Ethical Hacking and Countermeasures: Attack Phases, Second Edition. Chapter 1 Introduction to Ethical Hacking
|
|
- Emmeline Marianna Poole
- 5 years ago
- Views:
Transcription
1 Ethical Hacking and Countermeasures: Attack Phases, Second Edition Chapter 1 Introduction to Ethical Hacking
2 Objectives After completing this chapter, you should be able to: Understand the importance of information security in today s world Understand the elements of security Identify the phases of the hacking cycle Identify the different types of hacker attacks Understand hacktivism 2
3 Objectives After completing this chapter, you should be able to (cont d): Understand ethical hacking Understand vulnerability research and identify tools assisting in vulnerability research Identify steps for conducting ethical hacking Understand computer crimes and implications 3
4 Introduction to Ethical Hacking Hackers have various motivations for breaking into secure systems Duty of system administrators and network security professionals To guard their infrastructure against exploits by knowing the enemies who seek to use the same infrastructure for their own purposes One of the best ways to do this is to hire an ethical hacker Someone who has all of the skills of a malicious hacker, but is on the client s side 4
5 Importance of Security Today, companies are completely networked, exchanging information almost instantly Of utmost importance to secure assets from outside threats Security policy Specification for how objects in a security domain are allowed to interact There is an increased dependency on computers Any disruption in their operation or integrity can mean the loss of time, the loss of money, and sometimes even the loss of life 5
6 Threats and Vulnerabilities Vulnerability Weakness in a defined asset that could be taken advantage of or exploited by some threat Threat Action or event that might compromise security Every vulnerability does not lead to an attack, and all attacks do not result in success Factors that result in the success of an attack Degree of vulnerability, the strength of the attack, and the extent to which countermeasures are adopted 6
7 Attacks Target of evaluation Information resource or asset that is being protected from attacks Attack Deliberate assault on that system s security Attacks can be classified as Active modify the target system Passive violate the confidentiality of a system s data without affecting the state of that system Example: electronic eavesdropping 7
8 Attacks Attacks can also be categorized as inside or outside attacks Inside initiated from within a network by an authorized user Outside caused by an external intruder who does not have authorization to access the network 8
9 Security Breaches Exploit A specific way to breach the security of an IT system through a vulnerability Exposure A breach in security Can vary from one company to another, or even from one department to another Imperative for organizations to address both penetration and protection issues 9
10 Exposure Exposure Loss due to an exploit Examples of loss include Disclosure, deception, disruption, and usurpation Vulnerability is the primary entry point an attacker can use to gain access to a system or to its data Once the system is exposed, an attacker can collect confidential information with relative ease, and usually erase his or her tracks afterwards 10
11 Elements of Security Security: the state of well-being of a system s data and infrastructure Assurance Confidence that the system will behave according to its specifications 11
12 Accountability Accountability System administrators or concerned authorities need to be able to know by whom, when, how and why system resources have been accessed An audit trail or log files can address this 12
13 Reusability Reusability Generally, not all resources are available to all users Having access controls on predefined parameters can help increase the level of security One user or program may not reuse or manipulate objects that another user or program is currently accessing in order to prevent violation of security Also known as availability 13
14 The Security, Functionality, and Ease of Use Triangle Figure 1-1 Moving toward security means moving away from functionality and ease of use 14
15 The Growth of Hacking Originally, hacking required extraordinary computer skills Today there are automated tools and codes available on the Internet that make it possible for almost anyone to successfully hack a system A victim will often keep the attack secret For fear of losing the goodwill and faith of employees, customers, and partners Critical to take countermeasures to prevent any exploits that can result in loss 15
16 Phases of an Attack In general, there are five phases that make up an attack: 1. Reconnaissance 2. Scanning 3. Gaining access 4. Maintaining access 5. Covering tracks 16
17 Phase 1 - Reconnaissance Reconnaissance Preparatory phase where an attacker gathers as much information as possible about the target prior to launching the attack Reconnaissance may involve social engineering Convincing other people to reveal information such as unlisted phone numbers, passwords, etc. Dumpster diving Looking through an organization s trash for any discarded sensitive information 17
18 Phase 1 - Reconnaissance Reconnaissance types Passive: attacker does not interact with the system directly Active: attacker interacts with the target system by using tools to detect open ports, accessible hosts, router locations, network mapping, details of operating systems, and applications An ethical hacker must be able to distinguish among various reconnaissance methods Advocate preventative measures 18
19 Phase 2 - Scanning Attacker uses the details gathered during reconnaissance to identify specific vulnerabilities An attacker can gather critical network information, such as the mapping of systems, routers, and firewalls By using simple tools such as the Windows utility Traceroute Port scanners can be used to detect listening ports to find information about the nature of services running on the target machine Vulnerability scanners: most commonly used tools 19
20 Phase 3 Gaining Access Gaining access Where most of the damage is usually done, yet hackers can cause damage without gaining any access to the system Access can be gained locally, offline, over a LAN, or over the Internet Spoofing Technique used to exploit the system be pretending to be a legitimate user 20
21 Phase 3 Gaining Access Smurf attacks Attempt to cause users on a network to flood each other with data, making it appear as if everyone is attacking each other A hacker s chances of gaining access into a target system are influenced by factors such as: Architecture and configuration of the target system Skill level of the perpetrator Initial level of access obtained 21
22 Phase 4 Maintaining Access Attackers, who choose to remain undetected Remove evidence of their entry Install a backdoor or a Trojan to gain repeat access Install rootkits at the kernel level to gain full administrator access to the target compute Hackers can use Trojans to transfer user names, passwords, and any other information stored on the system Organizations can use intrusion detection systems or deploy traps known as honeypots and honeynets to detect intruders 22
23 Phase 5 Covering Tracks Attackers will usually attempt to erase all evidence of their actions Trojans such as ps or netcat are often used to erase the attacker s activities from the system s log files Steganography Process of hiding data in other data, for instance image and sound files Tunneling Takes advantage of the transmission protocol by carrying one protocol over another 23
24 Phase 5 Covering Tracks System administrators can deploy host-based IDS (intrusion detection systems) In order to detect Trojans and compromised files and directories As an ethical hacker You must be aware of tools and techniques that attackers deploy in order to advocate and implement countermeasures 24
25 Types of Hacker Attacks Hacker attacks can be categorized as: Operating system attacks Application-level attacks Shrink-wrap code attacks Misconfiguration attacks 25
26 Operating System Attacks Today s operating systems contain many features, making them increasingly complex Keeping up with latest patches and hotfixes can be challenging with today s complex networks Attackers are constantly looking for OS vulnerabilities to exploit 26
27 Application-Level Attacks Software developers often do not have time to completely test their products before shipping them Leaving undiscovered security holes Security is frequently delivered as an add-on component after release Not all instances of the software will have the same level of security Error checking can be very poor Which leads to buffer overflow attacks 27
28 Shrink-Wrap Code Attacks Software developers will often use free libraries and code licensed from other sources in their programs If vulnerabilities in that code are discovered, many pieces of software are at risk Developers need to customize and fine-tune code in order to make it more secure And different enough that the same exploit will not work 28
29 Misconfiguration Attacks System administrators need to be careful when configuring systems Create a simple, but usable configuration Remove all unnecessary services and software 29
30 Hacktivism Hacktivism When hackers break into government or corporate computer systems as an act of protest Use it to increase awareness of their social or political agendas Considered a crime, irrespective of intentions 30
31 Hacker Classes Black hats Use skills for illegal or malicious purposes White hats Use skills for defensive purposes Gray hats Believe in full disclosure (information is better out in the open than kept in secret) Suicide hackers Hacktivists who are willing to become martyrs for their cause 31
32 Ethical Hackers Ethical hackers Information security professionals who specialize in evaluating and defending against threats from attackers Use excellent computer skills to protect the integrity of computer systems rather than hurting them Ethical hackers categories: Former black hats White hats Consulting firms 32
33 What Do Ethical Hackers Do? Ethical hacker s evaluation of a client s information system security seeks answers to three basic questions: 1. What can an attacker see on the target system? 2. What can an intruder do with that information? 3. Are the attackers attempts being noticed on the target systems? Ethical hacker must convey to the client that it is never possible to guard systems completely However, they can always be improved 33
34 Can Hacking Be Ethical? Today, the term hacking is closely associated with illegal and unethical activities Most companies use IT professionals to audit their systems for known vulnerabilities Ethical hackers usually employ the same tools and techniques as attackers With the exception that once access is gained, no damage is done Distinction between ethical hackers and crackers is consent Crackers attempt to gain unauthorized access 34
35 Skills of an Ethical Hacker Ethical hackers must be computer experts Must have a strong grasp on programming and networking Should be comfortable with installing and maintaining systems using all popular OSs Ethical hackers must possess detailed knowledge of both hardware and software Any ethical hacker must have plenty of patience Analysis stage consumes more time than the testing stage 35
36 What is Vulnerability Research? Vulnerability research includes: Discovering system design faults and weaknesses that might allow attackers to compromise a system Keeping informed of new products and technologies in order to find news related to current exploits Checking underground hacking Web sites for newly discovered vulnerabilities and exploits Checking newly released alerts regarding relevant innovations and product improvements for security systems 36
37 Why Hackers Need Vulnerability Reasons: Research? To identify and correct network vulnerabilities To protect the network from being attacked To get information that helps to prevent security issues To gather information about viruses and malware To find weaknesses in the network and to alert the network administrator before a network attack To know how to recover from a network attack 37
38 Vulnerability Research Web Sites Vulnerability research web sites include: US-CERT ( National Vulnerability Database ( Securitytracker ( SecuriTeam ( SecurityFocus ( SCMagazine ( 38
39 Conducting Ethical Hacking Each ethical hacking assignment has six basic steps: 1. Talk with the client about the importance of security and the necessity of testing 2. Prepare NDA (nondisclosure agreement) documents and have the client sign them 3. Prepare an ethical hacking team and create a schedule for testing 4. Conduct the test 5. Analyze the results and prepare the report 6. Deliver the report to the client 39
40 How Do They Go About It? Security testing involves three phases: preparation, conduct, and conclusion After discussing security issues with the client, a formal contract should be drawn up that contains NDA, to protect the client s confidential data Clause stating that the ethical hacker has full consent of the client to hack into their systems Conduct phase Two most common approaches: Limited vulnerability analysis Attack and penetration testing 40
41 How Do They Go About It? The needs of the client Clients will often prefer a limited vulnerability analysis because they do not want to lose any data or risk any unintended damage While conducting an evaluation, ethical hackers may come across security holes that cannot be fixed within the predetermined time frame Client should be warned of this Final phase is the conclusion phase A report is prepared for the client 41
42 Approaches to Ethical Hacking Ethical hacker will attempt attacks over various channels: Remote network Remote dial-up network Local network Stolen equipment Social engineering Physical entry 42
43 Ethical Hacking Testing Approaches fall into one of three categories: Black box testing Ethical hacker is given no prior knowledge or information about a system White box testing Ethical hacker is given full advance knowledge of the system Gray box testing Internal testing performed by system administrator and network professionals 43
44 Ethical Hacking Deliverables In the conclusion phase, the ethical hacker creates a detailed report for the client Analyzing the possibility and impact of hacking Vulnerabilities that were detected are explained in detail Along with specific recommendations to patch them in order to bring about a permanent security solution Client may also solicit the participation of its employees by asking them for suggestions or observations during the course of the evaluation Final report should be delivered only in a hard copy 44
45 Computer Crimes and Implications Computer crimes can be separated into two categories: Crimes facilitated by use of a computer Crimes where the computer is the target The Cyber Security Enhancement Act 2002 allows life sentences for hackers who recklessly endanger the lives of others For more information, visit the United States Department of Justice s Cyber Crime and Intellectual Property section at 45
46 Summary The importance of security in any network is often underestimated Ethical hacking simulates a malicious attack without trying to cause damage Hacking involves five distinct phases: reconnaissance, scanning, gaining access, maintaining access, and clearing tracks Vulnerability research can be done via several Web sites 46
47 Summary Security testing involves three phases preparation, conduct, and conclusion Cyber crime is underreported, but taken very seriously when it is 47
ETHICAL HACKING & COMPUTER FORENSIC SECURITY
ETHICAL HACKING & COMPUTER FORENSIC SECURITY Course Description From forensic computing to network security, the course covers a wide range of subjects. You will learn about web hacking, password cracking,
More informationChapter 10: Security and Ethical Challenges of E-Business
Chapter 10: Security and Ethical Challenges of E-Business Learning Objectives Identify several ethical issues in IT that affect employment, individuality, working condition, privacy, crime health etc.
More informationIntroduction to Penetration Testing: Part One. Eugene Davis UAH Information Security Club February 21, 2013
Introduction to Penetration Testing: Part One Eugene Davis UAH Information Security Club February 21, 2013 Ethical Considerations: Pen Testing Ethics of penetration testing center on integrity (ISC)² Code
More informationCompTIA Security+ Malware. Threats and Vulnerabilities Vulnerability Management
CompTIA Security+ Lecture Six Threats and Vulnerabilities Vulnerability Management Copyright 2011 - VTC Malware Malicious code refers to software threats to network and systems, including viruses, Trojan
More informationGuide to Network Security First Edition. Chapter One Introduction to Information Security
Guide to Network Security First Edition Chapter One Introduction to Information Security About the Presentations The presentations cover the objectives found in the opening of each chapter. All chapter
More informationQuestion 1: What steps can organizations take to prevent incidents of cybercrime? Answer 1:
Cybercrime Question 1: What steps can organizations take to prevent incidents of cybercrime? Answer 1: Organizations can prevent cybercrime from occurring through the proper use of personnel, resources,
More informationOverview. Handling Security Incidents. Attack Terms and Concepts. Types of Attacks
Overview Handling Security Incidents Chapter 7 Lecturer: Pei-yih Ting Attacks Security Incidents Handling Security Incidents Incident management Methods and Tools Maintaining Incident Preparedness Standard
More informationChapter 4. Network Security. Part I
Chapter 4 Network Security Part I CCNA4-1 Chapter 4-1 Introducing Network Security Introduction to Network Security CCNA4-2 Chapter 4-1 Introducing Network Security Why is Network Security important? Rapid
More informationEthics and Information Security. 10 주차 - 경영정보론 Spring 2014
Ethics and Information Security 10 주차 - 경영정보론 Spring 2014 Ethical issue in using ICT? Learning Outcomes E-policies in an organization relationships and differences between hackers and viruses relationship
More informationn Given a scenario, analyze and interpret output from n A SPAN has the ability to copy network traffic passing n Capacity planning for traffic
Chapter Objectives n Understand how to use appropriate software tools to assess the security posture of an organization Chapter #7: Technologies and Tools n Given a scenario, analyze and interpret output
More informationAURA ACADEMY Training With Expertised Faculty Call Us On For Free Demo
ETHICAL HACKING (CEH) CURRICULUM Introduction to Ethical Hacking What is Hacking? Who is a Hacker? Skills of a Hacker? Types of Hackers? What are the Ethics and Legality?? Who are at the risk of Hacking
More informationMIS5206-Section Protecting Information Assets-Exam 1
Your Name Date 1. Which of the following contains general approaches that also provide the necessary flexibility in the event of unforeseen circumstances? a. Policies b. Standards c. Procedures d. Guidelines
More informationTHE EFFECTIVE APPROACH TO CYBER SECURITY VALIDATION BREACH & ATTACK SIMULATION
BREACH & ATTACK SIMULATION THE EFFECTIVE APPROACH TO CYBER SECURITY VALIDATION Cymulate s cyber simulation platform allows you to test your security assumptions, identify possible security gaps and receive
More informationHow Breaches Really Happen
How Breaches Really Happen www.10dsecurity.com About Dedicated Information Security Firm Clients Nationwide, primarily in financial industry Services Penetration Testing Social Engineering Vulnerability
More informationIntroduction to Ethical Hacking. Chapter 1
Introduction to Ethical Hacking Chapter 1 Definition of a Penetration Tester Sometimes called ethical hackers though label is less preferred Pen testers are: People who assess security of a target Specially
More informationChoosing the Right Security Assessment
A Red Team Whitepaper Choosing the Right Security Navigating the various types of Security s and selecting an IT security service provider can be a daunting task; however, it does not have to be. Understanding
More informationVULNERABILITY ASSESSMENT: SYSTEM AND NETWORK PENETRATION TESTING. Presented by: John O. Adeika Student ID:
VULNERABILITY ASSESSMENT: SYSTEM AND NETWORK PENETRATION TESTING. Presented by: John O. Adeika Student ID: 000205600 What is Penetration A penetration test, is a method of evaluating the security of a
More informationSecurity+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 1 Introduction to Security
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 1 Introduction to Security Objectives Describe the challenges of securing information Define information security and explain why
More information5. Execute the attack and obtain unauthorized access to the system.
Describe how a combination of preventive, detective, and corrective controls can be employed to provide reasonable assurance about information security. Before discussing the preventive, detective, and
More informationEthical Hacking and Prevention
Ethical Hacking and Prevention This course is mapped to the popular Ethical Hacking and Prevention Certification Exam from US-Council. This course is meant for those professionals who are looking for comprehensive
More informationGod is in the Small Stuff and it all matters. .In the Small Stuff. Security and Ethical Challenges. Introduction to Information Systems Chapter 11
Introduction to Information Systems Essentials for the Internetworked E-Business Enterprise 1 Eleventh Edition 2 Chapter Objectives C h a p t e r 11 Eleventh Edition James A. O Brien Identify several ethical
More informationCertified Ethical Hacker (CEH)
Certified Ethical Hacker (CEH) COURSE OVERVIEW: The most effective cybersecurity professionals are able to predict attacks before they happen. Training in Ethical Hacking provides professionals with the
More informationHacker Academy Ltd COURSES CATALOGUE. Hacker Academy Ltd. LONDON UK
Hacker Academy Ltd COURSES CATALOGUE Hacker Academy Ltd. LONDON UK TABLE OF CONTENTS Basic Level Courses... 3 1. Information Security Awareness for End Users... 3 2. Information Security Awareness for
More informationCurso: Ethical Hacking and Countermeasures
Curso: Ethical Hacking and Countermeasures Module 1: Introduction to Ethical Hacking Who is a Hacker? Essential Terminologies Effects of Hacking Effects of Hacking on Business Elements of Information Security
More informationAn ICS Whitepaper Choosing the Right Security Assessment
Security Assessment Navigating the various types of Security Assessments and selecting an IT security service provider can be a daunting task; however, it does not have to be. Understanding the available
More informationCYBER SECURITY AND MITIGATING RISKS
CYBER SECURITY AND MITIGATING RISKS 01 WHO Tom Stewart Associate Director Technology Consulting Chicago Technical Security Leader Protiviti Slides PRESENTATION AGENDA 3 START HACKING DEFINITION BRIEF HISTORY
More informationANATOMY OF AN ATTACK!
ANATOMY OF AN ATTACK! Are Your Crown Jewels Safe? Dom Kapac, Security Evangelist WHAT DO WE MEAN BY CROWN JEWELS? Crown jewels for most organizations are critical infrastructure and data Data is a valuable
More informationSecuring Information Systems
Chapter 7 Securing Information Systems 7.1 2007 by Prentice Hall STUDENT OBJECTIVES Analyze why information systems need special protection from destruction, error, and abuse. Assess the business value
More informationEC-Council C EH. Certified Ethical Hacker. Program Brochure
EC-Council TM H Program Brochure Course Description The (CEH) program is the core of the most desired information security training system any information security professional will ever want to be in.
More informationPrinciples of ICT Systems and Data Security
Principles of ICT Systems and Data Security Ethical Hacking Ethical Hacking What is ethical hacking? Ethical Hacking It is a process where a computer security expert, who specialises in penetration testing
More informationAttackers Process. Compromise the Root of the Domain Network: Active Directory
Attackers Process Compromise the Root of the Domain Network: Active Directory BACKDOORS STEAL CREDENTIALS MOVE LATERALLY MAINTAIN PRESENCE PREVENTION SOLUTIONS INITIAL RECON INITIAL COMPROMISE ESTABLISH
More informationOnline Threats. This include human using them!
Online Threats There are many dangers from using the web (and computer in general). One should watch out for malware, automated programs designed to cause harm to you, your data, and your system. You are
More informationThe Value of Automated Penetration Testing White Paper
The Value of Automated Penetration Testing White Paper Overview As an information security expert and the security manager of the company, I am well aware of the difficulties of enterprises and organizations
More informationSage Data Security Services Directory
Sage Data Security Services Directory PROTECTING INFORMATION ASSETS ENSURING REGULATORY COMPLIANCE FIGHTING CYBERCRIME Discover the Sage Difference Protecting your business from cyber attacks is a full-time
More informatione-commerce Study Guide Test 2. Security Chapter 10
e-commerce Study Guide Test 2. Security Chapter 10 True/False Indicate whether the sentence or statement is true or false. 1. Necessity refers to preventing data delays or denials (removal) within the
More informationVulnerability Assessment. Detection. Aspects of Assessment. 1. Asset Identification. 1. Asset Identification. How Much Danger Am I In?
Detection Vulnerability Assessment Week 4 Part 2 How Much Danger Am I In? Vulnerability Assessment Aspects of Assessment Vulnerability Assessment is a systematic evaluation of asset exposure to threats
More information716 West Ave Austin, TX USA
Fundamentals of Computer and Internet Fraud GLOBAL Headquarters the gregor building 716 West Ave Austin, TX 78701-2727 USA TABLE OF CONTENTS I. INTRODUCTION What Is Computer Crime?... 2 Computer Fraud
More informationCEH: CERTIFIED ETHICAL HACKER v9
CEH: CERTIFIED ETHICAL HACKER v9 SUMMARY The Certified Ethical Hacker (CEH) program is the core of the most desired information security training system any information security professional will ever
More informationCISSP CEH PKI SECURITY + CEHv9: Certified Ethical Hacker. Upcoming Dates. Course Description. Course Outline
CISSP CEH PKI SECURITY + CEHv9: Certified Ethical Hacker Learn to find security vulnerabilities before the bad guys do! The Certified Ethical Hacker (CEH) class immerses students in an interactive environment
More informationInsider Threat Program: Protecting the Crown Jewels. Monday, March 2, 2:15 pm - 3:15 pm
Insider Threat Program: Protecting the Crown Jewels Monday, March 2, 2:15 pm - 3:15 pm Take Away Identify your critical information Recognize potential insider threats What happens after your critical
More informationIntegrated Access Management Solutions. Access Televentures
Integrated Access Management Solutions Access Televentures Table of Contents OVERCOMING THE AUTHENTICATION CHALLENGE... 2 1 EXECUTIVE SUMMARY... 2 2 Challenges to Providing Users Secure Access... 2 2.1
More informationSecurity Solutions. Overview. Business Needs
Security Solutions Overview Information security is not a one time event. The dynamic nature of computer networks mandates that examining and ensuring information security be a constant and vigilant effort.
More informationFigure 11-1: Organizational Issues. Managing the Security Function. Chapter 11. Figure 11-1: Organizational Issues. Figure 11-1: Organizational Issues
1 Managing the Security Function Chapter 11 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Top Management Support Top-Management security awareness briefing (emphasis on brief)
More informationDefense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
More information10 Hidden IT Risks That Might Threaten Your Business
(Plus 1 Fast Way to Find Them) Your business depends on intelligence. But can you count on your technology? You may not be in the intelligence technology business, but it s probably impossible to imagine
More informationHOW SAFE IS YOUR DATA? Micho Schumann, KPMG, Cayman Islands
HOW SAFE IS YOUR DATA? Micho Schumann, KPMG, Cayman Islands HOW SAFE IS YOUR DATA? 16 November 2017 kpmg.ky Agenda Introduction Cyber Security presentation Q&A 3 Why this presentation? 4 The CIA Triad
More informationCarbon Black PCI Compliance Mapping Checklist
Carbon Black PCI Compliance Mapping Checklist The following table identifies selected PCI 3.0 requirements, the test definition per the PCI validation plan and how Carbon Black Enterprise Protection and
More informationCertified Ethical Hacker
Certified Ethical Hacker Certified Ethical Hacker Course Objective Describe how perimeter defenses function by ethically scanning and attacking networks Conduct information systems security audits by understanding
More informationWhat are PCI DSS? PCI DSS = Payment Card Industry Data Security Standards
PCI DSS What are PCI DSS? PCI DSS = Payment Card Industry Data Security Standards Definition: A multifaceted security standard that includes requirements for security management, policies, procedures,
More informationComputer Security Policy
Administration and Policy: Computer usage policy B 0.2/3 All systems Computer and Rules for users of the ECMWF computer systems May 1995 Table of Contents 1. The requirement for computer security... 1
More informationCHAPTER 8 SECURING INFORMATION SYSTEMS
CHAPTER 8 SECURING INFORMATION SYSTEMS BY: S. SABRAZ NAWAZ SENIOR LECTURER IN MANAGEMENT & IT SEUSL Learning Objectives Why are information systems vulnerable to destruction, error, and abuse? What is
More informationInformation Technology Enhancing Productivity and Securing Against Cyber Attacks
Information Technology Enhancing Productivity and Securing Against Cyber Attacks AGENDA Brief Overview of PortMiami Enhancing Productivity Using Technology Technology Being Using at the Port Cyber Attacks
More informationA (sample) computerized system for publishing the daily currency exchange rates
A (sample) computerized system for publishing the daily currency exchange rates The Treasury Department has constructed a computerized system that publishes the daily exchange rates of the local currency
More informationCYBER FRAUD & DATA BREACHES 16 CPE s May 16-17, 2018
CYBER FRAUD & DATA BREACHES 16 CPE s May 16-17, 2018 Cyber fraud attacks happen; they can t all be stopped. The higher order question must be how can we, as fraud examiners and assurance professionals,
More informationChapter 1 Ethical Hacking Overview. Revised
Chapter 1 Ethical Hacking Overview Revised 8-30-17 Describe the role of an ethical hacker Describe what you can do legally as an ethical hacker Describe what you cannot do as an ethical hacker Hands-On
More informationAcceptable Use Policy
Acceptable Use Policy. August 2016 1. Overview Kalamazoo College provides and maintains information technology resources to support its academic programs and administrative operations. This Acceptable
More informationEC-Council. Program Brochure. EC-Council. Page 1
Program Brochure Page 1 Certified Ethical Hacker Version 7 Revolutionary Product releases the most advanced ethical hacking program in the world. This much anticipated version was designed by hackers and
More informationTransforming Security from Defense in Depth to Comprehensive Security Assurance
Transforming Security from Defense in Depth to Comprehensive Security Assurance February 28, 2016 Revision #3 Table of Contents Introduction... 3 The problem: defense in depth is not working... 3 The new
More informationTeradata and Protegrity High-Value Protection for High-Value Data
Teradata and Protegrity High-Value Protection for High-Value Data 12.16 EB7178 DATA SECURITY Table of Contents 2 Data Centric Security: Providing High-Value Protection for High-Value Data 3 Visibility:
More informationEnterprise Cybersecurity Best Practices Part Number MAN Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
More informationSecurity+ Guide to Network Security Fundamentals, Third Edition. Chapter 1 Introduction to Security
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 1 Introduction to Security Objectives Describe the challenges of securing information Define information security and explain why
More informationIT Security Auditing. Mr. Watcharaphon Wongaphai. Senior Information Security Instructor. GIAC GCFA,SSCP,E CSA,C EH,CNE6,Security+,CCNA,Network+
IT Security Auditing Mr. Watcharaphon Wongaphai Senior Information Security Instructor GIAC GCFA,SSCP,E CSA,C EH,CNE6,Security+,CCNA,Network+ Class Introduction Security intelligence Introduce Instructor
More informationThe Honest Advantage
The Honest Advantage READY TO CHALLENGE THE STATUS QUO GSA Security Policy and PCI Guidelines The GreenStar Alliance 2017 2017 GreenStar Alliance All Rights Reserved Table of Contents Table of Contents
More informationCSIRT in general CSIRT Service Categories Reactive Services Proactive services Security Quality Management Services CSIRT. Brmlab, hackerspace Prague
Brmlab, hackerspace Prague Lightning talks, November 2016 in general in general WTF is an? in general WTF is an? Computer Security in general WTF is an? Computer Security Incident Response in general WTF
More informationCoreMax Consulting s Cyber Security Roadmap
CoreMax Consulting s Cyber Security Roadmap What is a Cyber Security Roadmap? The CoreMax consulting cyber security unit has created a simple process to access the unique needs of each client and allows
More informationIT SECURITY FOR NONPROFITS
IT SECURITY FOR NONPROFITS COMMUNITY IT INNOVATORS PLAYBOOK April 2016 Community IT Innovators 1101 14th Street NW, Suite 830 Washington, DC 20005 The challenge for a nonprofit organization is to develop
More informationInformation Security Is a Business
Information Security Is a Business Continuity Issue: Are You Ready? Dr. Nader Mehravari Cyber Risk and Resilience Management Team CERT Division Software Engineering Institute Carnegie Mellon University
More informationAcceptable Use Policy
Acceptable Use Policy 1. Overview ONS IT s intentions for publishing an Acceptable Use Policy are not to impose restrictions that are contrary to ONS established culture of openness, trust and integrity.
More informationCyber Security & Ethical Hacking Training. Introduction to Cyber Security Introduction to Cyber Security. Linux Operating System and Networking: LINUX
Cyber Security & Ethical Hacking Training. Introduction to Cyber Security Introduction to Cyber Security HTML PHP Database Linux Operating System and Networking: LINUX NETWORKING Information Gathering:
More informationIBM Global Technology Services Provide around-the-clock expertise and protect against Internet threats.
IBM Global Technology Services Provide around-the-clock expertise and protect against Internet threats. Enhancing cost to serve and pricing maturity Keeping up with quickly evolving ` Internet threats
More informationAcceptable Use Policy
Acceptable Use Policy 1. Purpose The purpose of this policy is to outline the acceptable use of computer equipment at Robotech CAD Solutions. These rules are in place to protect the employee and Robotech
More informationDesign your network to aid forensics investigation
18th Annual FIRST Conference Design your network to aid forensics investigation Robert B. Sisk, PhD, CISSP Senior Technical Staff Member IBM Baltimore, Maryland USA Master Outline Introduction Incident
More informationCyber Security Audit & Roadmap Business Process and
Cyber Security Audit & Roadmap Business Process and Organizations planning for a security assessment have to juggle many competing priorities. They are struggling to become compliant, and stay compliant,
More informationRiskSense Attack Surface Validation for IoT Systems
RiskSense Attack Surface Validation for IoT Systems 2018 RiskSense, Inc. Surfacing Double Exposure Risks Changing Times and Assessment Focus Our view of security assessments has changed. There is diminishing
More informationCyber Security. Building and assuring defence in depth
Cyber Security Building and assuring defence in depth The Cyber Challenge Understanding the challenge We live in an inter-connected world that brings a wealth of information to our finger tips at the speed
More informationAcceptable Use Policy
Acceptable Use Policy 1. Overview The Information Technology (IT) department s intentions for publishing an Acceptable Use Policy are not to impose restrictions that are contrary to Quincy College s established
More informationSpecialized Security Services, Inc. REDUCE RISK WITH CONFIDENCE. s3security.com
Specialized Security Services, Inc. REDUCE RISK WITH CONFIDENCE s3security.com Security Professional Services S3 offers security services through its Security Professional Services (SPS) group, the security-consulting
More informationData Security and Privacy : Compliance to Stewardship. Jignesh Patel Solution Consultant,Oracle
Data Security and Privacy : Compliance to Stewardship Jignesh Patel Solution Consultant,Oracle Agenda Connected Government Security Threats and Risks Defense In Depth Approach Summary Connected Government
More informationGATHERING SENSITIVE HEALTHCARE INFORMATION USING SOCIAL ENGINEERING TECHNIQUES
GATHERING SENSITIVE HEALTHCARE INFORMATION USING SOCIAL ENGINEERING TECHNIQUES B. Dawn Medlin Appalachian State University John A. Walker College of Business Department of Computer Information Systems
More informationE-guide Getting your CISSP Certification
Getting your CISSP Certification Intro to the 10 CISSP domains of the Common Body of Knowledge : The Security Professional (CISSP) is an information security certification that was developed by the International
More informationWhite paper Cybersecurity
White paper Cybersecurity Concepts and Terminology Table of contents 1. Introduction 3 2. Cybersecurity 3 3. Risk assessment 3 4. Threat landscape 4 5. Threat actors and their motivation 4 6. Attack value
More informationFTA 2017 SEATTLE. Cybersecurity and the State Tax Threat Environment. Copyright FireEye, Inc. All rights reserved.
FTA 2017 SEATTLE Cybersecurity and the State Tax Threat Environment 1 Agenda Cybersecurity Trends By the Numbers Attack Trends Defensive Trends State and Local Intelligence What Can You Do? 2 2016: Who
More informationCertified Cyber Security Analyst VS-1160
VS-1160 Certified Cyber Security Analyst Certification Code VS-1160 Vskills certification for Cyber Security Analyst assesses the candidate as per the company s need for cyber security and forensics. The
More informationn Explain penetration testing concepts n Explain vulnerability scanning concepts n Reconnaissance is the first step of performing a pen test
Chapter Objectives n Explain penetration testing concepts n Explain vulnerability scanning concepts Chapter #4: Threats, Attacks, and Vulnerabilities Vulnerability Scanning and Penetration Testing 2 Penetration
More informationCUNY John Jay College of Criminal Justice MATH AND COMPUTER SCIENCE
Instructor: Prof Aftab Ahmad Office: NB 612 Telephone No. (212)393-6314 Email Address: aahmad@jjay.cuny.edu Office Hours: By appointment TEXT & REFERENCE MATERIAL Text Notes from instructor posted on Blackboard
More informationCYBERSECURITY PENETRATION TESTING - INTRODUCTION
CYBERSECURITY PENETRATION TESTING - INTRODUCTION Introduction Pen-testing 101 University Focus Our Environment Openness and learning Sharing and collaboration Leads to Security Weaknesses What is Penetration
More informationDumpsTorrent. Latest dumps torrent provider, real dumps
DumpsTorrent http://www.dumpstorrent.com Latest dumps torrent provider, real dumps Exam : GCIH Title : GIAC Certified Incident Handler Vendor : GIAC Version : DEMO Get Latest & Valid GCIH Exam's Question
More informationWhitepaper on AuthShield Two Factor Authentication with SAP
Whitepaper on AuthShield Two Factor Authentication with SAP By AuthShield Labs Pvt. Ltd Table of Contents Table of Contents...2 1.Overview...4 2. Threats to account passwords...5 2.1 Social Engineering
More informationToday s Security Threats: Emerging Issues Keeping CFOs Up at Night Understanding & Protecting Against Information Security Breaches
Today s Security Threats: Emerging Issues Keeping CFOs Up at Night Understanding & Protecting Against Information Security Breaches Chris Bucolo, PCIP, MBA Today s Speaker Chris Bucolo Sr. Manager, Sikich
More informationOPSEC and defense agains social engineering for devels, execs, and sart-ups
OPSEC and defense agains social engineering for devels, execs, and sart-ups @KirilsSolovjovs on twitter http://kirils.org for more Mg.sc.comp. Kirils Solovjovs Possible Security Problem: Social Engineering
More informationChair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 8
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 8 System Vulnerabilities and Denial of Service Attacks System Vulnerabilities and
More informationTroubleshooting and Cyber Protection Josh Wheeler
May 4, 2016 Troubleshooting and Cyber Protection Josh Wheeler Network Security Network Security Risks Video Network Security Risks Article Network Security Risks Data stealing or disruption of network
More informationCyber Criminal Methods & Prevention Techniques. By
Cyber Criminal Methods & Prevention Techniques By Larry.Boettger@Berbee.com Meeting Agenda Trends Attacker Motives and Methods Areas of Concern Typical Assessment Findings ISO-17799 & NIST Typical Remediation
More informationProvide you with a quick introduction to web application security Increase you awareness and knowledge of security in general Show you that any
OWASP Top 10 Provide you with a quick introduction to web application security Increase you awareness and knowledge of security in general Show you that any tester can (and should) do security testing
More informationFundamentals of Information Systems Security Lesson 5 Auditing, Testing, and Monitoring
Fundamentals of Information Systems Security Lesson 5 Auditing, Testing, and Monitoring Learning Objective Explain the importance of security audits, testing, and monitoring to effective security policy.
More informationPosition Description. Computer Network Defence (CND) Analyst. GCSB mission and values. Our mission. Our values UNCLASSIFIED
Position Description Computer Network Defence (CND) Analyst Position purpose: Directorate overview: The CND Analyst seeks to discover, analyse and report on sophisticated computer network exploitation
More information10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS WHITE PAPER INTRODUCTION BANKS ARE A COMMON TARGET FOR CYBER CRIMINALS AND OVER THE LAST YEAR, FIREEYE HAS BEEN HELPING CUSTOMERS RESPOND
More informationSecurity Testing. - a requirement for a secure business. ISACA DAY in SOFIA. Gabriel Mihai Tanase, Director, Cyber Services KPMG in CEE
Gabriel Mihai Tanase, Director, Cyber Services KPMG in CEE Cyber Security Services Security Testing - a requirement for a secure business ISACA DAY in SOFIA Agenda No Agenda Some minimum theory More real
More informationA Passage to Penetration Testing!
A Passage to Penetration Testing! EC-Council Cyber Research This paper is from EC-Council s site. Reposting is not permitted without express written permission. What Is Penetration Testing? A penetration
More informationVulnerabilities. To know your Enemy, you must become your Enemy. Information security: Vulnerabilities & attacks threats. difficult.
Vulnerabilities To know your Enemy, you must become your Enemy. "The Art of War", Sun Tzu André Zúquete Security 1 Information security: Vulnerabilities & attacks threats Discouragement measures difficult
More information