Kostadinov goes on to note that most cyberterrorism actions are generally focused on website sabotage and email blasting. In order to prove that the network breach was a terrorist attack the company would need to provide electronic evidence of these types of information warfare. Information warfare is a term often used interchangeably with cyberterrorism but provides a deeper understanding in the shift of how data has become fundamental to society. As governments, companies and people shift to the use of digital information so have the methods used to attack (Gilmer, 2001). In order to combat this aspect of terrorism, the military have adopted computer forensics as part of their defenses (Vacca & Rudolph, 2011).
It will inform you on how hackers and system administrators used ping sweeps and port scans. While describing some of these notorious computer activities, these techniques will also be shown how system administrators can use to benefit the company. Two techniques that are used to attack a network is ping sweep and port scans. These activities can be used with malicious intent against, as well as, in effort to try to protect a network. Ping sweeps and port scans has been a notorious and yet a useful tool for hackers and system administrators.
To begin with, the definition of a port scan is, “The examination of TCP and UDP ports to determine which are open and what services are running. (Conklin 659) “The method used by intruders to discover the services running on the target machine. The intruder can then plan an attack on any vulnerable service that he or she finds for example, if the intruder finds that port 143 is open here she may proceed to find out what version of IMAP is running on the target machine if the version is vulnerable she may be able to gain superuser access to the machine using exploit (a program that exploits a security hole).” (Teo, 2000) To put the definition of the port scan into simpler terms it is a way for intruders to scan the network of the company for a way into the company records and programs. A port scan can tell an intruder what port is open, where it leads to, and what programs, files, passwords are on the machine that they have found access. Ping sweeps are used to identify the path a host ID uses in a given subnet.
Spyware is almost exactly as it sounds, a spying program. This type of malware will record the users input and transmit it back to the hacker to access at his leisure. This type of spyware is called a key logger and can capture interesting information such as user names, passwords, credit card numbers and email addresses. The more advanced versions of spyware can siphon off network data that will allow the hacker access to files, encryption keys, and other sensitive information. The final malware I will cover is the zombie.
The fact that an attacker can strike remotely makes a Web server an appealing target. Understanding threats to a Web server and being able to identify appropriate countermeasures permits us to anticipate many attacks and prevent the ever-growing numbers of attackers. The main threats to a Web server are: * Profiling * Denial of service * Unauthorized access * Arbitrary code execution * Elevation of privileges * Viruses, worms, and Trojan horses 1) Profiling: Profiling, or host enumeration, is an exploratory process used to gather information about the Web site. An attacker uses this information to attack known weak points. Vulnerabilities: • Unnecessary protocols • Open ports •Web servers providing configuration information in banners Attacks: • Port scans • Ping sweeps • NetBIOS and server message block (SMB) enumeration Countermeasures: Include blocking all unnecessary ports, blocking Internet Control Message Protocol (ICMP) traffic, and disabling unnecessary protocols such as NetBIOS and SMB.
Networked Systems Security Task 1 – THREATS AND IMPACT OF NETWORK THREATS There are many types of threats that can damage your computer either temporarily or permanently. Some threats posed may not threaten your computer right away however have the potential to do so. Some threats that present themselves can include physical threats such as the theft of equipment whether that is the monitor, computer etc. Other threats can be harder to find such as viruses, worms or any kind of malware. Understanding these threats allows the organisation to prevent, protect and correct any damage done to his/her computer to an extent.
• Imagine you are a CISO of a publically traded company and concerned about security when sending any message traffic over the Internet to your remote sites. Determine the security measures you would consider implementing to mitigate security risks when sending message traffic over the Internet. Explain your reasoning. Teardrop – a mangled packet sent in fragments via overlapping or overloading payloads which could cause the systems as it has in the past with older OS versions. Sequence number – hijacked or interrupted TCP/IP sessions via injected packets that disguises its origination from one of the two computers in a session.
Unit 9 Assignment 1: List Phases of a Computer Attack In this assignment I am a hacker who needs to protect my organization from a computer attack. I will list general phases of a computer attack. We have an organization that we need to protect from outside attacks by foreign parties. I am an ethical hackers who needs to take preventative measures in order to adequately secure the network against these attacks. Many attackers follow a general set of steps in order to gain the permissions necessary to break into a system.
An example of social network is Facebook, where people post personal information about themselves. Often, without modifying privacy settings and making information being visible by others. However, to protect ourselves from outsiders, we can simply go to privacy setting and change the audience to family and closest friends. Hackers are “people who gain unauthorized access to computers or networks” (Williams & Sawyer, 2013, p. 359). They break into our computer for several reasons but mainly to acquire personal information for financial gain, shut down hardware, steal people’s credit information, and destroy data.
IS3445 – Security Strategies in Web Applications and Social Networking Unit 1 Lab 1 Assessment Doug Stott Mr.Gibbins 10/1/14 1. From the results of lab #1 – Business Application impact analysis worksheet, what do you consider to be the greatest type of risk and why? The greatest risk is hackers having access to data because it can lead to identity theft. 2. Why is it critical to perform periodic web application vulnerability assessments and penetration tests?