Fundamentals of Networking

1. Fundamentals of Networking Discovery 1, Chapter 8 Basic Security

2. Objectives • Identify & describe the various networking threats • Identify different methods of attacks • Describe security procedures and applications • Describe the features of a firewall and how it can be used to protect against an attack

3. People use networks to exhange sensitive information...

4. We expect SECURE networks to PROTECT our IDENTITY & INFO

5. What’s Ahead… • Networking Threats • Methods of Attack • Security Policy • Using Firewalls

6. Networking Threats

7. Network Intrusion • Attacks can be devastating • Cost money, time, theft of files, etc • HACKERS • Intruders who gain access by modifying software or exploiting software vulnerabilities

8. 4 Threats from Hacker • Information theft • Identity theft • Data loss / manipulation • Disruption of service

9. 4 Threats from the Hacker • Stealing Confidential Info • Credit card #’s • Private Company info such as a project in development • Could be sold

10. 4 Threats from the Hacker • Destroy or Alter Records • Send a virus that reformats HD • Changing your grades • Change store prices

11. 4 Threats from the Hacker • Identity Theft • Stealing info to take on identity • Applying for credit cards & buying stuff • Obtain DL’s

12. 4 Threats from the Hacker • Disrupting Service • Preventing user from accessing services such as Internet

13. Activity

14. Activity • What is a hacker? • Handout • Review posters and decide on the threat • Handout

15. Where’d He Come From? • External Threat • Outside attacker • Internet or Wireless

16. Where’d He Come From? • Internal Threat • Has authorized access • Knows people & network • Knows what info is valuable • OR someone may have just picked up a virus • According to the FBI, internal access and misuse of computers systems account for approximately 70% of reported incidents of security breaches.

17. Discussion • Who is the greatest threat? • Internal or External

18. Social Engineering- The Trojan Horse

19. Social Engineering • Easiest way to gain access… • Deceiving internal users into performing actions or revealing confidential info • Takes advantage of them • Usually don’t meet them face-to-face

20. Fight Intrusion • http://www.us-cert.gov/reading_room/before_you_plug_in.html • http://www.us-cert.gov/reading_room/distributable.html • Example 1 • Example 2

21. 3 Types of Social Engineering • Pretexting, Phishing, and Vishing

22. Phishing

23. Review

24. Let’s Try This… • Cyber Security Awareness Quiz

25. Methods of Attack

26. Other Attacks • Viruses, Worms and Trojan horses • Malicious software put on hosts • Damage system, destroy data, deny access • They can forward data to thieves • Can replicate to other hosts

27. 3 Evil Things • Viruses, Worms and Trojan horses • Go to 8.2.1.2

28. Simplified

29. Let’s See… • GCIT • Who wants to play… • ID Theft Faceoff? • Invasion of the Wireless Hackers? • Phishing Scams? • Quiz Time for all! • http://www.sonicwall.com/phishing/

30. Activity • Virus, Worm or Trojan Horse???

31. Homework • Look up three current virus threats. • Handout

32. Just Being Evil! • Sometimes the goal is to shut a network down & disrupt the organization • Can cost a business lots of money!!

33. Denial of Service (DoS) • In general, DoS attacks seek to: • Flood a system or network with traffic to prevent legitimate network traffic from flowing • Disrupt connections between a client and server to prevent access to a service • Some are not used much anymore, but can be • SYN flooding • Ping of Death

34. DoS- SYN Flooding

35. DoS- Ping of Death! • Sending SO MANY LARGE pings, the server can’t respond to anyone else!

36. DDoS • DDoS • Attack by multiple systems infected with DDoS code • Sends useless data to server • Overwhelms system & it crashes

37. Brute Force • Fast computer used to guess passwords or decipher encryption code • Brute force attacks can cause a denial of service due to excessive traffic to a specific resource or by locking out user accounts • Try Activity on 8.2.2.3

38. Review • Name 3 types of social engineering. • Pretexting, Phishing, Vishing • How are you targeted in a pretexting attack? • Over the phone • You click on a pop-up window to claim a “prize.” A program was installed w/out you knowing & now an attacker has access to your system. What is this called? • Trojan Horse

39. Review • Which attack doesn’t need activation and copies itself across the network? • Worm • A server is busy responding to a SYN with an invalid source IP address. What’s the attack? • SYN Flooding

40. Other Threats • Not all threats do damage • Some collect info • Collecting Info/Invading Privacy • Spyware • Tracking Cookies • Adware • Pop-ups

41. Spyware • Program that gathers personal info w/out your permission • Info sent to advertisers • Usually installed unknowingly • Downloaded, installing a program, click on pop-up • Can slow computer down or make settings changes • Can be difficult to remove

42. Tracking Cookies • Form of spyware • Not always bad • Records info about user when they visit web sites • Allows personalization • Many sites require them

43. Adware • Form of spyware • Records info about user when they visit web sites • For advertising purposes • Pop-ups & pop-ups of ads

44. Adware EXCEPT doesn’t collect any info Pop-ups Open in front of the current browser window Pop-unders Open behind the current browser window Pop-Ups (and Pop-Unders)

45. What’s This?

46. Spam • Unwanted bulk mail from advertisers • Spammer sends • Often sent through unsecured servers • Can take control of computers • Then sent from that computer to others • On average, how many spam emails are sent to a person per year? • 3000

47. Review • You visit a web site and see this annoying advertising tactic that appears in a new window. What is it? • Pop-up • This type of advertising is sent to many, many people. The advertiser uses no marketing scheme. • Spam • This form of spyware is not always bad & can be used for personalization of a site. • Cookies

48. Security Policy

49. Security Measures • You can’t eliminate security breaches • You can minimize the risks • Policy • Procedures • Tools & Applications

50. Security Policy • Formal statement of rules when using tech • Acceptable use policy • Detailed handbook • What should be included?