice. They will also not detect legitimate users who may




    have incorrect access to information.
Types of Intrusion Detection Systems:


    It is an independent platform that identifies intrusions by
    Network Intrusion Detection System (NIDS)

    examining network traffic and monitors multiple hosts. Network




    Intrusion Detection Systems gain access to network traffic by
    connecting to a hub, network switch configured for port mirroring,
    or network tap. An example of a NIDS is Snort.


    It consists of an agent on a host that identifies intrusions by
    Host-based Intrusion Detection System (HIDS)

    analyzing system calls, application logs, file-system modifications




    (binaries, password files, capability/acl databases) and other host
    activities and state. An example of a HIDS is OSSEC (open source
    free host-based intrusion detection system).
Network Security Fundamentals
Network Security Fundamentals
A bastion host is a special purpose computer on a
    network specifically designed and configured to
    withstand attacks.





    The computer generally hosts a single application, for
    example a proxy server, and all other services are
    removed or limited to reduce the threat to the computer.





    It is hardened in this manner primarily due to its
    location and purpose, which is either on the outside of
    the firewall or in the DMZ and usually involves access




    from untrusted networks or computers.
There are two common network configurations that include
    bastion hosts and their placement.
    ◦ The first requires two firewalls, with bastion hosts sitting between




      the first "outside world" firewall.
    ◦ An inside firewall, in a demilitarized zone (DMZ).

    Often smaller networks do not have multiple firewalls, so if
    only one firewall exists in a network, bastion hosts are
    commonly placed outside the firewall.





    Bastion hosts are related to multi-homed hosts and screened
    hosts. While a dual-homed host often contains a firewall it is
    also used to host other services as well. A screened host is a




    dual-homed host that is dedicated to running the firewall.
1. Web server
Examples of bastion host systems/services:

2. DNS (Domain Name System) server
3. Email server
4. FTP (File Transfer Protocol) server
5. Proxy server
6. Honeypot
7. VPN (Virtual Private Network) server
Network Security Fundamentals
Honeypot is a trap set to detect, deflect, or in some
    manner counteract attempts at unauthorized use of
    information systems.





    Generally it consists of a computer, data, or a network
    site that appears to be part of a network, but is actually
    isolated, (un)protected, and monitored, and which




    seems to contain information or a resource of value to
    attackers.

    A honeypot is valuable as a surveillance and early-
    warning tool.

While it is often a computer, a honeypot can take
    other forms, such as files or data records, or even
    unused IP address space.





    A honeypot that masquerades as an open proxy to
    monitor and record those using the system is a
    sugarcane.





    Honeypots should have no production value, and
    hence should not see any legitimate traffic or
    activity.

Network Security Fundamentals
Network Security Fundamentals
Policies and procedures are important components of a good
    security program and the management of policies across
    computer systems is equally important.





    With a policy management system, an organization can be
    made aware of any system that does not conform to policy.




    Policy management may not take into account vulnerabilities
    in systems or misconfigurations in application software,
    either of these may lead to a successful penetration.





    Policy management on computer systems also does not
    guarantee that users will not write down their passwords or
    give their passwords to unauthorized individuals.

Assessing computer systems for vulnerabilities is an
    important part of a good security program. Such
    assessment will help an organization to identify




    potential entry points for intruders.

    Vulnerability assessment will not protect your computer
    systems.




    Each vulnerability must be fixed after it is identified.

    Vulnerability assessment will not detect legitimate users




    who may have inappropriate access nor will it detect an
    intruder who is already in your systems.

Network Security Fundamentals
Network Security Fundamentals
Encryption is the primary mechanism for communications
    security. It will certainly protect information in transit.




    Encryption might even protect information that is in storage
    by encrypting files. However, legitimate users must have
    access to these files.





    The encryption system will not differentiate between
    legitimate and illegitimate users if both present the same
    keys to the encryption algorithm. Therefore, encryption by




    itself will not provide security.

    There must also be controls on the encryption keys and the
    system as a whole.

Network Security Fundamentals
Network Security Fundamentals
Patch management is an area of systems
    management that involves: acquiring, testing, and
    installing multiple patches (code changes) to an





    administered computer system.

    Effective patch management is the first line of
    defense for networks of any size.





    Patch management is an important part of every IT
    administrator's responsibility.

To maintain a secure network, one must ensure that
    the latest security patches and operating system
    service packs are installed network-wide.





    Patch management software also plays a part in
    adhering to the most recent compliance regulations
    such as the Sarbanes-Oxley Act and HIPAA, which





    require enterprises to maintain control of their
    information assets.
Effective patch management involves not only the
    discovery of software vulnerabilities but also the
    subsequent patch deployment to the multiple computers




    on the network.

    IT administrators understand the effects that un-
    patched computers can have on a network.





    Because they also fully recognize the challenge of
    ensuring network-wide protection, an easy-to-
    administer patch management solution has quickly




    become the tool of choice for IT administrators.
A number of products are available to automate
    patch management tasks.





    Like its real world counterpart, a patch is a "make-
    do" fix rather than an elegant-solution. Patches are
    sometimes ineffective, and can sometimes cause





    more problems than they fix.
System administrators take simple steps to avoid
    problems, such as performing backups and testing
    patches on non-critical systems prior to





    installations.

    Security patch management is patch management
    with a focus on reducing security vulnerabilities. It
    should not be a defensive procedure in reaction to





    critical incidents.
Network Security Fundamentals
Patch Deployment Cycle:

    Detect - Use patch management software to scan for missing security patches.
    Detection should be automated and should trigger the patch management process.




    Acquire - If the vulnerability is not addressed by the security measures already in
    place, download the patch for testing.




    Test - Install the patch on a realistic operational environment to ensure that the
    security fixes are suitable and do not compromise your system.




    Deploy - Allow patch deployment to the other computers on the network. Review
    this deployment to ensure its success with minimum impact on system users.




    Maintain - Subscribe to notifications that alert you to vulnerabilities as they are
    reported. Once a new security patch is available, the process is started again.

1. Maintaining current knowledge of available
Patch Management task include:

   patches.
2. Deciding what patches are appropriate for
   particular systems.
3. Ensuring that patches are installed properly, testing
   systems after installation.
4. Documenting all associated procedures, such as
   specific configurations required.
1. http://technet.microsoft.com/en-us/wsus/default.aspx
Patch Management Solutions:

2. http://www.shavlik.com
3. http://www.kaseya.com
4. http://www.symantec.com
5. http://www.ecora.com
6. http://www.lumension.com
7. http://www.gfi.com
8. http://www.landesk.com
9. http://www.manageengine.com
10. http://www.everdream.com
Network Security Fundamentals
Network Security Fundamentals
Network Security Fundamentals
OS Hardening is the process to address security
    weaknesses in operation systems by implementing
    the latest OS paches, hotfixes and updates and





    following procedures and policies to reduce attacks
    and system down time.

    The idea of OS hardening is to minimize a
    computer's exposure to current and future threats
    by fully configuring the operating system and





    removing unnecessary applications.
Incident handling is a generalized term that refers to
    the response by a person or organization to an
    attack.





    An organized and careful reaction to an incident can
    mean the difference between complete recovery and
    total disaster.

Incident Handling Steps:

    Preparation - Comprehensively addressing the issue of security includes methods
    to prevent attack as well as how to respond to a successful one.




    Identification of Attack - The first post-attack step in Incident handling is the
    identification of an incident. Identification of an incident becomes more difficult as
    the complexity of the attack grows.





    Containment of Attack - Once an attack has been identified, steps must be taken to
    minimize the effects of the attack. Containment allows the user or administrator to
    protect other systems and networks from the attack and limit damage.





    Recovery and Analysis - The recovery phase allows users to assess what damage
    has been incurred, what information has been lost and what the post-attack status
    of the system is. Once the user can be assured that the attack has been contained, it




    is helpful to conduct an analysis of the attack.
Case Study (Discussion)


    1.   Preparation
    Viruses Outbreak
    2.   Identification of the attack




    3.   Containment of the attack
    4.   Recovery & Analysis


    1.   Preparation
    System Compromise
    2.   Identification of the attack




    3.   Containment of the attack
    4.   Recovery & Analysis
Traditionally, attackers went for hacking servers, but there has
    been a shift to the client side because server-side applications have
    been targets for attackers since 2001, and these applications have




    matured.

    Attackers are going after weaknesses in desktop applications such
    as browsers, media players, common office applications and e-mail


    clients.

    The remedy is to maintain the most current application patch
    levels, keep antivirus software updated and seek and remove
    unauthorized applications.





    Keeping authorized software to a minimum also decreases
    exposure.

   Application vulnerabilities exceeds OS vulnerabilities
 Two main avenues for exploiting and compromising web servers:
Web Application Attacks

  brute force password guessing attacks and web application attacks.

    Microsoft SQL, FTP, and SSH servers are popular targets for
    password guessing attacks because of the access that is gained if a
    valid username/password pair is identified.





    SQL Injection, Cross-site Scripting and PHP File Include attacks
    continue to be the three most popular techniques used for
    compromising web sites.





    Automated tools, designed to target custom web application
    vulnerabilities, make it easy to discover and infect several thousand
    web sites.

 Attacks on Microsoft Windows operating systems were
Windows: Conficker/Downadup

  dominated by Conficker/ Downadup worm variants.

    For the past six months, over 90% of the attacks
    recorded for Microsoft targeted the buffer overflow
    vulnerability described in the Microsoft Security Bulletin




    MS08-067.

    Although in much smaller proportion, Sasser and
    Blaster, the infamous worms from 2003 and 2004,
    continue to infect many networks.

   Attacks on critical Microsoft vulnerabilities
   Attacks on critical Microsoft vulnerabilities
   Attacks on critical Apple vulnerabilities
 Step 0: Attacker places contents on trusted site.
Client-Side Attacks Example (Step-by-Step)

 Step 1: Client-side exploitation.

 Step 2: Established reverse shell backdoor using HTTPS.

 Step 3: Dump hashes and use pass-the-hash attack to pivot.

 Step 4: Pass the hash to compromise Domain Controller.
   Step 0: Attacker places contents on trusted site
   Step 1: Client-side exploitation
   Step 2: Established reverse shell backdoor using HTTPS
   Step 3: Dump hashes and use pass-the-hash attack to pivot
   Step 4: Pass the hash to compromise Domain Controller
A penetration test of which the goal is to discover
    Ethical Hacking

    trophies throughout the network within the





    predetermined project time limit.


    A goal-oriented project of which the goal is the
    Penetration Testing

    trophy and includes gaining privileged access by





    pre-conditional means.
A penetration test is a method of evaluating the
    security of a computer system or network by
    simulating an attack from a malicious source, known




    as a Black Hat Hacker, or Cracker.

    The process involves an active analysis of the system
    for any potential vulnerabilities that may result from
    poor or improper system configuration, known




    and/or unknown hardware or software flaws, or
    operational weaknesses in process or technical
    countermeasures.
Analysis is carried out from the position of a potential
    attacker, and can involve active exploitation of security
    vulnerabilities.





    Any security issues that are found will be presented to the
    system owner together with an assessment of their impact
    and often with a proposal for mitigation or a technical




    solution.

    The intent of a penetration test is to determine feasibility of
    an attack and the amount of business impact of a successful
    exploit, if discovered.





   It is a component of a full security audit.
The IT Infrastructure Threat Modeling Guide
    provides an easy-to-understand method for
    developing threat models that can help prioritize





    investments in IT infrastructure security.

    This guide describes and considers the extensive
    methodology that exists for Security Development
    Lifecycle (SDL) threat modeling and uses it to





    establish a threat modeling process for IT
    infrastructure.
   Primary steps of the Threat Modeling Process:
Threat Modeling Guide is designed to help IT

1. Identify threats that could affect their
professionals accomplish the following:

   organizations’ IT infrastructures.
2. Discover and mitigate design and implementation
   issues that could put IT infrastructures at risk.
3. Prioritize budget and planning efforts to address
   the most significant threats.
4. Conduct security efforts for both new and existing
   IT infrastructure components in a more proactive
   and cost-effective manner.
1. Do choose your passwords carefully.
Dos:

2. Do learn about network security.
3. Do save your work-related data on the network.
4. Do encrypt data.
5. Do utilize network virus protection software.
6. Do report any unauthorized use of your computer.
7. Do lock your workstation when you step away from
   your computer.
8. Do inform administrators of employee departures.
1. Don’t leave passwords around your workplace.
Don’ts:

2. Don’t save personal or sensitive information on
   shared network resources.
3. Don’t open suspect e-mails.
4. Don’t leave sensitive data on your hard drive.
5. Don’t use automatic login features.
6. Network security should always be taken seriously.
In order to effectively secure your network environment, you must first become
    Assess Your Environment

    familiar with all of its components.





    Being part of the connected world brings many benefits as well as challenges. Any
    Protect Your Network

    computer within your network that is connected to the Internet, directly or




    indirectly, is a potential risk for an attack from viruses or external attackers.


    You should be sure to take sufficient steps to harden your core operating systems
    Protect Your Servers and Clients

    and major applications from common attacks.





    Monitoring and auditing are central to an organization's security efforts. We often
    Monitor Your Environment

    think of monitoring as watching and waiting for an event to occur so that we can




    react to the situation.
1.    Selecting a Good Anti-Virus Software
2.    Testing and Evaluating Anti-Virus Software
3.    Analyzing and Implementing File & Folder Permissions
4.    Analyzing and Implementing Database Security
5.    Analyzing Local Security Policy
6.    Analyzing and Implementing Security Templates
7.    Implementing Group Policy
8.    Implementing Encrypted File System (EFS)
9.    Implementing Disk Encryption
10.   Selecting Patch Management solutions
11.   Implementing Patch Management
12.   Configuring IDS and Firewall
13.   Analyzing IDS and Firewall Rules
14.   Testing IDS and Firewall

Más contenido relacionado

La actualidad más candente

Introduction to Network Security
Introduction to Network SecurityIntroduction to Network Security
Introduction to Network SecurityJohn Ely Masculino
 
Network security and protocols
Network security and protocolsNetwork security and protocols
Network security and protocolsOnline
 
Intrusion detection
Intrusion detectionIntrusion detection
Intrusion detectionCAS
 
Network Security
Network SecurityNetwork Security
Network SecurityManoj Singh
 
Computer security concepts
Computer security conceptsComputer security concepts
Computer security conceptsG Prachi
 
Attack detection and prevention in the cyber
Attack detection and prevention in the cyberAttack detection and prevention in the cyber
Attack detection and prevention in the cyberJahangirnagar University
 
What is Cyber Security? | Introduction to Cyber Security | Cyber Security Tra...
What is Cyber Security? | Introduction to Cyber Security | Cyber Security Tra...What is Cyber Security? | Introduction to Cyber Security | Cyber Security Tra...
What is Cyber Security? | Introduction to Cyber Security | Cyber Security Tra...Edureka!
 
Intrusion detection and prevention system
Intrusion detection and prevention systemIntrusion detection and prevention system
Intrusion detection and prevention systemNikhil Raj
 
Vulnerability assessment and penetration testing
Vulnerability assessment and penetration testingVulnerability assessment and penetration testing
Vulnerability assessment and penetration testingAbu Sadat Mohammed Yasin
 
Network Security Presentation
Network Security PresentationNetwork Security Presentation
Network Security PresentationAllan Pratt MBA
 
Cyber Security Best Practices
Cyber Security Best PracticesCyber Security Best Practices
Cyber Security Best PracticesEvolve IP
 
Cybercrime and Security
Cybercrime and SecurityCybercrime and Security
Cybercrime and SecurityNoushad Hasan
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Edureka!
 
What is Cryptography and Types of attacks in it
What is Cryptography and Types of attacks in itWhat is Cryptography and Types of attacks in it
What is Cryptography and Types of attacks in itlavakumar Thatisetti
 

La actualidad más candente (20)

Introduction to Network Security
Introduction to Network SecurityIntroduction to Network Security
Introduction to Network Security
 
Network security and protocols
Network security and protocolsNetwork security and protocols
Network security and protocols
 
Intrusion detection
Intrusion detectionIntrusion detection
Intrusion detection
 
Network Security
Network SecurityNetwork Security
Network Security
 
Computer security concepts
Computer security conceptsComputer security concepts
Computer security concepts
 
Attack detection and prevention in the cyber
Attack detection and prevention in the cyberAttack detection and prevention in the cyber
Attack detection and prevention in the cyber
 
What is Cyber Security? | Introduction to Cyber Security | Cyber Security Tra...
What is Cyber Security? | Introduction to Cyber Security | Cyber Security Tra...What is Cyber Security? | Introduction to Cyber Security | Cyber Security Tra...
What is Cyber Security? | Introduction to Cyber Security | Cyber Security Tra...
 
Intrusion detection and prevention system
Intrusion detection and prevention systemIntrusion detection and prevention system
Intrusion detection and prevention system
 
Vulnerability assessment and penetration testing
Vulnerability assessment and penetration testingVulnerability assessment and penetration testing
Vulnerability assessment and penetration testing
 
Network Security Presentation
Network Security PresentationNetwork Security Presentation
Network Security Presentation
 
Cyber Security Best Practices
Cyber Security Best PracticesCyber Security Best Practices
Cyber Security Best Practices
 
Cybercrime and Security
Cybercrime and SecurityCybercrime and Security
Cybercrime and Security
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...
 
Network security ppt
Network security pptNetwork security ppt
Network security ppt
 
Email security
Email securityEmail security
Email security
 
Network attacks
Network attacksNetwork attacks
Network attacks
 
Introduction Network security
Introduction Network securityIntroduction Network security
Introduction Network security
 
Security Threats at OSI layers
Security Threats at OSI layersSecurity Threats at OSI layers
Security Threats at OSI layers
 
What is Cryptography and Types of attacks in it
What is Cryptography and Types of attacks in itWhat is Cryptography and Types of attacks in it
What is Cryptography and Types of attacks in it
 
Network security
Network securityNetwork security
Network security
 

Destacado

Authentication Application in Network Security NS4
Authentication Application in Network Security NS4Authentication Application in Network Security NS4
Authentication Application in Network Security NS4koolkampus
 
Kerberos presentation
Kerberos presentationKerberos presentation
Kerberos presentationChris Geier
 
Protocols and the TCP/IP Protocol Suite
Protocols and the TCP/IP Protocol SuiteProtocols and the TCP/IP Protocol Suite
Protocols and the TCP/IP Protocol SuiteAtharaw Deshmukh
 
An Introduction to Kerberos
An Introduction to KerberosAn Introduction to Kerberos
An Introduction to KerberosShumon Huque
 
Kerberos Authentication Protocol
Kerberos Authentication ProtocolKerberos Authentication Protocol
Kerberos Authentication ProtocolBibek Subedi
 
Digital data transmission
Digital data transmissionDigital data transmission
Digital data transmissionBZU lahore
 
File Transfer Protocol
File Transfer ProtocolFile Transfer Protocol
File Transfer Protocolguest029bcd
 

Destacado (7)

Authentication Application in Network Security NS4
Authentication Application in Network Security NS4Authentication Application in Network Security NS4
Authentication Application in Network Security NS4
 
Kerberos presentation
Kerberos presentationKerberos presentation
Kerberos presentation
 
Protocols and the TCP/IP Protocol Suite
Protocols and the TCP/IP Protocol SuiteProtocols and the TCP/IP Protocol Suite
Protocols and the TCP/IP Protocol Suite
 
An Introduction to Kerberos
An Introduction to KerberosAn Introduction to Kerberos
An Introduction to Kerberos
 
Kerberos Authentication Protocol
Kerberos Authentication ProtocolKerberos Authentication Protocol
Kerberos Authentication Protocol
 
Digital data transmission
Digital data transmissionDigital data transmission
Digital data transmission
 
File Transfer Protocol
File Transfer ProtocolFile Transfer Protocol
File Transfer Protocol
 

Similar a Network Security Fundamentals

unit 2 IT security solution.pptx
unit 2 IT security solution.pptxunit 2 IT security solution.pptx
unit 2 IT security solution.pptxlochanrajdahal
 
Firewalls And Infrastructure Security
Firewalls And Infrastructure SecurityFirewalls And Infrastructure Security
Firewalls And Infrastructure SecurityBrooke Curtis
 
ppt on securities.pptx
ppt on securities.pptxppt on securities.pptx
ppt on securities.pptxmuskaangoel15
 
Basic Home Computer Network And Computer Network Security...
Basic Home Computer Network And Computer Network Security...Basic Home Computer Network And Computer Network Security...
Basic Home Computer Network And Computer Network Security...Jennifer Letterman
 
Network Security Practices Essay
Network Security Practices EssayNetwork Security Practices Essay
Network Security Practices EssayTina Williams
 
Network and web security
Network and web securityNetwork and web security
Network and web securityNitesh Saitwal
 
Manage Network Security
Manage Network SecurityManage Network Security
Manage Network SecurityLaura Hansen
 
Seguridad web -articulo completo- ingles
Seguridad web -articulo completo- inglesSeguridad web -articulo completo- ingles
Seguridad web -articulo completo- inglesisidro luna beltran
 
Ne Course Part Two
Ne Course Part TwoNe Course Part Two
Ne Course Part Twobackdoor
 
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT .docx
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT           .docxRunning Head RISK, THREAT AND VULNERABILITY MANAGEMENT           .docx
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT .docxjeanettehully
 
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT .docx
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT           .docxRunning Head RISK, THREAT AND VULNERABILITY MANAGEMENT           .docx
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT .docxtodd521
 
Global Security Law And Act Of Network Security
Global Security Law And Act Of Network SecurityGlobal Security Law And Act Of Network Security
Global Security Law And Act Of Network SecurityDotha Keller
 
Global Security Law And Act Of Network Security
Global Security Law And Act Of Network SecurityGlobal Security Law And Act Of Network Security
Global Security Law And Act Of Network SecurityRenee Wardowski
 
Data protection and security
Data protection and securityData protection and security
Data protection and securitynazar60
 
Wireless Networking
Wireless NetworkingWireless Networking
Wireless NetworkingGulshanAra14
 
Network_Security1.pdf.pdf
Network_Security1.pdf.pdfNetwork_Security1.pdf.pdf
Network_Security1.pdf.pdfahmed53254
 

Similar a Network Security Fundamentals (20)

Network srcurity
Network srcurityNetwork srcurity
Network srcurity
 
unit 2 IT security solution.pptx
unit 2 IT security solution.pptxunit 2 IT security solution.pptx
unit 2 IT security solution.pptx
 
Firewalls And Infrastructure Security
Firewalls And Infrastructure SecurityFirewalls And Infrastructure Security
Firewalls And Infrastructure Security
 
ppt on securities.pptx
ppt on securities.pptxppt on securities.pptx
ppt on securities.pptx
 
Basic Home Computer Network And Computer Network Security...
Basic Home Computer Network And Computer Network Security...Basic Home Computer Network And Computer Network Security...
Basic Home Computer Network And Computer Network Security...
 
Network Security Practices Essay
Network Security Practices EssayNetwork Security Practices Essay
Network Security Practices Essay
 
Network and web security
Network and web securityNetwork and web security
Network and web security
 
Network security
Network securityNetwork security
Network security
 
Module 3.pdf
Module 3.pdfModule 3.pdf
Module 3.pdf
 
Module 3.Infrastructure and Network Security:
Module 3.Infrastructure and Network Security:Module 3.Infrastructure and Network Security:
Module 3.Infrastructure and Network Security:
 
Manage Network Security
Manage Network SecurityManage Network Security
Manage Network Security
 
Seguridad web -articulo completo- ingles
Seguridad web -articulo completo- inglesSeguridad web -articulo completo- ingles
Seguridad web -articulo completo- ingles
 
Ne Course Part Two
Ne Course Part TwoNe Course Part Two
Ne Course Part Two
 
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT .docx
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT           .docxRunning Head RISK, THREAT AND VULNERABILITY MANAGEMENT           .docx
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT .docx
 
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT .docx
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT           .docxRunning Head RISK, THREAT AND VULNERABILITY MANAGEMENT           .docx
Running Head RISK, THREAT AND VULNERABILITY MANAGEMENT .docx
 
Global Security Law And Act Of Network Security
Global Security Law And Act Of Network SecurityGlobal Security Law And Act Of Network Security
Global Security Law And Act Of Network Security
 
Global Security Law And Act Of Network Security
Global Security Law And Act Of Network SecurityGlobal Security Law And Act Of Network Security
Global Security Law And Act Of Network Security
 
Data protection and security
Data protection and securityData protection and security
Data protection and security
 
Wireless Networking
Wireless NetworkingWireless Networking
Wireless Networking
 
Network_Security1.pdf.pdf
Network_Security1.pdf.pdfNetwork_Security1.pdf.pdf
Network_Security1.pdf.pdf
 

Último

How to Show Error_Warning Messages in Odoo 17
How to Show Error_Warning Messages in Odoo 17How to Show Error_Warning Messages in Odoo 17
How to Show Error_Warning Messages in Odoo 17Celine George
 
Drug Information Services- DIC and Sources.
Drug Information Services- DIC and Sources.Drug Information Services- DIC and Sources.
Drug Information Services- DIC and Sources.raviapr7
 
CHUYÊN ĐỀ DẠY THÊM TIẾNG ANH LỚP 11 - GLOBAL SUCCESS - NĂM HỌC 2023-2024 - HK...
CHUYÊN ĐỀ DẠY THÊM TIẾNG ANH LỚP 11 - GLOBAL SUCCESS - NĂM HỌC 2023-2024 - HK...CHUYÊN ĐỀ DẠY THÊM TIẾNG ANH LỚP 11 - GLOBAL SUCCESS - NĂM HỌC 2023-2024 - HK...
CHUYÊN ĐỀ DẠY THÊM TIẾNG ANH LỚP 11 - GLOBAL SUCCESS - NĂM HỌC 2023-2024 - HK...Nguyen Thanh Tu Collection
 
Diploma in Nursing Admission Test Question Solution 2023.pdf
Diploma in Nursing Admission Test Question Solution 2023.pdfDiploma in Nursing Admission Test Question Solution 2023.pdf
Diploma in Nursing Admission Test Question Solution 2023.pdfMohonDas
 
How to Make a Field read-only in Odoo 17
How to Make a Field read-only in Odoo 17How to Make a Field read-only in Odoo 17
How to Make a Field read-only in Odoo 17Celine George
 
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRADUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRATanmoy Mishra
 
3.21.24 The Origins of Black Power.pptx
3.21.24  The Origins of Black Power.pptx3.21.24  The Origins of Black Power.pptx
3.21.24 The Origins of Black Power.pptxmary850239
 
M-2- General Reactions of amino acids.pptx
M-2- General Reactions of amino acids.pptxM-2- General Reactions of amino acids.pptx
M-2- General Reactions of amino acids.pptxDr. Santhosh Kumar. N
 
CapTechU Doctoral Presentation -March 2024 slides.pptx
CapTechU Doctoral Presentation -March 2024 slides.pptxCapTechU Doctoral Presentation -March 2024 slides.pptx
CapTechU Doctoral Presentation -March 2024 slides.pptxCapitolTechU
 
Ultra structure and life cycle of Plasmodium.pptx
Ultra structure and life cycle of Plasmodium.pptxUltra structure and life cycle of Plasmodium.pptx
Ultra structure and life cycle of Plasmodium.pptxDr. Asif Anas
 
AUDIENCE THEORY -- FANDOM -- JENKINS.pptx
AUDIENCE THEORY -- FANDOM -- JENKINS.pptxAUDIENCE THEORY -- FANDOM -- JENKINS.pptx
AUDIENCE THEORY -- FANDOM -- JENKINS.pptxiammrhaywood
 
How to Solve Singleton Error in the Odoo 17
How to Solve Singleton Error in the  Odoo 17How to Solve Singleton Error in the  Odoo 17
How to Solve Singleton Error in the Odoo 17Celine George
 
Benefits & Challenges of Inclusive Education
Benefits & Challenges of Inclusive EducationBenefits & Challenges of Inclusive Education
Benefits & Challenges of Inclusive EducationMJDuyan
 
Patterns of Written Texts Across Disciplines.pptx
Patterns of Written Texts Across Disciplines.pptxPatterns of Written Texts Across Disciplines.pptx
Patterns of Written Texts Across Disciplines.pptxMYDA ANGELICA SUAN
 
How to Manage Cross-Selling in Odoo 17 Sales
How to Manage Cross-Selling in Odoo 17 SalesHow to Manage Cross-Selling in Odoo 17 Sales
How to Manage Cross-Selling in Odoo 17 SalesCeline George
 
HED Office Sohayok Exam Question Solution 2023.pdf
HED Office Sohayok Exam Question Solution 2023.pdfHED Office Sohayok Exam Question Solution 2023.pdf
HED Office Sohayok Exam Question Solution 2023.pdfMohonDas
 
How to Add Existing Field in One2Many Tree View in Odoo 17
How to Add Existing Field in One2Many Tree View in Odoo 17How to Add Existing Field in One2Many Tree View in Odoo 17
How to Add Existing Field in One2Many Tree View in Odoo 17Celine George
 
Presentation on the Basics of Writing. Writing a Paragraph
Presentation on the Basics of Writing. Writing a ParagraphPresentation on the Basics of Writing. Writing a Paragraph
Presentation on the Basics of Writing. Writing a ParagraphNetziValdelomar1
 
Quality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICEQuality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICESayali Powar
 
The Stolen Bacillus by Herbert George Wells
The Stolen Bacillus by Herbert George WellsThe Stolen Bacillus by Herbert George Wells
The Stolen Bacillus by Herbert George WellsEugene Lysak
 

Último (20)

How to Show Error_Warning Messages in Odoo 17
How to Show Error_Warning Messages in Odoo 17How to Show Error_Warning Messages in Odoo 17
How to Show Error_Warning Messages in Odoo 17
 
Drug Information Services- DIC and Sources.
Drug Information Services- DIC and Sources.Drug Information Services- DIC and Sources.
Drug Information Services- DIC and Sources.
 
CHUYÊN ĐỀ DẠY THÊM TIẾNG ANH LỚP 11 - GLOBAL SUCCESS - NĂM HỌC 2023-2024 - HK...
CHUYÊN ĐỀ DẠY THÊM TIẾNG ANH LỚP 11 - GLOBAL SUCCESS - NĂM HỌC 2023-2024 - HK...CHUYÊN ĐỀ DẠY THÊM TIẾNG ANH LỚP 11 - GLOBAL SUCCESS - NĂM HỌC 2023-2024 - HK...
CHUYÊN ĐỀ DẠY THÊM TIẾNG ANH LỚP 11 - GLOBAL SUCCESS - NĂM HỌC 2023-2024 - HK...
 
Diploma in Nursing Admission Test Question Solution 2023.pdf
Diploma in Nursing Admission Test Question Solution 2023.pdfDiploma in Nursing Admission Test Question Solution 2023.pdf
Diploma in Nursing Admission Test Question Solution 2023.pdf
 
How to Make a Field read-only in Odoo 17
How to Make a Field read-only in Odoo 17How to Make a Field read-only in Odoo 17
How to Make a Field read-only in Odoo 17
 
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRADUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
 
3.21.24 The Origins of Black Power.pptx
3.21.24  The Origins of Black Power.pptx3.21.24  The Origins of Black Power.pptx
3.21.24 The Origins of Black Power.pptx
 
M-2- General Reactions of amino acids.pptx
M-2- General Reactions of amino acids.pptxM-2- General Reactions of amino acids.pptx
M-2- General Reactions of amino acids.pptx
 
CapTechU Doctoral Presentation -March 2024 slides.pptx
CapTechU Doctoral Presentation -March 2024 slides.pptxCapTechU Doctoral Presentation -March 2024 slides.pptx
CapTechU Doctoral Presentation -March 2024 slides.pptx
 
Ultra structure and life cycle of Plasmodium.pptx
Ultra structure and life cycle of Plasmodium.pptxUltra structure and life cycle of Plasmodium.pptx
Ultra structure and life cycle of Plasmodium.pptx
 
AUDIENCE THEORY -- FANDOM -- JENKINS.pptx
AUDIENCE THEORY -- FANDOM -- JENKINS.pptxAUDIENCE THEORY -- FANDOM -- JENKINS.pptx
AUDIENCE THEORY -- FANDOM -- JENKINS.pptx
 
How to Solve Singleton Error in the Odoo 17
How to Solve Singleton Error in the  Odoo 17How to Solve Singleton Error in the  Odoo 17
How to Solve Singleton Error in the Odoo 17
 
Benefits & Challenges of Inclusive Education
Benefits & Challenges of Inclusive EducationBenefits & Challenges of Inclusive Education
Benefits & Challenges of Inclusive Education
 
Patterns of Written Texts Across Disciplines.pptx
Patterns of Written Texts Across Disciplines.pptxPatterns of Written Texts Across Disciplines.pptx
Patterns of Written Texts Across Disciplines.pptx
 
How to Manage Cross-Selling in Odoo 17 Sales
How to Manage Cross-Selling in Odoo 17 SalesHow to Manage Cross-Selling in Odoo 17 Sales
How to Manage Cross-Selling in Odoo 17 Sales
 
HED Office Sohayok Exam Question Solution 2023.pdf
HED Office Sohayok Exam Question Solution 2023.pdfHED Office Sohayok Exam Question Solution 2023.pdf
HED Office Sohayok Exam Question Solution 2023.pdf
 
How to Add Existing Field in One2Many Tree View in Odoo 17
How to Add Existing Field in One2Many Tree View in Odoo 17How to Add Existing Field in One2Many Tree View in Odoo 17
How to Add Existing Field in One2Many Tree View in Odoo 17
 
Presentation on the Basics of Writing. Writing a Paragraph
Presentation on the Basics of Writing. Writing a ParagraphPresentation on the Basics of Writing. Writing a Paragraph
Presentation on the Basics of Writing. Writing a Paragraph
 
Quality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICEQuality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICE
 
The Stolen Bacillus by Herbert George Wells
The Stolen Bacillus by Herbert George WellsThe Stolen Bacillus by Herbert George Wells
The Stolen Bacillus by Herbert George Wells
 

Network Security Fundamentals

  • 1. Programs: Certified Computer Security Officer (CCSO) Certified Computer Security Analyst (CCSA) LSP Telematika Semi Yulianto Created By Shared By Linuxer@kaskus.co.id
  • 2. Semi Yulianto MCT, MCP, MCSA, MCSE, MCSA & MCSE: Security, MCTS, MCITP, CCNA, CCNP, CNI, CNA, CNE, CCA, CIW-CI, CIW-SA, CEI, CEH, ECSA, CHFI, EDRP, ECSP, etc  Independent Trainer and Consultant  EC-Council Indonesia & Asia Pacific (Jakarta, Indonesia) Current Roles: ITS2 (Riyadh, Saudi Arabia) Senior Technical Trainer/Security Consultant IshanTech (M) Sdn Bhd (Kuala Lumpur, Malaysia)  Security Consultant (Web Application Pen-Tester)  Security Consultant (ESET Anti-Virus & Smart Security) semi.yulianto@flexi-learn.com and semi.yulianto2009@gmail.com Contacts: +62 852 1325 6600 and +60 14 9377 462
  • 3. 1. Network Security Part I 2. Threats to Network Security 3. Security and People 4. Secure Network Infrastructure 6. Identity Services 5. Virtual Private Networks (I) 7. Anti-Virus 8. Access Controls 9. Firewalls (II) 11. Bastian Host 10. Intrusion Detection System (IDS) + Iprevention S (III) 12. Honey pot (IV)
  • 4. 1. Policy Management Part II 2. Vulnerability Assessment 4. Patch Management 3. Encryption (V + VI) 6. Incident Handling 5. OS Hardening (VII) 7. Client-Side Attacks 8. Ethical Hacking and Pen-Test 9. Penetration Testing 10. IT Infra Threat Modeling 11. Do and Don’ts 12. Best Practices
  • 5. Network security involves all activities that organizations, enterprises, and institutions undertake to protect the value and ongoing usability  of assets and the integrity and continuity of operations. An effective network security strategy requires identifying threats and then choosing the most  effective set of tools to combat them.
  • 6. Today’s system/network administration should includes security related activities such as patch management, OS, host and device hardening and network vulnerability  assessment. System/Network Administrators should be ready to perform those related activities to protect and prevent from malicious hackers, external and internal attacks.  Responsibilities of the System/Network Administrators should not only limited to managing and administering the existing system/network, security should be added since it’s  vital to protect the organization’s assets (data, information and IP).
  • 7. Computer programs written by devious programmers Viruses and designed to replicate themselves and infect  computers when triggered by a specific event. Delivery vehicles for destructive code, which appear to Trojan Horses Programs be harmless or useful software programs such as games.  Software applications or applets that cause destruction.  Vandals
  • 8. Attacks Information-gathering activities to collect data that is later ◦ Reconnaissance attacks used to compromise networks. Exploit network vulnerabilities in order to gain entry to e-mail, ◦ Access attacks databases, or the corporate network. Prevent access to part or all of a computer system. ◦ Denial-of-service (DoS) attacks
  • 9. Involves eavesdropping on communications or  Data Interception altering data packets being transmitted. Obtaining confidential network security information  Social Engineering through nontechnical means, such as posing as a technical support person and asking for people's passwords.
  • 14. None of the approaches alone will be sufficient to protect a network, but when they are layered together, they can be highly effective in keeping a  network safe from attacks and other threats to security. Well-thought-out corporate policies are critical to determine and control access to various parts of the network. 
  • 15. Security is not only about the technology, it’s about people, processes and other related components linked together. Do not just depend on technology  since they can change very fast and we may not be able to keep up. Human is the weakest link in the security chain. Educate people to reduce the threats and attacks (fact: 40% of the attacks are coming from the  Insider).
  • 16. Switches and routers have hardware and software features that support secure connectivity, perimeter security, intrusion protection, identity services, and  security management. Dedicated network security hardware and software- tools such as firewalls and intrusion detection systems provide protection for all areas of the  network and enable secure connections.
  • 17. Virtual Private Networks (VPN) provide access control and data encryption between two different computers on a network.  VPN allows remote workers to connect to the network without the risk of a hacker or thief intercepting data. 
  • 19. Identity management or ID management is a broad administrative area that deals with identifying individuals in a system (such as a country, a network or  an organization) and controlling the access to the resources in that system by placing restrictions on the established identities. Identity management or IDM is a term related to how humans are identified and authorized across computer networks. It covers issues such as how users are given  an identity, the protection of that identity and the technologies supporting that protection such as network protocols, digital certificates, passwords and so on.
  • 22. Anti-virus software is a necessary part of a good security program. If properly implemented and configured, it can reduce an organization’s exposure to malicious programs.  Anti-virus software only protects an organization from malicious programs (and not all of them—remember Melissa?).  Anti-virus software will not protect an organization from an intruder who misuses a legitimate program to gain access to a system.  Nor will anti-virus software protect an organization from a legitimate user who attempts to gain access to files that he should not have access to. 
  • 25. Each and every computer system within an organization should have the capability to restrict access to files based on the ID of the user attempting  the access. If systems are properly configured and the file permissions set appropriately, file access controls can restrict legitimate users from accessing files  they should not have access to.
  • 26. File access controls will not prevent someone from using a system vulnerability to gain access to the system as an administrator and thus see files on the  system. Even access control systems that allow the configuration of access controls on systems across the organization cannot do this, to the access control  system, such an attack will look like a legitimate administrator attempting to access files to which the account is allowed access.
  • 28. Firewalls are access control devices for the network and can assist in protecting an organization’s internal network from external attacks.  By their nature, firewalls are border security products, meaning that they exist on the border between the internal network and the external  network. Properly configured, firewalls have become a necessary security device. 
  • 29. Firewalls can be implemented in either hardware or software, or a combination of both.  Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets.  All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security  criteria.
  • 30. A firewall will not prevent an attacker from using an allowed connection to attack a system.  ◦ For example: if a Web server is allowed to be accessed from the outside and is vulnerable to an attack against the Web server software, a firewall will likely allow this attack since the Web server should receive Web connections. Firewalls will also not protect an organization from an internal user since that internal user is already on the internal network. 
  • 31. Firewall techniques: Packet filtering inspects each packet passing through the network and accepts or  Packet filter rejects it based on user-defined rules. Although difficult to configure, it is fairly effective and mostly transparent to its users. It is susceptible to IP spoofing. Applies security mechanisms to specific applications, such as FTP and Telnet Application gateway servers. This is very effective, but can impose a performance degradation.  Applies security mechanisms when a TCP or UDP connection is established. Once Circuit-level gateway the connection has been made, packets can flow between the hosts without further  checking. Intercepts all messages entering and leaving the network. The proxy server Proxy server effectively hides the true network addresses. 
  • 35. In computer security, a DMZ, or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger  untrusted network, usually the Internet. The term is normally referred to as a DMZ by IT professionals. It is sometimes referred to as a Perimeter Network.  The purpose of a DMZ is to add an additional layer of security to an organization's Local Area Network (LAN); an external attacker only has access to equipment in the  DMZ, rather than any other part of the network.
  • 36. Generally, any service that is being provided to users from an external network could be placed in the DMZ.  The most common of these services are web servers, mail servers, FTP servers, VoIP servers and DNS servers.  In some situations, additional steps need to be taken to be able to provide secure services. 
  • 39. Intrusion detection systems were once touted as the solution to the entire security problem.  No longer would we need to protect our files and systems, we could just identify when someone was doing something wrong and stop them.  Some of the intrusion detection systems were marketed with the ability to stop attacks before they were successful.  No intrusion detection system is foolproof and thus they cannot replace a good security program or good security practice. They will also not detect legitimate users who may  have incorrect access to information.
  • 40. Types of Intrusion Detection Systems: It is an independent platform that identifies intrusions by Network Intrusion Detection System (NIDS) examining network traffic and monitors multiple hosts. Network  Intrusion Detection Systems gain access to network traffic by connecting to a hub, network switch configured for port mirroring, or network tap. An example of a NIDS is Snort. It consists of an agent on a host that identifies intrusions by Host-based Intrusion Detection System (HIDS) analyzing system calls, application logs, file-system modifications  (binaries, password files, capability/acl databases) and other host activities and state. An example of a HIDS is OSSEC (open source free host-based intrusion detection system).
  • 43. A bastion host is a special purpose computer on a network specifically designed and configured to withstand attacks.  The computer generally hosts a single application, for example a proxy server, and all other services are removed or limited to reduce the threat to the computer.  It is hardened in this manner primarily due to its location and purpose, which is either on the outside of the firewall or in the DMZ and usually involves access  from untrusted networks or computers.
  • 44. There are two common network configurations that include bastion hosts and their placement. ◦ The first requires two firewalls, with bastion hosts sitting between  the first "outside world" firewall. ◦ An inside firewall, in a demilitarized zone (DMZ). Often smaller networks do not have multiple firewalls, so if only one firewall exists in a network, bastion hosts are commonly placed outside the firewall.  Bastion hosts are related to multi-homed hosts and screened hosts. While a dual-homed host often contains a firewall it is also used to host other services as well. A screened host is a  dual-homed host that is dedicated to running the firewall.
  • 45. 1. Web server Examples of bastion host systems/services: 2. DNS (Domain Name System) server 3. Email server 4. FTP (File Transfer Protocol) server 5. Proxy server 6. Honeypot 7. VPN (Virtual Private Network) server
  • 47. Honeypot is a trap set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems.  Generally it consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated, (un)protected, and monitored, and which  seems to contain information or a resource of value to attackers. A honeypot is valuable as a surveillance and early- warning tool. 
  • 48. While it is often a computer, a honeypot can take other forms, such as files or data records, or even unused IP address space.  A honeypot that masquerades as an open proxy to monitor and record those using the system is a sugarcane.  Honeypots should have no production value, and hence should not see any legitimate traffic or activity. 
  • 51. Policies and procedures are important components of a good security program and the management of policies across computer systems is equally important.  With a policy management system, an organization can be made aware of any system that does not conform to policy.  Policy management may not take into account vulnerabilities in systems or misconfigurations in application software, either of these may lead to a successful penetration.  Policy management on computer systems also does not guarantee that users will not write down their passwords or give their passwords to unauthorized individuals. 
  • 52. Assessing computer systems for vulnerabilities is an important part of a good security program. Such assessment will help an organization to identify  potential entry points for intruders. Vulnerability assessment will not protect your computer systems.  Each vulnerability must be fixed after it is identified. Vulnerability assessment will not detect legitimate users  who may have inappropriate access nor will it detect an intruder who is already in your systems. 
  • 55. Encryption is the primary mechanism for communications security. It will certainly protect information in transit.  Encryption might even protect information that is in storage by encrypting files. However, legitimate users must have access to these files.  The encryption system will not differentiate between legitimate and illegitimate users if both present the same keys to the encryption algorithm. Therefore, encryption by  itself will not provide security. There must also be controls on the encryption keys and the system as a whole. 
  • 58. Patch management is an area of systems management that involves: acquiring, testing, and installing multiple patches (code changes) to an  administered computer system. Effective patch management is the first line of defense for networks of any size.  Patch management is an important part of every IT administrator's responsibility. 
  • 59. To maintain a secure network, one must ensure that the latest security patches and operating system service packs are installed network-wide.  Patch management software also plays a part in adhering to the most recent compliance regulations such as the Sarbanes-Oxley Act and HIPAA, which  require enterprises to maintain control of their information assets.
  • 60. Effective patch management involves not only the discovery of software vulnerabilities but also the subsequent patch deployment to the multiple computers  on the network. IT administrators understand the effects that un- patched computers can have on a network.  Because they also fully recognize the challenge of ensuring network-wide protection, an easy-to- administer patch management solution has quickly  become the tool of choice for IT administrators.
  • 61. A number of products are available to automate patch management tasks.  Like its real world counterpart, a patch is a "make- do" fix rather than an elegant-solution. Patches are sometimes ineffective, and can sometimes cause  more problems than they fix.
  • 62. System administrators take simple steps to avoid problems, such as performing backups and testing patches on non-critical systems prior to  installations. Security patch management is patch management with a focus on reducing security vulnerabilities. It should not be a defensive procedure in reaction to  critical incidents.
  • 64. Patch Deployment Cycle: Detect - Use patch management software to scan for missing security patches. Detection should be automated and should trigger the patch management process.  Acquire - If the vulnerability is not addressed by the security measures already in place, download the patch for testing.  Test - Install the patch on a realistic operational environment to ensure that the security fixes are suitable and do not compromise your system.  Deploy - Allow patch deployment to the other computers on the network. Review this deployment to ensure its success with minimum impact on system users.  Maintain - Subscribe to notifications that alert you to vulnerabilities as they are reported. Once a new security patch is available, the process is started again. 
  • 65. 1. Maintaining current knowledge of available Patch Management task include: patches. 2. Deciding what patches are appropriate for particular systems. 3. Ensuring that patches are installed properly, testing systems after installation. 4. Documenting all associated procedures, such as specific configurations required.
  • 66. 1. http://technet.microsoft.com/en-us/wsus/default.aspx Patch Management Solutions: 2. http://www.shavlik.com 3. http://www.kaseya.com 4. http://www.symantec.com 5. http://www.ecora.com 6. http://www.lumension.com 7. http://www.gfi.com 8. http://www.landesk.com 9. http://www.manageengine.com 10. http://www.everdream.com
  • 70. OS Hardening is the process to address security weaknesses in operation systems by implementing the latest OS paches, hotfixes and updates and  following procedures and policies to reduce attacks and system down time. The idea of OS hardening is to minimize a computer's exposure to current and future threats by fully configuring the operating system and  removing unnecessary applications.
  • 71. Incident handling is a generalized term that refers to the response by a person or organization to an attack.  An organized and careful reaction to an incident can mean the difference between complete recovery and total disaster. 
  • 72. Incident Handling Steps: Preparation - Comprehensively addressing the issue of security includes methods to prevent attack as well as how to respond to a successful one.  Identification of Attack - The first post-attack step in Incident handling is the identification of an incident. Identification of an incident becomes more difficult as the complexity of the attack grows.  Containment of Attack - Once an attack has been identified, steps must be taken to minimize the effects of the attack. Containment allows the user or administrator to protect other systems and networks from the attack and limit damage.  Recovery and Analysis - The recovery phase allows users to assess what damage has been incurred, what information has been lost and what the post-attack status of the system is. Once the user can be assured that the attack has been contained, it  is helpful to conduct an analysis of the attack.
  • 73. Case Study (Discussion) 1. Preparation Viruses Outbreak 2. Identification of the attack  3. Containment of the attack 4. Recovery & Analysis 1. Preparation System Compromise 2. Identification of the attack  3. Containment of the attack 4. Recovery & Analysis
  • 74. Traditionally, attackers went for hacking servers, but there has been a shift to the client side because server-side applications have been targets for attackers since 2001, and these applications have  matured. Attackers are going after weaknesses in desktop applications such as browsers, media players, common office applications and e-mail  clients. The remedy is to maintain the most current application patch levels, keep antivirus software updated and seek and remove unauthorized applications.  Keeping authorized software to a minimum also decreases exposure. 
  • 75. Application vulnerabilities exceeds OS vulnerabilities
  • 76.  Two main avenues for exploiting and compromising web servers: Web Application Attacks brute force password guessing attacks and web application attacks. Microsoft SQL, FTP, and SSH servers are popular targets for password guessing attacks because of the access that is gained if a valid username/password pair is identified.  SQL Injection, Cross-site Scripting and PHP File Include attacks continue to be the three most popular techniques used for compromising web sites.  Automated tools, designed to target custom web application vulnerabilities, make it easy to discover and infect several thousand web sites. 
  • 77.  Attacks on Microsoft Windows operating systems were Windows: Conficker/Downadup dominated by Conficker/ Downadup worm variants. For the past six months, over 90% of the attacks recorded for Microsoft targeted the buffer overflow vulnerability described in the Microsoft Security Bulletin  MS08-067. Although in much smaller proportion, Sasser and Blaster, the infamous worms from 2003 and 2004, continue to infect many networks. 
  • 78. Attacks on critical Microsoft vulnerabilities
  • 79. Attacks on critical Microsoft vulnerabilities
  • 80. Attacks on critical Apple vulnerabilities
  • 81.  Step 0: Attacker places contents on trusted site. Client-Side Attacks Example (Step-by-Step)  Step 1: Client-side exploitation.  Step 2: Established reverse shell backdoor using HTTPS.  Step 3: Dump hashes and use pass-the-hash attack to pivot.  Step 4: Pass the hash to compromise Domain Controller.
  • 82. Step 0: Attacker places contents on trusted site
  • 83. Step 1: Client-side exploitation
  • 84. Step 2: Established reverse shell backdoor using HTTPS
  • 85. Step 3: Dump hashes and use pass-the-hash attack to pivot
  • 86. Step 4: Pass the hash to compromise Domain Controller
  • 87. A penetration test of which the goal is to discover Ethical Hacking trophies throughout the network within the  predetermined project time limit. A goal-oriented project of which the goal is the Penetration Testing trophy and includes gaining privileged access by  pre-conditional means.
  • 88. A penetration test is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source, known  as a Black Hat Hacker, or Cracker. The process involves an active analysis of the system for any potential vulnerabilities that may result from poor or improper system configuration, known  and/or unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures.
  • 89. Analysis is carried out from the position of a potential attacker, and can involve active exploitation of security vulnerabilities.  Any security issues that are found will be presented to the system owner together with an assessment of their impact and often with a proposal for mitigation or a technical  solution. The intent of a penetration test is to determine feasibility of an attack and the amount of business impact of a successful exploit, if discovered.   It is a component of a full security audit.
  • 90. The IT Infrastructure Threat Modeling Guide provides an easy-to-understand method for developing threat models that can help prioritize  investments in IT infrastructure security. This guide describes and considers the extensive methodology that exists for Security Development Lifecycle (SDL) threat modeling and uses it to  establish a threat modeling process for IT infrastructure.
  • 91. Primary steps of the Threat Modeling Process:
  • 92. Threat Modeling Guide is designed to help IT 1. Identify threats that could affect their professionals accomplish the following: organizations’ IT infrastructures. 2. Discover and mitigate design and implementation issues that could put IT infrastructures at risk. 3. Prioritize budget and planning efforts to address the most significant threats. 4. Conduct security efforts for both new and existing IT infrastructure components in a more proactive and cost-effective manner.
  • 93. 1. Do choose your passwords carefully. Dos: 2. Do learn about network security. 3. Do save your work-related data on the network. 4. Do encrypt data. 5. Do utilize network virus protection software. 6. Do report any unauthorized use of your computer. 7. Do lock your workstation when you step away from your computer. 8. Do inform administrators of employee departures.
  • 94. 1. Don’t leave passwords around your workplace. Don’ts: 2. Don’t save personal or sensitive information on shared network resources. 3. Don’t open suspect e-mails. 4. Don’t leave sensitive data on your hard drive. 5. Don’t use automatic login features. 6. Network security should always be taken seriously.
  • 95. In order to effectively secure your network environment, you must first become Assess Your Environment familiar with all of its components.  Being part of the connected world brings many benefits as well as challenges. Any Protect Your Network computer within your network that is connected to the Internet, directly or  indirectly, is a potential risk for an attack from viruses or external attackers. You should be sure to take sufficient steps to harden your core operating systems Protect Your Servers and Clients and major applications from common attacks.  Monitoring and auditing are central to an organization's security efforts. We often Monitor Your Environment think of monitoring as watching and waiting for an event to occur so that we can  react to the situation.
  • 96. 1. Selecting a Good Anti-Virus Software 2. Testing and Evaluating Anti-Virus Software 3. Analyzing and Implementing File & Folder Permissions 4. Analyzing and Implementing Database Security 5. Analyzing Local Security Policy 6. Analyzing and Implementing Security Templates 7. Implementing Group Policy 8. Implementing Encrypted File System (EFS) 9. Implementing Disk Encryption 10. Selecting Patch Management solutions 11. Implementing Patch Management 12. Configuring IDS and Firewall 13. Analyzing IDS and Firewall Rules 14. Testing IDS and Firewall