Unit 5 Seminar

1. Unit 5 Seminar Unit 5 Chapter 5 in CompTIA Security + Course Name – IT286-01 Introduction to Network Security Instructor – Jan McDanolds, MS, Security+ Contact Information: AIM – JMcDanolds Email – jmcdanolds@kaplan.edu Office Hours: Tuesday, 7:00 PM ET or Thursday, 7:00 PM ET

2. Chapter 4 Review Monitoring Activity and Intrusion Detection Monitoring the Network Understanding Intrusion Detection Systems (IDS) Working with Wireless Systems Understanding Instant Messaging Features Working with 8.3 File Naming Understanding Protocol Analyzers Understanding Signal Analysis and Intelligence Footprinting Scanning

3. Chapter 4 REVIEW Quick check of concepts… • Quickly type your response to these questions: #1 What is NFS and why do we care? • #2 With IDS there is a data source. What makes up the raw information in the data source? • #3 Name a problem with Host-Based IDS. • #4 Bonus: Why should you discard WEP for WPA2?

4. Chapter 5 Overview Implementing and Maintaining a Secure Network Overview of Network Security Threats Defining Security Baselines Hardening the OS (operating system) and NOS (network operating system) Hardening Network Devices Hardening Applications

5. Chapter 5 Network Security Threats • What should you do to learn about national/international security threats? • CERT Coordination Center (CERT/CC) US Computer Emergency Readiness Team • http://www.cert.org • http://www.cert.org/insider_threat/ • Field Trip….. • http://www.kb.cert.org/vuls/ • http://www.kb.cert.org/vuls/id/404051 • Example: Vulnerability Note VU#404051- Dell SonicWALL Scrutinizer 9.5.0 and older versions contain a SQL injection vulnerability.

6. Chapter 5 Network Security Threats (continued) Department of Homeland Security – Daily Reports DHS Daily Open Source Infrastructure Report http://www.dhs.gov/files/programs/editorial_0542.shtm “The DHS Daily Open Source Infrastructure Report is collected each business day as a summary of open-source published information concerning significant critical infrastructure issues. Each Daily Report is divided by the critical infrastructure sectors and key assets defined in the National Infrastructure Protection Plan.” Select current .pdf DHS Daily Open Source Infrastructure Report Go to Fast Jump Menu - Information Technology from the Services menu

7. Chapter 5 Network Security Threats (continued) SANs – The SANS (SysAdmin, Audit, Network, Security) Institute was established in 1989 as a cooperative research and education organization – now worldwide. http://www.sans.org/ SANs Internet Storm Center ISC http://isc.sans.edu/index.html Internet Storm Center http://isc.sans.org/ Also: Tools List - http://isc.sans.edu/tools/ Laptop at Security Conferences (next page) http://isc.sans.edu/diary.html?storyid=13207 Stormcasts are daily 5-10 minute threat updates. Podcast Field Trip….. http://isc.sans.edu/podcast.html ISC StormCast

8. Chapter 5 Network Security Threats (continued) Laptop at Security Conferences http://isc.sans.edu/diary.html?storyid=13207 Published: 2012-05-14, Last Updated: 2012-05-14 15:31:16 UTC by Chris Mohan (Version: 1) “I’m often curious what other security folks do to keep their machine safe when they go to IT conferences. I often see what looks like standard office machines being used and wonder if any precautions have been taken.”

9. Chapter 5 Network Security Threats (continued) SANS – Newsletters - Spend fifteen minutes a day keeping up with the high-level perspective of all the latest security news. Field Trip….. http://www.sans.org/newsletters SANS Newsbites – slide down to Archive NewsBitesis a semiweekly executive summary of news articles published on computer security during the last week. @Risk – select Archive – Date and then go down page http://www.sans.org/newsletters/risk/display.php?v=11&i=11 OUCH!Select Archive Disposing of computers… http://www.securingthehuman.org/newsletters/ouch/issues/201101.pdf

10. Chapter 5 Network Security Threats (continued) SANS NewsBites Man Pleads Guilty to US $1.3 Million Phishing Scam (8th May 2012) A 31 year old US man from Atlanta, Georgia, pleaded guilty to his part in a phishing ring responsible for defrauding people of over US $1.3 million. WayaNwaki, also known as "Shawn Conley," "USAprince12k," and "Prince Abuja", pleaded guilty to charges of wire fraud conspiracy, wire fraud, aggravated identity theft and computer fraud conspiracy. He could face up to 47 years in prison and a fine of US $250,000 for each count. According to the indictment filed with the U.S. District Court in New Jersey, Nwaki was part of an international gang of fraudsters with others named in the scheme as KarlisKarklins of Latvia; Charles UmehChidi of the United Kingdom; AlphonsusOsuala and OsarhiemeUyiObaygbona of Atlanta; Marvin Dion Hill of College Park, Ga.; and Olani Yi Jones of Nigeria. http://www.govinfosecurity.com/phisher-guilty-13-million-scam-a-4742http://www.msnbc.msn.com/id/47342263/ns/technology_and_science-security/t/georgia-man-admits-role-million-global-cyberscam/

11. Chapter 5 Network Security Threats (continued) Read about current topics in security magazines: SC Magazine http://www.scmagazine.com/ Information Security Magazine http://www.information-security-magazine.com/ Network Security Magazine http://www.network-security-magazine.com/ Info Security Magazine http://www.infosecurity-magazine.com/ http://www.infosecurity-magazine.com/news/

12. Chapter 5 Network Security Threats (continued) Listen to podcasts: http://www.govinfosecurity.com/interviews (See black bar under title, hit triangle) Interview with Chris Novak (May 11, 2012) 15 minutes http://www.govinfosecurity.com/interviews/improving-breach-investigations-i-1560Improving Breach Investigations - In short, organizations need to know where data is stored and what it comprises. But Novak says most organizations have too much data and in too many places to manage. Many organizations just struggle with understanding the picture of the data problem," says Novak, a member of Verizon's investigative response team. "They don't necessarily know where they have data ... and how it's being handled." Fraud Fighters Wanted (July 5, 2011) 13 minutes http://www.govinfosecurity.com/podcasts.php?podcastID=1177 Global Threats Create Boom Times for Fraud Examiners Today's top fraud threats recognize no global boundaries, says James Ratley, head of the Association of Certified Fraud Examiners. And they require a stronger global workforce than ever before.

13. Chapter 5 Nessus and NMAP Nessus - vulnerability scanner that was a free and open source vulnerability scanner until they closed the source code in 2005 and removed the free "registered feed" version in 2008 http://www.nessus.org/products/nessus Nmap ("Network Mapper") is a free and open source utility for network exploration or security auditing. http://nmap.org/

14. Chapter 5 Security Baselines • Back to the book…pg 222 • What is a security baseline? • “The base level of security that will be implemented and maintained.” • Depending on the environment, baseline security may include layers of protection, such as encryption, filtering, access control lists, authorization and authentication, and other security functions. • Tools to help: • Baseline: http://www.computerbaseline.com/ Demo explains this product. • VMWare/Shavlik – patch management, etc. • Qualys: policy management, vulnerability scanning, etc.

15. Chapter 5 Security Baselines (continued) Microsoft tools for baselines: Microsoft Security TechCenter – Patch Tuesday, Windows Update http://technet.microsoft.com/en-us/security Microsoft Security Compliance Manager (SCM) http://technet.microsoft.com/en-us/solutionaccelerators/cc835245 http://social.technet.microsoft.com/wiki/contents/articles/774.microsoft-security-compliance-manager-scm-en-us.aspx “baselines are based on Microsoft Security guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.Microsoft Baseline Security Analyzer http://technet.microsoft.com/en-us/security/cc184922#EWBAC Security Configuration Wizard (SCW) - attack-surface reduction tool included with Windows Server 2008 R2. SCW guides administrators in creating security policies based on the minimum functionality required for a server's role or roles.

16. Chapter 5 Security Baselines • Common Criteria (CC) • Evaluation Assurance Levels (EALs) • EAL 1 • EAL 2 • EAL 3 • EAL 4 – Recommended for commercial systems –Windows 7 • EAL 5 • EAL 6 • EAL 7

17. Chapter 5 Hardening the OS and NOS • Configuring Network Protocols • Hardening Microsoft Windows Vista/Windows 7 • Hardening Microsoft Windows XP • Hardening Windows Server 2003/Server 2008 • Hardening Windows Server 2000 • Hardening Unix/Linux • Hardening Novell NetWare • Hardening Apple Macintosh

18. Chapter 5 Hardening the OS and NOS Windows Service Hardening restricts critical Windows services from running abnormal activities in the file system, registry, network or other areas that could be exploited by malware.  Ex: Install Windows Server 2008 as a Server Core installation. Server Core provides a minimal environment for running specific server roles, reducing maintenance and management requirements and the attack surface. Windows services represent a large percentage of the overall attack surface. Windows Server 2008 limits the number of services that are running and operational by default.  Security Configuration Wizard – examines roles, adjusts to role

19. Chapter 5 Hardening the OS and NOS • Hardening Filesystems • NTFS, Unix NFS, Apple AFS • Updating Your Operating System • Hotfixes, Service Packs and Support Packs, Patches • Microsoft Patch Tuesday: Monthly Security Bulletins • http://technet.microsoft.com/en-us/security/bulletin/ms12-may • Articles - Help: I Got Hacked. Now What Do I Do? • http://technet.microsoft.com/en-us/library/cc700813.aspx • Jesper M. Johansson, Ph.D., CISSP, MCSE, MCP+ISecurity Program Manager, Microsoft Corporation • “After the very long Patch Management article last month, this month’s article is much shorter and to the point. Let’s just say you did not install the patches like we discussed last month. Now you got hacked. What to do?”

20. Chapter 5 Hardening Network Devices • Updating Network Devices • Configuring Routers and Firewalls • Patches and Updates for Routers and Firewalls • Enabling/Disabling Services and Protocols • Working with Access Control Lists (ACLs)

21. Chapter 5 Application Hardening Web Servers E-mail Servers FTP Servers DNS Servers NNTP Servers File and Print Servers and Services DHCP Services Data Repositories

22. Chapter 5 Application Hardening (cont) • Web Servers – IIS, Apache, anonymous, executable scripts, uploads, etc. • DNS Servers • http://www.networksolutions.com/whois/index.jsp • http://www.whois.net • Data Repositories • Directory Services – LDAP, Active Directory, X.500, SQL

23. Chapter 5 Unit 5 Assignment Unit 5 Project – Two Parts

24. Chapter 5 Unit 5 Project Assignment TWO PARTS! Essay questions 30 points for Part 1 1.1. Pick one NOS and one OS and describe the process of hardening it from attacks and intruders. (i.e. Windows XP and Windows Server 2008 ORWindows 7 and Linux Ubuntu) 1.2. Pick two application server types listed in the text (pg. 240 to 246) and describe the process of hardening them from attacks and intruders 20 points for Part 2- at least four paragraphs Based on the knowledge you have achieved thus far in our class, compose a brief synopsis compiling what you have learned about network security. Describe how you will use this knowledge with any other class, your present or future career, or your own personal life. APA Style for both Part 1 and Part 2.