Threat Pragmatics. Target 6/19/ June 2018 PacNOG 22, Honiara, Solomon Islands Supported by:
|
|
- Ginger Hamilton
- 5 years ago
- Views:
Transcription
1 Threat Pragmatics June 2018 PacNOG 22, Honiara, Solomon Islands Supported by: Issue Date: Revision: 1 Target Many sorts of targets: Network infrastructure Network services Application services User machines What s at risk? 1
2 Attacks on Different Layers Application Presentation Session Transport Network Data Link Physical OSI Reference Model Layer 5: NFS, Socks Application Layer 7: HTTP, FTP, IMAP, LDAP, NTP, Radius, SSH, SMTP, SNMP, Telnet, DNS, DHCP DNS Poisoning, Phishing, SQL injection, Spam/Scam Transport Layer 4: TCP, UDP, SCTP TCP attacks, Routing attack, SYN flooding Internet Layer 3: IPv4, IPv6, ICMP, ICMPv6, IGMP Ping/ICMP Flood, Sniffing Layer 2: Ethernet, PPP, ARP, NDP Network Access (Link Layer) ARP spoofing, MAC flooding TCP/IP Model 3 Layer 2 Attacks ARP Spoofing MAC attacks DHCP attacks VLAN hopping 4 2
3 ARP Spoofing I want to connect to I don t know the MAC address Wait, I am ! ARP Request BB-BB-BB-BB-BB-BB AA-AA-AA-AA-AA-AA ARP Reply CC-CC-CC-CC-CC-CC ARP Cache poisoned. Machine A connects to Machine D (not C) ARP Reply DD-DD-DD-DD-DD-DD I am This is my MAC address 5 MAC Flooding Exploits the limitation of all switches CAM = Content Addressable memory = stores info on the mapping of individual MAC addresses to physical ports on the switch. Attacker floods the switch interface with very large number of Ethernet frames with different fake source MAC address. Port 1 Port 2 Port 3 Port 4 00:01:23:45:67:A1 x 00:01:23:45:67:B2 x 00:01:23:45:67:C3 x 00:01:23:45:67:D4 x 6 3
4 DHCP Attacks DHCP Starvation Attack Broadcasting vast number of DHCP requests with spoofed MAC address simultaneously. DoS attack using DHCP leases Rogue DHCP Server Attacks Server runs out of IP addresses to allocate to valid users Attacker sends many different DHCP requests with many spoofed addresses. 7 Man in the Middle Attacks (Wireless) Creates a fake access point and have clients authenticate to it instead of a legitimate one. Capture traffic to see usernames, passwords, etc that are sent in clear text. 8 4
5 Link-Layer Defense Dynamic ARP Inspection Protects against ARP spoofing uses DHCP Snooping forward ARP packets on Trusted interfaces without checks intercept all ARP packets on Untrusted ports and check against IP-to- MAC binding Drop (and log) if no valid binding 9 Link-Layer Defense Port Security Protects the MAC table Limit the number of MACs per port (static or sticky learning) Forwards valid frames (valid source MACs), and drops invalid frames Violation could trigger: Dropping of invalid frames and port shutdown, or Drop frames with/without notification 10 5
6 Link-Layer Defense 802.1X Identity based network access control Protection against rogue devices (DHCP or AP) attaching to a LAN 11 Layer 3 Attacks ICMP Ping Flood ICMP Smurf Ping of death 12 6
7 ICMP Smurf Attacker Echo request Src ip = victim Network ICMP Smurf is one type of DDOS attack. Other forms of ICMP attack: -Ping of death Echo request Broadcast Enabled Network Echo reply to actual destination Defense: Disable directed broadcast no ip directed-broadcast Victim 13 Routing Attacks Malicious route insertion Poison routing table To divert traffic and eavesdrop Analyse/Modify/Drop packets BGP attacks hijack prefixes Tamper the path information 14 7
8 Defense- Routing Attacks Authenticate source of routing updates Peer authentication Origin Validation Rolled out today as RPKI ROA (resource certificate) signed by the owner Verifies the origin AS (signed route announcement) Path Validation Sign the full path (ASNs traversed) In IETF process as BGPsec 15 TCP Attacks SYN Flood occurs when an attacker sends SYN requests in succession to a target. Causes a host to retain enough state for bogus halfconnections such that there are no resources left to establish new legitimate connections. 16 8
9 TCP Attacks Exploits the TCP 3-way handshake Attacker sends a series of SYN packets without replying with the ACK packet Finite queue size for incomplete connections SYN SYN+ACK ACK CONNECTION ESTABLISHED Server 17 TCP Attacks Exploits the TCP 3-way handshake Attacker sends a series of SYN packets without replying with the ACK packet Finite queue size for incomplete connections SYN SYN+ACK Attacker ACK? Server (Victim) OPEN CONNECTIONS 18 9
10 Application Layer Attacks Scripting vulnerabilities Cookie poisoning Buffer overflow Hidden field manipulation Parameter tampering Cross-site scripting SQL injection 19 DoS A Denial of Service attack aims to disrupt the availability of a service such as a machine or network resource by Flooding Bandwidth number of connections crashing the service Nowadays also known as stress tests 20 10
11 Layer 7 DDoS Attack Traditional DoS attacks focus on Layer 3 and Layer 4 In Layer 7, a DoS attack is targeted towards the applications disguised as legitimate packets The aim is to exhaust application resources (bandwidth, ports, protocol weakness) rendering it unusable Includes: HTTP GET HTTP POST Slowloris LOIC / HOIC RUDY (R-U-Dead Yet) 21 Layer 7 DDoS Slowloris Incomplete HTTP requests Properties Low bandwidth Keep sockets alive Only affects certain web servers Doesn t work through load balancers Managed to work around accf_http 22 11
12 Distributed Denial of Service attack 23 DNS Attack Example On 26th Jan 2015, Domain Name System (DNS) has been compromised where users are re-directed to a hacker website 24 12
13 DNS Changer Criminals have learned that if they can control a user s DNS servers, they can control what sites the user connects to the Internet. How: infect computers with a malicious software (malware) This malware changes the user s DNS settings with that of the attacker s DNS servers Points the DNS configuration to DNS resolvers in specific address blocks and use it for their criminal enterprise 25 DNS Changer - Defense Find out if you are infected FBI: forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-dns /20; /20; /24; /20; /23; /20 DNSChanger Working Group: Clean up: Run free anti-malware tools DNSChanger WG site maintains clean-up guides and list of free tools toremove the malware firewall rules to only allow queries to legitimate servers 26 13
14 DNS Cache Poisoning Caching incorrect resource record that did not originate from authoritative DNS sources. Result: connection (web, , network) is redirected to another target (controlled by the attacker) 27 DNS Cache Poisoning 1 I want to access QID=64569 QID=64570 QID=64571 match! (pretending to be the authoritative zone) Client 2 DNS Caching Server QID=64571 Root/GTLD Webserver ( ) QID= ns.example.com 28 14
15 Best Practices Preventing Unauthorised changes / Transfer Registry Lock Services 2 Factor Authentication DNS Sec Can be used to protect the communication between authoritative servers, and between authoritative servers and cache servers. 29 Amplification Attacks Distributed Reflection Denial of Service attack No need for a botnet, just use existing servers with UDP services. Some services can be misused because they amplify the request: DNS, NTP, SNMP, 1 small query in, 1 large answer out This misuse can be avoided by disabling specific options or implementing firewall rules. Typical amplification factors DNS: ~ NTP: ~ SNMP: ~
16 DNS Amplification Attack A type of reflection attack combined with amplification Source of attack is reflected off another machine Traffic received is bigger (amplified) than the traffic sent by the attacker UDP packet s source address is spoofed 31 DNS Amplification Queries for Root/GTLD DNS Recursive server Compromised Machines (spoofed IP) ns.example.com Victim Machine Attacker 32 16
17 Source IP spoofing Defense BCP38 (RFC2827) Since 1998! Only allow traffic with valid source addresses to Leave your network Only from your own address space To enter/transit your network Only from downstream customer address space This document is uncontrolled when printed. Before use, check the APNIC electronic master document to verify that this is the current version. 33 urpf Unicast Reverse Path Unicast Reverse Path Forwarding (urpf) Router verifies if the source address of any packets received is in the FIB table and reachable (routing table) Drop if not valid! Recommended on customer facing interfaces 34 17
18 NTP Amplification Network Time Protocol (NTP) Port 123/UDP Exploits NTP versions older than v4.2.7 monlist Several incidents in Gbps attack on cloud provider 35 NTP Amplification - Defense BCP38 Upgrade NTP (ntpd) server to v4.2.7p26 or later Removes/disables monlist command; replaced with mrulist Requires proof that the command came from the address in the NTP packet In older versions: disable ntp monitor and do not answer ntpq/ntpdc queries This document is uncontrolled when printed. Before use, check the APNIC electronic master document to verify that this is the current version
19 Attacks on Different Layers Application Presentation Session Transport Network Data Link Physical OSI Reference Model Layer 5: NFS, Socks Application Layer 7: HTTP, FTP, IMAP, LDAP, NTP, Radius, SSH, SMTP, SNMP, Telnet, DNS, DHCP DNS HTTPS, Poisoning, DNSSEC, Phishing, PGP, SQL injection, SMIME Spam/Scam Transport Layer 4: TCP, UDP, SCTP TCP TLS, attacks, SSL, Routing SSH attack, SYN flooding Internet Layer 3: IPv4, IPv6, ICMP, ICMPv6, IGMP Ping/ICMP IPsec Flood, Sniffing Layer 2: Ethernet, PPP, ARP, NDP, OSPF Network Access flooding (Link Layer) IEEE ARP 802.1X, spoofing, PPP MAC & PPTP TCP/IP Model 37 Transport Layer Security Secure Socket Layer (SSL) Secure Shell Protocol 38 19
20 Application Layer Security HTTPS PGP (Pretty Good Privacy) SMIME (Secure Multipurpose Internet Mail Extensions) TSIG and DNSSEC Wireless Encryption - WEP, WPA, WPA
Threat Pragmatics & Cryptography Basics. PacNOG July, 2017 Suva, Fiji
Threat Pragmatics & Cryptography Basics PacNOG20 3-7 July, 2017 Suva, Fiji Issue Date: [31-12-2015] Revision: [V.1] Why Security? The Internet was initially designed for connectivity Trust is assumed,
More informationCyber Security Threat Pragmatics & Cryptography. Cyber Security & Network Security March, 2017 Dhaka, Bangladesh
Cyber Security Threat Pragmatics & Cryptography Cyber Security & Network Security 20-22 March, 2017 Dhaka, Bangladesh Issue Date: [31-12-2015] Revision: [V.1] Global Cyber Security Trend It s Global Issue
More informationCSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 18: Network Attacks Department of Computer Science and Engineering University at Buffalo 1 Lecture Overview Network attacks denial-of-service (DoS) attacks SYN
More informationNetwork Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
More informationInternetwork Expert s CCNA Security Bootcamp. Common Security Threats
Internetwork Expert s CCNA Security Bootcamp Common Security Threats http:// Today s s Network Security Challenge The goal of the network is to provide high availability and easy access to data to meet
More informationCS Paul Krzyzanowski
The Internet Packet switching: store-and-forward routing across multiple physical networks... across multiple organizations Computer Security 11. Network Security ISP Paul Krzyzanowski Rutgers University
More informationComputer Security. 11. Network Security. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 11. Network Security Paul Krzyzanowski Rutgers University Spring 2018 April 15, 2018 CS 419 2018 Paul Krzyzanowski 1 The Internet Packet switching: store-and-forward routing across multiple
More informationRouting Security DDoS and Route Hijacks. Merike Kaeo CEO, Double Shot Security
Routing Security DDoS and Route Hijacks Merike Kaeo CEO, Double Shot Security merike@doubleshotsecurity.com DISCUSSION POINTS Understanding The Growing Complexity DDoS Attack Trends Packet Filters and
More informationLayer 4: UDP, TCP, and others. based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers
Layer 4: UDP, TCP, and others based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers Concepts application set transport set High-level, "Application Set" protocols deal only with how handled
More informationInternet Layers. Physical Layer. Application. Application. Transport. Transport. Network. Network. Network. Network. Link. Link. Link.
Internet Layers Application Application Transport Transport Network Network Network Network Link Link Link Link Ethernet Fiber Optics Physical Layer Wi-Fi ARP requests and responses IP: 192.168.1.1 MAC:
More information20-CS Cyber Defense Overview Fall, Network Basics
20-CS-5155 6055 Cyber Defense Overview Fall, 2017 Network Basics Who Are The Attackers? Hackers: do it for fun or to alert a sysadmin Criminals: do it for monetary gain Malicious insiders: ignores perimeter
More informationNETWORK SECURITY. Ch. 3: Network Attacks
NETWORK SECURITY Ch. 3: Network Attacks Contents 3.1 Network Vulnerabilities 3.1.1 Media-Based 3.1.2 Network Device 3.2 Categories of Attacks 3.3 Methods of Network Attacks 03 NETWORK ATTACKS 2 3.1 Network
More informationTOP TEN DNS ATTACKS PROTECTING YOUR ORGANIZATION AGAINST TODAY S FAST-GROWING THREATS
TOP TEN DNS ATTACKS PROTECTING YOUR ORGANIZATION AGAINST TODAY S FAST-GROWING THREATS 1 Introduction Your data and infrastructure are at the heart of your business. Your employees, business partners, and
More informationImma Chargin Mah Lazer
Imma Chargin Mah Lazer How to protect against (D)DoS attacks Oliver Matula omatula@ernw.de #2 Denial of Service (DoS) Outline Why is (D)DoS protection important? Infamous attacks of the past What types
More informationChapter 2. Switch Concepts and Configuration. Part II
Chapter 2 Switch Concepts and Configuration Part II CCNA3-1 Chapter 2-2 Switch Concepts and Configuration Configuring Switch Security MAC Address Flooding Passwords Spoofing Attacks Console Security Tools
More informationOur Narrow Focus Computer Networking Security Vulnerabilities. Outline Part II
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2016 www.cs.cmu.edu/~prs/15-441-f16 Yes: Creating a secure channel for communication (Part I) Protecting
More informationSecurity+ Guide to Network Security Fundamentals, Fourth Edition. Network Attacks Denial of service Attacks
Security+ Guide to Network Security Fundamentals, Fourth Edition Network Attacks Denial of service Attacks Introduction: What is DoS? DoS attack is an attempt (malicious or selfish) by an attacker to cause
More informationRemember Extension Headers?
IPv6 Security 1 Remember Extension Headers? IPv6 allows an optional Extension Header in between the IPv6 header and upper layer header Allows adding new features to IPv6 protocol without major re-engineering
More informationNetwork Security. Network Vulnerabilities
Network Security Network Vulnerabilities 1 Attacks and the OSI Stack Stack layer Services Protocols Application; Presentation; Session Transport DNS SMTP TCP Network Routers IP Logic Physical Switches
More informationInternetwork Expert s CCNA Security Bootcamp. Mitigating Layer 2 Attacks. Layer 2 Mitigation Overview
Internetwork Expert s CCNA Security Bootcamp Mitigating Layer 2 Attacks http:// Layer 2 Mitigation Overview The network is only as secure as its weakest link If layer 2 is compromised, all layers above
More informationDNS Security. Ch 1: The Importance of DNS Security. Updated
DNS Security Ch 1: The Importance of DNS Security Updated 8-21-17 DNS is Essential Without DNS, no one can use domain names like ccsf.edu Almost every Internet communication begins with a DNS resolution
More informationPROTECTING INFORMATION ASSETS NETWORK SECURITY
PROTECTING INFORMATION ASSETS NETWORK SECURITY PAUL SMITH 20 years of IT experience (desktop, servers, networks, firewalls.) 17 years of engineering in enterprise scaled networks 10+ years in Network Security
More informationOur Narrow Focus Computer Networking Security Vulnerabilities. IP-level vulnerabilities
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2014 www.cs.cmu.edu/~prs/15-441-f14 Yes: Creating a secure channel for communication (Part I) Protecting
More informationnetwork security s642 computer security adam everspaugh
network security s642 adam everspaugh ace@cs.wisc.edu computer security today Announcement: HW3 to be released WiFi IP, TCP DoS, DDoS, prevention 802.11 (wifi) STA = station AP = access point BSS = basic
More informationConfiguring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
More informationN exam.420q. Number: N Passing Score: 800 Time Limit: 120 min N CompTIA Network+ Certification
N10-006.exam.420q Number: N10-006 Passing Score: 800 Time Limit: 120 min N10-006 CompTIA Network+ Certification Sections 1. Network security 2. Troubleshooting 3. Industry standards, practices, and network
More informationEthical Hacking and Prevention
Ethical Hacking and Prevention This course is mapped to the popular Ethical Hacking and Prevention Certification Exam from US-Council. This course is meant for those professionals who are looking for comprehensive
More informationTCP/IP Networking. Training Details. About Training. About Training. What You'll Learn. Training Time : 9 Hours. Capacity : 12
TCP/IP Networking Training Details Training Time : 9 Hours Capacity : 12 Prerequisites : There are no prerequisites for this course. About Training About Training TCP/IP is the globally accepted group
More informationCSC 574 Computer and Network Security. TCP/IP Security
CSC 574 Computer and Network Security TCP/IP Security Alexandros Kapravelos kapravelos@ncsu.edu (Derived from slides by Will Enck and Micah Sherr) Network Stack, yet again Application Transport Network
More informationChair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 8
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 8 System Vulnerabilities and Denial of Service Attacks System Vulnerabilities and
More informationELEC5616 COMPUTER & NETWORK SECURITY
ELEC5616 COMPUTER & NETWORK SECURITY Lecture 17: Network Protocols I IP The Internet Protocol (IP) is a stateless protocol that is used to send packets from one machine to another using 32- bit addresses
More informationECE 435 Network Engineering Lecture 23
ECE 435 Network Engineering Lecture 23 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 30 November 2017 HW#11 will be posted Announcements Don t forget projects next week Presentation
More informationHP High-End Firewalls
HP High-End Firewalls Attack Protection Configuration Guide Part number: 5998-2650 Software version: F1000-A-EI&F1000-S-EI: R3721 F5000: F3210 F1000-E: F3171 Firewall module: F3171 Document version: 6PW101-20120719
More informationDenial of Service. EJ Jung 11/08/10
Denial of Service EJ Jung 11/08/10 Pop Quiz 3 Write one thing you learned from today s reading Write one thing you liked about today s reading Write one thing you disliked about today s reading Announcements
More informationAN TOÀN LỚP 4: TCP/IP ATTACKS NGUYEN HONG SON PTITHCM
1 AN TOÀN LỚP 4: TCP/IP ATTACKS NGUYEN HONG SON PTITHCM 2 Introduction (1/2) TCP provides a full duplex reliable stream connection between two end points A connection is uniquely defined by the quadruple
More informationCloudflare Advanced DDoS Protection
Cloudflare Advanced DDoS Protection Denial-of-service (DoS) attacks are on the rise and have evolved into complex and overwhelming security challenges. 1 888 99 FLARE enterprise@cloudflare.com www.cloudflare.com
More informationCS670: Network security
Cristina Nita-Rotaru CS670: Network security ARP, TCP 1: Background on network protocols OSI/ISO Model Application Presentation Session Transport Network Data Link Physical Layer Application Presentation
More informationDenial of Service. Eduardo Cardoso Abreu - Federico Matteo Bencic - Pavel Alexeenko -
Denial of Service Eduardo Cardoso Abreu - e.abreu@fe.up.pt Federico Matteo Bencic - up201501013@fe.up.pt Pavel Alexeenko - ei11155@fe.up.pt Index What is Denial of Service (DoS)? DoS vs DDoS (Distributed
More informationEndpoint Security - what-if analysis 1
Endpoint Security - what-if analysis 1 07/23/2017 Threat Model Threats Threat Source Risk Status Date Created File Manipulation File System Medium Accessing, Modifying or Executing Executable Files File
More informationNetwork Security. Tadayoshi Kohno
CSE 484 (Winter 2011) Network Security Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials...
More informationNetwork Security. Evil ICMP, Careless TCP & Boring Security Analyses. Mohamed Sabt Univ Rennes, CNRS, IRISA Thursday, October 4th, 2018
Network Security Evil ICMP, Careless TCP & Boring Security Analyses Mohamed Sabt Univ Rennes, CNRS, IRISA Thursday, October 4th, 2018 Part I Internet Control Message Protocol (ICMP) Why ICMP No method
More informationGigabit SSL VPN Security Router
As Internet becomes essential for business, the crucial solution to prevent your Internet connection from failure is to have more than one connection. PLANET is the ideal to help the SMBs increase the
More informationExam Questions SY0-401
Exam Questions SY0-401 CompTIA Security+ Certification https://www.2passeasy.com/dumps/sy0-401/ 1. A company has implemented PPTP as a VPN solution. Which of the following ports would need to be opened
More informationSecurity in inter-domain routing
DD2491 p2 2011 Security in inter-domain routing Olof Hagsand KTH CSC 1 Literature Practical BGP pages Chapter 9 See reading instructions Beware of BGP Attacks (Nordström, Dovrolis) Examples of attacks
More informationChapter 10: Denial-of-Services
Chapter 10: Denial-of-Services Technology Brief This chapter, "Denial-of-Service" is focused on DoS and Distributed Denial-of-Service (DDOS) attacks. This chapter will cover understanding of different
More informationA Framework for Optimizing IP over Ethernet Naming System
www.ijcsi.org 72 A Framework for Optimizing IP over Ethernet Naming System Waleed Kh. Alzubaidi 1, Dr. Longzheng Cai 2 and Shaymaa A. Alyawer 3 1 Information Technology Department University of Tun Abdul
More informationIntroduction to Network. Topics
Introduction to Network Security Chapter 7 Transport Layer Protocols 1 TCP Layer Topics Responsible for reliable end-to-end transfer of application data. TCP vulnerabilities UDP UDP vulnerabilities DNS
More informationLecture 6. Internet Security: How the Internet works and some basic vulnerabilities. Thursday 19/11/2015
Lecture 6 Internet Security: How the Internet works and some basic vulnerabilities Thursday 19/11/2015 Agenda Internet Infrastructure: Review Basic Security Problems Security Issues in Routing Internet
More informationInt ernet w orking. Internet Security. Literature: Forouzan: TCP/IP Protocol Suite : Ch 28
Int ernet w orking Internet Security Literature: Forouzan: TCP/IP Protocol Suite : Ch 28 Internet Security Internet security is difficult Internet protocols were not originally designed for security The
More informationConfiguring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
More informationCTS2134 Introduction to Networking. Module 08: Network Security
CTS2134 Introduction to Networking Module 08: Network Security Denial of Service (DoS) DoS (Denial of Service) attack impacts system availability by flooding the target system with traffic or by exploiting
More informationFlashback.. Internet design goals. Security Part One: Attacks and Countermeasures. Why did they leave it out? Security Vulnerabilities
Flashback.. Internet design goals Security Part One: Attacks and Countermeasures 15-441 With slides from: Debabrata Dash,Nick Feamster, Vyas Sekar 15-411: F08 security 1 1. Interconnection 2. Failure resilience
More informationChapter Three test. CompTIA Security+ SYO-401: Read each question carefully and select the best answer by circling it.
Chapter Three test Name: Period: CompTIA Security+ SYO-401: Read each question carefully and select the best answer by circling it. 1. What protocol does IPv6 use for hardware address resolution? A. ARP
More informationManaging and Securing Computer Networks. Guy Leduc. Chapter 7: Securing LANs. Chapter goals: security in practice: Security in the data link layer
Managing and Securing Computer Networks Guy Leduc Chapter 7: Securing LANs Computer Networking: A Top Down Approach, 7 th edition. Jim Kurose, Keith Ross Addison-Wesley, April 2016. (section 8.8) Also
More informationECE 435 Network Engineering Lecture 23
ECE 435 Network Engineering Lecture 23 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 4 December 2018 Announcements HW#9 graded Don t forget projects next week Presentation schedule
More informationCIS 5373 Systems Security
CIS 5373 Systems Security Topic 4.1: Network Security Basics Endadul Hoque Slide Acknowledgment Contents are based on slides from Cristina Nita-Rotaru (Northeastern) 2 Network Security INTRODUCTION 3 What
More informationIntroduction to Computer Security
Introduction to Computer Security Instructor: Mahadevan Gomathisankaran mgomathi@unt.edu CSCE 4550/5550, Fall 2009 Lecture 7 1 Projects Groups Max 3 persons Topics Cryptography Network Security Program
More informationChapter 7. Denial of Service Attacks
Chapter 7 Denial of Service Attacks DoS attack: An action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU),
More informationNetwork and Internet Vulnerabilities
Network and Internet Vulnerabilities Computer Security Lecture 10 Mike Just 1 School of Informatics University of Edinburgh 15th February 2010 1 Based on original lecture notes by David Aspinall Internet
More informationCSC 6575: Internet Security Fall Attacks on Different OSI Layer Protocols OSI Layer Basic Attacks at Lower Layers
CSC 6575: Internet Security Fall 2017 Attacks on Different OSI Layer Protocols OSI Layer Basic Attacks at Lower Layers Mohammad Ashiqur Rahman Department of Computer Science College of Engineering Tennessee
More informationNetwork Security. The Art of War in The LAN Land. Mohamed Sabt Univ Rennes, CNRS, IRISA Thursday, September 27th, 2018
Network Security The Art of War in The LAN Land Mohamed Sabt Univ Rennes, CNRS, IRISA Thursday, September 27th, 2018 Part I MAC Attacks MAC Address/CAM Table Review 48 Bit Hexadecimal Number Creates Unique
More informationCurso: Ethical Hacking and Countermeasures
Curso: Ethical Hacking and Countermeasures Module 1: Introduction to Ethical Hacking Who is a Hacker? Essential Terminologies Effects of Hacking Effects of Hacking on Business Elements of Information Security
More informationAURA ACADEMY Training With Expertised Faculty Call Us On For Free Demo
ETHICAL HACKING (CEH) CURRICULUM Introduction to Ethical Hacking What is Hacking? Who is a Hacker? Skills of a Hacker? Types of Hackers? What are the Ethics and Legality?? Who are at the risk of Hacking
More informationCSCI 680: Computer & Network Security
CSCI 680: Computer & Network Security Lecture 15 Prof. Adwait Nadkarni Fall 2017 Derived from slides by William Enck and Micah Sherr 1 Grading Class Participat ion and Quizzes 10% Grade Breakdown Homewo
More informationCISNTWK-440. Chapter 4 Network Vulnerabilities and Attacks
CISNTWK-440 Intro to Network Security Chapter 4 Network Vulnerabilities and Attacks Objectives Explain the types of network vulnerabilities List categories of network attacks Define different methods of
More informationLecture 33. Firewalls. Firewall Locations in the Network. Castle and Moat Analogy. Firewall Types. Firewall: Illustration. Security April 15, 2005
Firewalls Lecture 33 Security April 15, 2005 Idea: separate local network from the Internet Trusted hosts and networks Intranet Firewall DMZ Router Demilitarized Zone: publicly accessible servers and networks
More informationBGP Security. Kevin s Attic for Security Research
Kevin s Attic for Security Research kevinkoo001@gmail.com Table 1. BGP Operation (1): Concept & Topology 2. BGP Operation (2): Message Exchange, Format and Path Decision Algorithm 3. Potential Attacks
More informationComputer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition. Chapter 3 Investigating Web Attacks
Computer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition Chapter 3 Investigating Web Attacks Objectives After completing this chapter, you should be able to: Recognize the indications
More informationData Plane Protection. The googles they do nothing.
Data Plane Protection The googles they do nothing. Types of DoS Single Source. Multiple Sources. Reflection attacks, DoS and DDoS. Spoofed addressing. Can be, ICMP (smurf, POD), SYN, Application attacks.
More informationAre You Fully Prepared to Withstand DNS Attacks?
WHITE PAPER Are You Fully Prepared to Withstand DNS Attacks? Fortifying Mission-Critical DNS Infrastructure Are You Fully Prepared to Withstand DNS Attacks? Fortifying Mission-Critical DNS Infrastructure
More information(DNS, and DNSSEC and DDOS) Geoff Huston APNIC
D* (DNS, and DNSSEC and DDOS) Geoff Huston APNIC How to be bad 2 How to be bad Host and application-based exploits abound And are not going away anytime soon! And there are attacks on the Internet infrastructure
More informationWhen does it work? Packet Sniffers. INFO Lecture 8. Content 24/03/2009
Packet Sniffers INFO 404 - Lecture 8 24/03/2009 nfoukia@infoscience.otago.ac.nz Definition Sniffer Capabilities How does it work? When does it work? Preventing Sniffing Detection of Sniffing References
More informationUDP-based Amplification Attacks and its Mitigations
UDP-based Amplification Attacks and its Mitigations Yoshiaki Kasahara kasahara@nc.kyushu-u.ac.jp 1/21/2014 APAN 37th in Bandung, Indonesia 1 Summary If you have servers with global IP addresses 1. Make
More informationCSc 466/566. Computer Security. 18 : Network Security Introduction
1/81 CSc 466/566 Computer Security 18 : Network Security Introduction Version: 2012/05/03 13:57:28 Department of Computer Science University of Arizona collberg@gmail.com Copyright c 2012 Christian Collberg
More informationAugust 14th, 2018 PRESENTED BY:
August 14th, 2018 PRESENTED BY: APPLICATION LAYER ATTACKS 100% 80% 60% 40% 20% 0% DNS is the second most targeted protocol after HTTP. DNS DoS techniques range from: Flooding requests to a given host.
More informationPrepAwayExam. High-efficient Exam Materials are the best high pass-rate Exam Dumps
PrepAwayExam http://www.prepawayexam.com/ High-efficient Exam Materials are the best high pass-rate Exam Dumps Exam : 642-618 Title : Deploying Cisco ASA Firewall Solutions (FIREWALL v2.0) Vendors : Cisco
More informationH
H12-721 Number: H12-721 Passing Score: 800 Time Limit: 120 min File Version: 1.0 Exam A QUESTION 1 The main method of caching servers DNS Request Flood defense is the use of DNS source authentication.
More informationGuide to DDoS Attacks November 2017
This Multi-State Information Sharing and Analysis Center (MS-ISAC) document is a guide to aid partners in their remediation efforts of Distributed Denial of Service (DDoS) attacks. This guide is not inclusive
More informationNetwork and Internet Vulnerabilities
Network and Internet Vulnerabilities Computer Security Lecture 11 David Aspinall School of Informatics University of Edinburgh 27th February 2012 Outline Introduction Network and transport-level vulnerabilities
More informationAPNIC Security Tutorial (as part of AFCEA Marianas Technet)
APNIC Security Tutorial (as part of AFCEA Marianas Technet) Tamuning, Guam 24 April 2014 Proudly Supported by: Presenter Sheryl Hermoso (Shane) Training Officer, APNIC Sheryl has had various roles as a
More informationExample: Configuring DHCP Snooping and DAI to Protect the Switch from ARP Spoofing Attacks
Example: Configuring DHCP Snooping and DAI to Protect the Switch from ARP Spoofing Attacks In an ARP spoofing attack, the attacker associates its own MAC address with the IP address of a network device
More informationINFS 766 Internet Security Protocols. Lecture 1 Firewalls. Prof. Ravi Sandhu INTERNET INSECURITY
INFS 766 Internet Security Protocols Lecture 1 Firewalls Prof. Ravi Sandhu INTERNET INSECURITY Internet insecurity spreads at Internet speed Morris worm of 1987 Password sniffing attacks in 1994 IP spoofing
More informationSANS SEC504. Hacker Tools, Techniques, Exploits and Incident Handling.
SANS SEC504 Hacker Tools, Techniques, Exploits and Incident Handling http://killexams.com/exam-detail/sec504 QUESTION: 315 Which of the following techniques can be used to map 'open' or 'pass through'
More informationNETWORK INTRUSION. Information Security in Systems & Networks Public Development Program. Sanjay Goel University at Albany, SUNY Fall 2006
NETWORK INTRUSION Information Security in Systems & Networks Public Development Program Sanjay Goel University at Albany, SUNY Fall 2006 1 Learning Objectives Students should be able to: Recognize different
More informationDOMAIN NAME SECURITY EXTENSIONS
DOMAIN NAME SECURITY EXTENSIONS The aim of this paper is to provide information with regards to the current status of Domain Name System (DNS) and its evolution into Domain Name System Security Extensions
More informationComputer Network Routing Challenges Associated to Tackle Resolution Protocol
Computer Network Routing Challenges Associated to Tackle Resolution Protocol Manju Bala IP College for Women, Department of Computer Science manjugpm@gmail.com Charvi Vats Dept. Of Comp. SC., IP College
More informationDenial of Service. Serguei A. Mokhov SOEN321 - Fall 2004
Denial of Service Serguei A. Mokhov SOEN321 - Fall 2004 Contents DOS overview Distributed DOS Defending against DDOS egress filtering References Goal of an Attacker Reduce of an availability of a system
More informationGlobal Information Assurance Certification Paper
Global Information Assurance Certification Paper Copyright SANS Institute Author Retains Full Rights This paper is taken from the GIAC directory of certified professionals. Reposting is not permited without
More informationHands-On TCP/IP Networking
Hands-On Course Description In this Hands-On TCP/IP course, the student will work on a live TCP/IP network, reinforcing the discussed subject material. TCP/IP is the communications protocol suite on which
More informationNIP6000 Next-Generation Intrusion Prevention System
NIP6000 Next-Generation Intrusion Prevention System Thanks to the development of the cloud and mobile computing technologies, many enterprises currently allow their employees to use smart devices, such
More informationWhat is New in Cisco ACE 4710 Application Control Engine Software Release 3.1
What is New in Cisco ACE 4710 Application Control Engine Software Release 3.1 PB478675 Product Overview The Cisco ACE Application Control Engine 4710 represents the next generation of application switches
More informationErasable Programmable Read-Only Memory (EPROM) Electrically Erasable Programmable Read-Only Memory (EEPROM) CMOS 2.2.
Day - 1 1. INTRODUCTION 1.1 What is Security? 1.2 What is Cyber Security? 1.3 What is Information Security? 1.4 What are the Layers of Security? 1.5 What are the Classification of Security? 1.6 What are
More informationTable of Contents 1 IPv6 Configuration IPv6 Application Configuration 2-1
Table of Contents 1 IPv6 Configuration 1-1 IPv6 Overview 1-1 IPv6 Features 1-1 Introduction to IPv6 Address 1-2 Introduction to IPv6 Neighbor Discovery Protocol 1-5 Introduction to ND Snooping 1-7 Introduction
More informationfirewall { all-ping enable broadcast-ping disable ipv6-receive-redirects disable ipv6-src-route disable ip-src-route disable log-martians enable name
firewall { all-ping enable broadcast-ping disable ipv6-receive-redirects disable ipv6-src-route disable ip-src-route disable log-martians enable name WAN_IN { default-action drop description "WAN to internal"
More informationPROGRAMMING Kyriacou E. Frederick University Cyprus. Network communication examples
ACSC424 NETWORK APPLICATION PROGRAMMING Kyriacou E. Frederick University Cyprus communication examples The OSI reference model (proposed by ISO) Application A Application B 2 Application Application Presentation
More informationEthical Hacker Foundation and Security Analysts Course Semester 2
Brochure Software Education Ethical Hacker Foundation and Security Analysts Course Semester 2 The Security Management Course is a graduate-level foundation course in the Information Security space. Brochure
More informationDrone /12/2018. Threat Model. Description. Threats. Threat Source Risk Status Date Created
Drone - 2 04/12/2018 Threat Model Description Threats Threat Source Risk Status Date Created Mobile Phone: Sensitive Data Leakage Smart Devices Mobile Phone: Session Hijacking Smart Devices Mobile Phone:
More informationCIT 380: Securing Computer Systems. Network Security Concepts
CIT 380: Securing Computer Systems Network Security Concepts Topics 1. Protocols and Layers 2. Layer 2 Network Concepts 3. MAC Spoofing 4. ARP 5. ARP Spoofing 6. Network Sniffing Protocols A protocol defines
More informationENEE 457: Computer Systems Security 11/07/16. Lecture 18 Computer Networking Basics
ENEE 457: Computer Systems Security 11/07/16 Lecture 18 Computer Networking Basics Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland, College Park
More informationsnoc Snoc DDoS Protection Fast Secure Cost effective Introduction Snoc 3.0 Global Scrubbing Centers Web Application DNS Protection
Snoc DDoS Protection Fast Secure Cost effective sales@.co.th www..co.th securenoc Introduction Snoc 3.0 Snoc DDoS Protection provides organizations with comprehensive protection against the most challenging
More information