Module - 4: Cyber Network Security Concepts

Module - 4
Cyber Network
Security Concepts
Cyber Security Overview
• What is Cyber Security?
• Cyber security refers to the body of technologies, processes,
and practices designed to protect networks, devices,
programs, and data from attack, damage, or unauthorized
access.
• Also refers to the security offered through on-line services to
protect your online information.
• The security threats that cause massive harm are increasing
also, with an increasing amount of people getting connected
to Internet
• Major security problems
• Virus
• Hacker
• Malware
• Trojan horses
• Password cracking
• Viruses and Worms
• A Virus is a “program that is loaded onto your computer
without your knowledge and runs against your wishes.
• Solution
• Install a security suite that protects the computer against
threats such as viruses and worms.
• Hackers
• In common a hacker is a person who breaks into computers,
usually by gaining access to administrative controls.
• Types of Hackers
• White Hat Hacker
• Grey Hat Hacker
• Black Hat Hacker
• How To prevent hacking
• It may be impossible to prevent computer hacking, however
effective security controls including strong passwords, and
the use of firewalls can helps.
• Malware
• The word "malware" comes from the term "MALicious
softWARE.“
• Malware is any software that infects and damages a
computer system without the owner's knowledge or
permission.
• To Stop Malware
• Download an anti-malware program that also helps prevent
infections.
• Activate Network Threat Protection, Firewall, Antivirus
• Trojan Horses
• Trojan horses are email viruses that can duplicate
themselves, steal information, or harm the computer system.
• These viruses are the most serious threats to computers
• How to Avoid Trojans?
• Security suites, such as Avast Internet Security, will prevent
you from downloading Trojan Horses
• Password Cracking
• Password attacks are attacks by hackers that are able to
determine passwords or find passwords to different protected
electronic areas and social network sites.
• Securing Password
• Use always Strong password.
• Never use same password for two different sites
•
Cyber Security
• Effective cybersecurity is a critical capability for the defense
and preservation of civil society.
• Cyber crime largest and fastest-growing categories of crime.
• Cyber criminals are responsible for stealing of funds and
other assets
• To successfully make a change, the first step is to admit you
have a problem.
• Antipatterns employ psychological frameworks for solving
problems whose causes involve habitual mistakes.
• Antipatterns require a mind shift.
• “Technology is not the problem…people are the problem”.
• Changing people’s minds is very difficult
Cyber Security
• Few examples of modern-day social antipatterns used in
general society:
• Liberal (lily livered - weak and cowardly),
• Bigot - a person who is intolerant towards those holding
different opinions
• Terrorist (violent extremist),
• Convict (felon, violent offender),
• Street criminal (thug, gang banger),
• Corrupt politician (crook),
Cyber Security - Security Architecture
• Many of the networked technologies we depend upon daily
have no effective security.
• The architecture of the Internet and the vast majority of
deployed software create significant opportunities for
malicious exploitation.
• It is worth stating that if infrastructure and software
technologies were engineered properly they would be built
to withstand known and manage unknown risks, and they
would be significantly more secure than current-day
technologies
Cybersecurity Antipatterns
• Antipattern -1 : Signature-Based Malware Detection
versus Polymorphic Threats
• All systems with up-to-date antivirus signatures will be safe.
• Many popular antivirus solutions are nearly obsolete, with
many missing the majority of new malware.
• Current signature-based antivirus engines miss 30 percent to
70 percent of malicious code, and nearly 100 percent of zero
day infections, which are unreported exploits.
• The proliferation of malware signatures is exploding primarily
due to polymorphic malware techniques.
• E.g.: Hash functions used by signature-based detectors yield very
different values with only slight changes to a malicious file.
• Changing a string literal in the file is sufficient to trigger a
false negative
• Signature-Based Malware Detection versus Polymorphic
Threats
•
• POLYMORPHIC MALWARE
• Polymorphic malware is a type of malware that constantly
changes its identifiable features in order to evade detection.
• Many of the common forms of malware can be polymorphic,
including viruses, worms, bots, trojans, or keyloggers.
• Polymorphism is used to evade pattern-matching detection
relied on by security solutions like antivirus software.
• Examples of polymorphic malware
• Storm Worm Email:
• Spam email sent in 2007 with the subject “230 dead as storm
batters Europe” was, at one point, responsible for as much as
8% of all global malware infections.
• Storm worm was so hard to detect with traditional antivirus
software was the malicious code used morphed every 30
minutes or so.
• CryptoWall Ransomware:
• CryptoWall is a polymorphic ransomware strain that
encrypts files on the victim’s computer and demands a
ransom payment for their decryption.
• Best practices for protecting against polymorphic malware
• Keep Your Software Up To Date: Enterprise software
manufacturers like Microsoft, Oracle, and Adobe regularly
release software updates that contain critical security patches
for known vulnerabilities.
• Do Not Click Suspicious Links or Attachments: Phishing
emails or other unsolicited electronic communications can
contain malicious links or attachments used to spread malware.
• Use Strong Passwords and Change Them
Regularly: Ensuring that your accounts are protected with
secure and unique passwords is another best practice for
malware protection
• Refactored Solution: Reputational-, Behavioral-, and
Entropy-Based Malware Detection
• Vendors are developing innovative techniques that can detect
zero day and polymorphic malware.
• Several promising approaches for the future include
• Symantec is controlling a 100M+ global customer base to
identify potential malware signatures.
• The technique, called reputation-based signatures, is able to
identify 240 million new malware signatures by comparing
binaries across millions of systems for anomalous variations.
• FireEye has created a behavioral intrusion detection system
(IDS) that uses elements of honeypots and forensics to
automatically identify malicious content as it flows across
corporate networks.
• An emerging field of research called entropy-based
malware detection looks for mathematical similarity to
known malware signatures.
• Hash functions that are used by most antivirus programs
detect subtle differences between a file and its known hash.
• Minor changes to a file, such as modification of strings or
encodings can cause a hash match to fail.
• Antipattern -2 : Document-Driven Certification and
Accreditation
• Some of the most obvious antipatterns involve the IT security
industry itself.
• Assessment and Authorization (A&A), formerly called
Certification and Accreditation (C&A), has attracted much
public criticism because it has a reputation as a paper-driven
process that does not secure systems from real threats.
• Vulnerabilities are thoroughly explored with state of the art
tools – Penetration Testing
• followed by actual exploitation and malicious user tests where
unauthorized accesses are the goal.
• Refactored solutions for this antipattern can be derived from
the practical security testing and investigation techniques
• Antipattern -2 : Document-Driven Certification and
Accreditation
• Assessment and Authorization (A&A)
• Process of assuring the information security of systems before they
are deployed.
• Certification
• It is an assessment and testing phase that identifies and confirms
vulnerabilities.
• Accreditation
• It is an executive approval process that accepts risks discovered
during certification.
• Software engineering consists of all the technical activities
that are performed to build the project deliverable.
• Software engineering deals with construction the
components, integrating them, verifying them, validating
them, and finally combining all of the components into a
product and convincing the customer to accept delivery of it.
• Mechanism to describe a commonly occurring solution to a
software development need that generates significantly
negative consequences.
• An Antipattern is a repeated application of code or design
that leads to a bad outcome.
• An antipattern, just like a software design pattern, is a
structured description.
• Antipattern is a form that describes a commonly occurring
solution to a problem that generates decidedly negative
consequences
• Design patterns focus on solutions.
• Antipatterns focus on commonly recurring problems and
then address the problems with one or more candidate
solutions.
• Design forces are the competing concerns, priorities, and
technical factors that influence the choice of solutions.
• In antipatterns, there are two solutions: the antipattern
solution and the refactored solution.
• The antipattern solution may be the result of multiple
choices over an extended system lifecycle.
• The refactored solution results from a reconsideration of the
design forces and the selection of a more effective solution
• Forces in Cyber Antipatterns
• The major types of forces in antipatterns include primal,
horizontal, and vertical forces.
• Primal forces are common design forces present in almost
every design decision.
• The primal design forces in the cybersecurity domain
include:
• Management of functionality
• Management of confidentiality
• Management of integrity
• Management of availability
• Confidentiality is the protection of information on the
system.
• The information is the primary resource being secured in
most current systems.
• The sensitivity of the information defines the level of risk
and security priority for each system
• Integrity is protection of the coherence of the data.
• The significant threat of damage to data can be very costly.
• Threat affects even the most sensitive systems that have very
limited connectivity to external networks as removable
media with malware can migrate to those systems through
normal and erroneous operations
• Availability is the continuous readiness of the system to
execute its functionality in response to users and other
systems’ requests.
• Availability is an aspect of the more general concept of
Quality of Service (QOS).
• The functionality design force is added because it drives the
other forces.
• Functionality is tested and verified by the developers prior to
security testing.
• Cyber Antipattern Templates
• Micro-Antipattern Templates
• The components of a micro-antipattern template are:
• Name:
• The name of the micro-antipattern suggests the negative
consequences of the antipattern’s presence.
• Antipattern Problem:
• The problem section summarizes the micro-antipattern’s
symptoms, consequences, and characterization.
• Refactored Solution:
• The solution section summarizes alternative ways to resolve the
antipattern design forces with improved benefits.
• Full Cyber Antipattern Template
• The full cyber antipattern template has two main parts: a
header and a body.
• The header gives a quick sense of the antipattern and the
solution.
• The body sections contain the pattern details.
• The heading fields in the full cyber antipattern template are:
• Antipattern Name:
• The name is a unique describing something is not good.
• The intent is to make this antipattern a well-known phenomenon,
easily recognizable.
• Also Known As:
• Many antipatterns are known by various names across different
organizations.
• A given organization might want to adopt a name from list of
available known names
• The heading fields in the full cyber antipattern template are:
• Refactored Solution Names:
• One or more names of alternative solutions are listed here.
• Give the reader a sense of the pattern write-up provide a common
solution.
• Unbalanced Primal Forces:
• This field lists the primal design forces that are poorly resolved by
this antipattern.
• Anecdotal Evidence:
• These are some phrases that characterize this antipattern.
• The body fields in the full cyber antipattern template are:
• Background:
• This optional field provides contextual explanations that are
potentially useful to the antipattern and its refactored solution.
• Antipattern Solution:
• This field defines the antipattern solution through diagrams,
explanations, examples, and discussions of design forces.
• Causes, Symptoms, and Consequences:
• This section lists the typical causes, common symptoms, and
resulting consequences of the antipattern solution.
• Make it easier to recognize the antipattern and understand how and
why its replacement is necessary
• The body fields in the full cyber antipattern template are:
• Known Exceptions:
• This section identifies situations where the antipattern solution
might be desirable.
• Refactored Solution and Examples:
• The refactored solution is proposed as an alternative to the
antipattern solution. Refactoring is a process of replacing or
reworking a given solution into an alternative solution.
• Related Solutions:
• If there are other potential solutions to the antipattern, they are
identified in this section
• Cybersecurity Antipattern Catalog
• Signature-Based Malware Detection Versus Polymorphic
Threats
• Document-Driven Certification and Accreditation
• Proliferating IA Standards with No Proven Benefits
• Policy-Driven Security Certifications Do Not Address the
Threat
• Cyber mistakes, and bad security habits with these prevalent
antipatterns:
• Can’t Patch Dumb
• Unpatched Applications
• Never Read the Logs
• Networks Always Play by the Rules
• Hard on the Outside, Gooey in the Middle
• Webify Everything
• No Time for Security
• Also Known As:
• Social Engineering, Phishing, Spam, Spyware, Drive-by Malware,
Ransom-Ware, Autoplay Attacks
• Security Awareness
• Confidentiality, Integrity
• “Technology is not the problem; people are the problem”
• Antipattern Solution
• The end user’s lack of security awareness puts his personal
information and the organization’s competitiveness at risk.
• Unaware end users are easily fooled into opening malicious
e‑mail attachments, responding to spam offers, and
downloading spyware, ransom-ware, and malicious websites.
• The spyware problem is much more widespread and
thousands of web-tracking companies making money spying
on web activities and capturing information from browser
tabs.
• Autoplay infections result when malware is introduced by a
user from a Universal Serial Bus (USB) memory stick, often
in violation of organizational policies.
• Causes, Symptoms, and Consequences
• Causes and symptoms of this antipattern are a lack of a recurring
security awareness training program for all end users.
• Refactored Solution and Examples
• Security awareness training should be mandatory for every person
in an organization.
• The courses should include training on social engineering skills as
well as Internet safety.
• The training should articulate the organization’s policies.
• Related Solutions
• End users should have website advisors installed as part of the
antivirus suite.
• Users should take even further precautions, while using websites.
• Also Known As:
• Vendor-Specific Updates, Default Configuration
• Patch Management
• Management of integrity
• “Most new attacks are going after the applications, not the
operating systems.”
• Background
• Vendors release new software at the earliest.
• For example, some early versions of Windows were released with
about 25,000 known defects.
• Patches are software updates that repair known defects. All defects
are potential security issues, given the likelihood that a defect in one
part of the software could affect any other part of the system.
• Unpatched applications are one of the biggest security risks.
• Vendors try to release patches for the problems at the same time that
the defects are announced.
• The lag between the patch release and the installed update creates a
vulnerability window for attackers.
• The causes, symptoms, and consequences of this antipattern
include
• Automatic update disabled on any application where it’s available
• Never visit vendor websites to search for updates
• No update maintenance schedule
• No governance of application versions
• Known Exceptions
• If software product support has expired and there are no further
vendor updates, migration to a supported version is strongly
recommended.
• Some vendors, will continue to support the product with security
patches for an additional fee.
• Enable automatic updates on Windows and applications such as
Acrobat and Firefox.
• For larger networks, patch management tools can maintain
hundreds or thousands of machines.
• For greater assurance adopt vulnerability scanning tools
• Also Known As:
• Guys Watching Big Network Displays Miss Everything, Insider
Threat, Advanced Persistent Threat (APT), Network Operations
Center (NOC)
• Advanced Log Analysis
• Management of confidentiality
• Nick Leeson at Barings Bank, Wikileaks, Aurora Cyber Intrusions
• Network operating centers (NOC) are facilities with large
colorful displays of system and network status.
• System, network, and security devices send messages about
events (audit logs) to centralized management applications.
• The alerting rules are usually set to eliminate false positive
alarms.
• For example, Intrusion Detection System (IDS) rules and
Intrusion Prevention Systems (IPS) that cause false alarms
are disabled
•
•
•
•
include
• Nobody responsible for reading network, system, and
security logs.
• No health and status monitoring of syslog events.
• No alarm rules for Windows configurations.
• New IDS yields numerous alerts.
• Many IDS rules disabled.
• Depending on the criticality of the applications, it might be
necessary to review the logs daily or multiple times
throughout the day.
• Depending on the criticality of the applications, it might be
necessary to review the logs daily or multiple times
throughout the day.
• Also Known As:
• Trust All Servers, Trust All Clients, Do You Believe in Magic?
• System Hardening, State-of-the-Art Wireless Security Protocols
• Management of confidentiality and integrity
• In wireless, the access point with the strongest signal is the one that
user devices will trust, even if it’s malicious.
• The Internet was not designed with security in mind.
• There is a free security tool called Karma that can turn any Wi-Fi-
enabled laptop into an imposter wireless access point.
• Karma fools other laptops into sharing their cookies for major
websites
• Lack of server authentication (HTTP, Wi-Fi, GSM, DNS, SMTP)
• Lack of client authentication (HTTP, HTTPS)
• Not monitoring networks for malformed protocols and packets
• Use the most advanced, updated solutions for antivirus, anti-
spyware, IDS, IPS, and Host-Based Security System (HBSS).
• Configure systems such as Wi-Fi-enabled laptops to require host
authentication.
• Converting some information content from its original format into
a format capable of being displayed on the World Wide Web.
• Also Known As:
• Cross-site scripting, Cross-site Request Forgery, US Power Grid on
Internet, Global Financial System on Internet
• Physical Separation, Out of Band Separation
• Management of integrity and availability
• “Why the hell would they put the electrical power grid on the Internet?”
• Causes, Symptoms, and Consequences.
• Web browsers are a user interface platform for applications, called
thin clients. They are convenient for system administrators because
there is no client software installation or client software updates.
• Users are in the habit of opening multiple browser tabs and
connecting with multiple websites. Malicious content can be
embedded in the site or served up through advertisements supplied
by third parties.
• Interception of packets using technologies like network sniffers is
essentially prevented.
• VPNs are a widely deployed technology to prevent.
•
•
• Also Known As:
• Add Security Last, Blame Security for Schedule Slippage, Deliver It
Now!
• Security Requirements Are Real Requirements, Cyber Risk
Management
• Management of confidentiality, integrity, and availability
• “Wait until it’s time to test the system, and then worry about
security.”
• Background
• Security is usually the final consideration in the development
of a system.
• Developers of software projects wait until the end of the
development lifecycle to address security.
• Near the date that the enterprise release process will test
security vulnerabilities
include
• Security was never part of the requirements.
• Saving on development costs and time at the expense of security.
• Project is behind schedule.
• Shared administrator accounts.
• Not training the developers to be security aware.
• Security risks and requirements should be analyzed early in
the development cycle.
• The security requirements should be given first class status
in the overall requirements set.

Module - 4: Cyber Network Security Concepts

Uploaded by

Copyright:

Available Formats

Module - 4: Cyber Network Security Concepts

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module - 4: Cyber Network Security Concepts

Uploaded by

Copyright:

Available Formats

Module - 4

You might also like