Computer Security Fundamentals, 5th edition William Chuck Easttom Solution Manual

Type:

Solution Manual

Computer Security Resource: Fundamentals Edition:

5th Edition

Author(s):

William Chuck Easttom

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 1 INTRODUCTION TO COMPUTER SECURITY

CHAPTER 1 OBJECTIVES When students finish reading this chapter, they will be able to: •

Identify the top threats to a network: security breaches, denial of service attacks, and malware

•

Understand essential security concepts

•

Assess the likelihood of an attack on a network

•

Define key terms such as cracker, penetration tester, firewall, and authentication

•

Compare and contrast perimeter and layered approaches to network security

•

Use online resources to secure a network

CHAPTER OVERVIEW This chapter introduces students to the actual threats posed to a network. It also gives a high-level overview of the entire textbook, introduces topics, and references detailed content covered in later chapters. This chapter introduces students to key terms, techniques, and network security resources.

The major sections in this chapter are: 1.

How Seriously Should You Take Threats to Network Security? Realistically assesses the risks to your computer network.

2.

Identifying Types of Threats. Covers the common threats to a computer, including malware, security breaches, and denial of service attacks.

3.

Assessing the Likelihood of an Attack on Your Network. Reviews the dangers of attacks on computer networks.

4.

Basic Security Terminology. Presents definitions of the people, devices, activities, and basic paradigms involved in network security.

5.

Concepts and Approaches. Examines concepts and approaches to consider about security.

.

1

6.

How Do Legal Issues Impact Network Security? Covers privacy and security laws and their impact on organizations.

7.

Online Security Resources. Presents some major security organizations with links to their sites.

CHAPTER OUTLINE I.

How Seriously Should You Take Threats to Network Security?

II.

Identifying Types of Threats Malware Compromising System Security DoS Attacks Web Attacks Session Hijacking Insider Threats DNS Poisoning New Attacks

III.

Assessing the Likelihood of an Attack on Your Network

IV.

Basic Security Terminology Hacker Slang Professional Terms

V.

Concepts and Approaches

VI.

How Do Legal Issues Impact Network Security?

VII.

Online Security Resources CERT Microsoft Security Advisor F-Secure SANS Institute

.

2

KEY TERMS Annualized Loss Expectancy (ALE) Single Loss Expectancy (SLE) multiplied by the Annual Rate of Occurrence (ARO).

Auditing The process of reviewing logs, records, and procedures to determine if these items meet standards.

Authentication The process of determining if the credentials given by a user or another system (such as a username and password) are authorized to access the network resource in question.

Black hat hacker Someone who uses hacking skills for malicious and illegal purposes.

CERT Computer Emergency Response Team, the first computer incident-response team and one of the most respected, sponsored by Carnegie Mellon University.

CIA triangle A common security acronym for confidentiality, integrity, and accessibility.

Cookie A small bit of data, often in plain text, that is stored by web browsers.

Cracker One who breaks into a system to do something malicious, illegal, or harmful. Synonymous with black hat hacker.

Denial of service (DoS) A type of attack that prevents legitimate users from accessing a resource. This is usually done by overloading the target system with more workload than it can handle.

DNS poisoning A type of attack that seeks to compromise a DNS server so that users can be redirected to malicious websites, including phishing websites.

Doxing The process of finding personal information about an individual and broadcasting it, often via the Internet.

Ethical hacker One who hacks into systems to accomplish some goal that he feels is ethically valid. Often called a penetration tester.

Firewall A device or software that provides a barrier between your machine or network and the rest of the world.

Gray hat hacker A hacker who usually obeys the law but, in some instances, will cross the line into black hat hacking.

Hacker One who tries to learn about a system by examining it in detail and reverse engineering.

Hacking Any attempt to gain unauthorized access to your system. This includes cracking passwords, elevating privileges, and breaking into a server.

Intrusion detection system (IDS) A system for detecting attempted intrusions.

Key logger Software that logs keystrokes on a computer.

Layered security approach A security approach in which the perimeter is secured as well as individual systems within the network.

.

3

Logic bomb Software that lays dormant until some specific condition is met, such as a date and time.

Malware Any software that has a malicious purpose, such as a virus or Trojan horse.

Penetration testing Assessing the security of a system by attempting to break into the system. Penetration testing is the activity of most penetration testers.

Personal Health Information (PHI) Information about an individual's health conditions and treatments.

Personally Identifiable Information (PII) Information that can be used to identify an individual.

Phreaking Hacking into telephone systems.

Proxy server A device that hides internal IP addresses and presents a single IP address to the outside world.

Single Loss Expectancy (SLE) The Asset Value (AV) multiplied by the Exposure Factor (EF).

Script kiddy (or kiddie) A slang term for an unskilled person who purports to be a skilled hacker.

Social engineering The use of persuasion on human users to gain information required to access a system.

Spyware Software that monitors computer use.

Trojan horse Software that appears to have a valid and benign purpose but has another nefarious purpose.

Virus Software that is self-replicating and spreads like a biological virus.

War-dialing Dialing phones waiting for a computer to pick up. War-dialing is usually done via some automated system.

War-driving Driving and scanning for wireless networks that can be compromised.

White hat hacker A hacker who does not break the law; often synonymous with “ethical hacker.”

TEACHING NOTES I.

How Seriously Should You Take Threats to Network Security?

Teaching Tip: Have students assess the risk on their home computers using the formulas on page 6. Lead students in a discussion on how valuable they believe their data is to someone else.

Teaching Tip: Have students calculate the SLE and the ALE for an example scenario using the formulas provided.

II.

Identifying Types of Threats Teaching Tip: Lead students in a discussion about why someone would write malware, break into a system, or deny access to another system.

.

4

III.

Assessing the Likelihood of an Attack on Your Network Teaching Tip: Review the common methods of attacks on computer systems, including spyware and unauthorized usage of systems by internal employees. Have the students perform a risk analysis on their own network.

IV.

Basic Security Terminology Teaching Tip: As with any occupation, security personnel need to understand the language used by people in the field. In this case, there are two basic cultures. Some exploit systems and some protect systems; each may use words a little differently. Review some examples for each of these two cultures.

Teaching Tip: Ask students: “Who should grant permission for a penetration tester to test the security of a system? Would it be the system administrator, the head of the IT department, or the CEO? How would a penetration tester prove she has the authorization to break in?”

Teaching Tip: Not all IT security issues have technological solutions. IT Security is about one-third technology, one-third business, and one-third sociology. Social engineering is by far the tool of choice for most crackers. You can obtain an ID and password faster, easier, and with less risk over the phone than by using a computer. Ask students whether they have overheard a conversation in which someone has revealed a password. Ask them to recall the key rules for personal password security.

V.

Concepts and Approaches Teaching Tip: Good security has different layers of access. Use the example of a bank safety deposit box.

What layers of security do you need to go through to get to items stored in your safety deposit box? The doors to the bank building have locks. The lobby may have armed guards. The vault has a big lock on it.

Each drawer of a safety deposit box also has two key locks—you have one key, and the bank has the other.

How do layers improve security?

VI.

How Do Legal Issues Impact Network Security?

Teaching Tip: Help students understand that IT security needs to protect systems not only from hackers but also from untrained users, disgruntled employees, and lawyers. Lawsuits can damage a company faster than the loss of a computer or the temporary loss of data. Lawsuits can even lead to imprisonment of CEOs if their IT department did not perform “due diligence.”

VII.

Online Security Resources Teaching Tip: Review with students some of the available online security resources they will need in the professional world. These include CERT, the Microsoft Security Response Center, F-Secure, and the SANS Institute.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 Is there such a thing as an ethical reason for unauthorized access to a computer system?

.

5

Answer: Students’ answers may vary. There may be a discussion of gray hat hackers, who feel they are acting ethically when they hack into the system of a corporation they feel is unethical.

B. Discussion Question 2 Who is legally responsible for leaks of credit card numbers you have used online?

Answer: Students’ answers may vary. Facilitate a discussion regarding the legal issues governing companies doing business over the Internet. In addition, mention the consumers’ responsibility to be aware of site security they frequent.

II.

Web Projects A. Web Project 1 Have students visit the CERT statistics site at www.cert.org to see how vulnerabilities are growing.

Have them chart the number of incident reports for 10 years. This project can further students’ understanding of the increasing threats to network security.

Answer: This project explores in-depth information on the increased number of vulnerabilities.

B. Web Project 2 Kevin Mitnick is a well-known “hacker” from the 1980s. He used social engineering and technical knowledge to break into many systems. Look up the history of Kevin Mitnick using a search engine to find out first, whether he used technology or social engineering more in order to succeed.

Second, determine whether he was caught, convicted, or served time. Third, look at his security company at http://www.mitnicksecurity.com/. After reading his history, would you hire him as a security consultant?

Answer: This project can further students’ understanding of the activities of a hacker. Students should find answers to the questions previously asked and formulate an opinion on whether Mitnick would be a good hire as a security consultant.

C. Web Project 3 One type of specialty hacking involves breaking into telephone systems. This subspecialty in the 1980s of hacking was referred to as phreaking. Find articles on phone phreaking and look up a device called “the blue box.” What does this device do? Does it still work on today’s phone system? What is the significance of 2600? And who is “Cap'n Crunch?” A good place to start is http://www.telephonetribute.com/phonephreaking.html.

Answer: This project can further students’ understanding of phreaking. Students should find answers to the questions previously asked.

D. Web Project 4 CERT National Cyber Alert System Cyber Security Alerts provide timely information about current security issues, vulnerabilities, and exploits. At https://www.us-cert.gov/mailing-lists-and-feeds you can subscribe to one of their mailing lists.

Answer: This project explores in-depth information on the security resources available online.

.

6

WEB RESOURCES •

http://www.cert.org The Computer Emergency Response Team site; a respected security resource

•

https://www.microsoft.com/en-us/msrc?rtc=1 The Microsoft Security Response Center website, with Microsoft-specific security information

•

http://www.f-secure.com F-Secure corporation for virus information

•

http://www.sans.org/ SANS Institute website for security-related documents

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

You are trying to explain security to a nontechnical manager. She has taken a rather extreme view of computer security. Which of the following is one of the extreme viewpoints about computer security discussed in this chapter?

C 2.

You have just taken over as network security administrator for a small community college. You want to take steps to secure your network. Before you can formulate a defense for a network, what do you need?

B

3.

Mary is teaching an introductory cybersecurity course to freshmen. She is explaining to them the major threats. Which of the following is not one of the three major classes of threats?

B

4.

Being able to define attack terms is an important skill for a cybersecurity professional. What is a computer virus?

B

5.

Being able to define attack terms is an important skill for a cybersecurity professional. What is spyware?

A

6.

What is a penetration tester?

C

7.

Elizabeth is explaining various hacking terms to a class. She is in the process of discussing the history of phone system hacking. What is the term for hacking a phone system?

D

.

7

8.

What is malware?

A

9.

What is war-driving?

C

10.

What is the name for the hacking technique that involves using persuasion and deception to get a person to provide information to help compromise security?

A

11.

There are many threats on the Internet. Which one is currently the most common may change over time, but certain threats have always been more common than others. Which of the following is the most common threat on the Internet?

C

12.

What are the three approaches to security?

A

13.

Defining your security strategy is an important step in securing a network. You are trying to classify devices based on the approach they take to security. An intrusion detection system is an example of which of the following?

A

14.

Which of the following is the most basic security activity?

A

15.

The most desirable approach to security is one that is which of the following?

B

16.

As of 2022, which of the following is the fastest-growing target for cyber attacks?

A

17.

Which of the following types of privacy law affects computer security?

B

18.

The first computer incident-response team is affiliated with what university?

B

19.

.

Which of the following is the best definition of the term sensitive information?

8

C 20.

Which of the following is the best description of doxing?

C

Exercises

EXERCISE 1.1: HOW MANY VIRUS ATTACKS HAVE OCCURRED THIS MONTH? The student should give an accurate account of how many virus attacks have occurred in the specified timeframes.

Checking with the F-Secure website is the most accurate way to verify the current count.

EXERCISE 1.2: LEARNING ABOUT COOKIES AS SPYWARE The essay about cookies and privacy should discuss that cookies can store a wide range of data and that this data can be read by any website, not just the site that generated the cookie.

EXERCISE 1.3: HACKER TERMINOLOGY In this exercise, the student uses an online dictionary to define hacker terms.

A. Alpha geek: The most technically accomplished or skillful person in some implied context.

B. Grok: Means to understand, usually in a global sense. Connotes intimate and exhaustive knowledge. The more emphatic form is “grok in fullness.”

C. Red Book: Has several meanings depending upon the users and the context. The first meaning of Red Book is as an informal name for one of the three standard references about PostScript ("PostScript Language Reference Manual,” Adobe Systems; or its 1990 second edition.) The other Adobe reference books are known as the Green Book, the Blue Book, and the White Book.

The second meaning of Red Book is as an informal name for one of the three standard references about Smalltalk ("Smalltalk-80: The Interactive Programming Environment" by Adele Goldberg).

Also used to refer to a document about standards done in the 1980s by an assembly of the CCITT, an IEEE guide about ISO 9945-1, and an NSA publication.

D. Wank: Used much as hack elsewhere, the computer hacker’s term wank can be used as a noun denoting a clever technique or person or the result of such cleverness. May describe (negatively) the act of hacking for hacking’s sake or (more positively) a wizard. When used as an adjective, wanky describes something particularly clever (a person, program, or algorithm). Conversations can also get wanky when there are too many wanks involved. Considered an extremely rude term in Britain and the Commonwealth.

EXERCISE 1.4: USING SECURITY RESOURCES The student might find three policy or procedure documents about security anywhere; however, the SANS Institute website is probably the best place to start. The students’ explanations should also include a discussion of the impact of policies on any organization’s security.

.

9

EXERCISE 1.5: LEARNING ABOUT THE LAW The students should list laws about computer security, in particular those laws specific to their state or locality.

State government websites should be adequate to verify an accurate list.

Projects

PROJECT 1.1: LEARNING ABOUT A VIRUS After researching one virus, students should discuss the methods the virus uses to propagate, the specific damage it causes, and speculation as to the motivations of the virus creator.

PROJECT 1.2: CONSIDERING THE LAW (A GROUP PROJECT) This is an open-ended assignment to make students think about what computer law they would like to see passed.

Quality answers would include a well-stated law, its justification, and how the students would want the law implemented and enforced.

PROJECT 1.3: RECOMMENDING SECURITY This assignment about security recommendations requires critical thinking. A good answer will list five recommendations gathered from at least one source, and for each, students must say why the recommendation is sound. Though students’ knowledge of computer security is limited at this point, this project is a good introduction to the recommendations others make. It should get them thinking about security and begin to critically assess the recommendations of others.

Case Study The successful student will notice that in this case study, the network administrator did handle all the essentials, including protecting against virus attacks and enabling a firewall. Removing Internet access from employee machines was the single-most significant factor in preventing virus outbreaks. Students might recommend any of the following: •

Installing antispyware

•

Limiting the employee computers to running only the operating system and required business software

•

Disconnecting removable drives

.

10

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 2 NETWORKS AND THE INTERNET

CHAPTER 2 OBJECTIVES When students finish reading this chapter, they will be able to: •

Identify each of the major protocols used in network communication (for example, FTP and Telnet) and what use you can make of each of them

•

Understand the various connection methods and speeds used on networks

•

Compare and contrast various network devices

•

Identify and explain various network protocols

•

Understand how data is transmitted over a network

•

Explain how the Internet works and the use of IP addresses and URLs

•

Recount a brief history of the Internet

•

Use network utilities such as ping, IPConfig, and tracert

•

Describe the OSI model of network communication and the use of MAC addresses

CHAPTER OVERVIEW This chapter is a high-level summary on networking. It describes the protocols and devices using the OSI model layers. Students should also understand IP addressing and the Internet as a network. This material will be critical in later chapters.

The major sections in this chapter are: 1.

Network Basics. Examines the basic technologies, protocols, methods, and devices used for networks and the Internet to communicate.

2.

How the Internet Works. Covers IP addresses, URLs, network packets, and basic communications.

3.

History of the Internet. Presents the origins of the Internet and further developments that led to its growth.

.

1

4.

Basic Network Utilities. Presents the basic command-line networking utilities: IPConfig, ping, tracert, netstat, nslookup, arp, route, and pathping.

5.

Other Network Devices. Reviews firewalls and proxy servers in more detail.

6.

Advanced Network Communications Topics. Covers some extra information that can provide a broader understanding of networking, including the OSI model, the TCP/IP model, and MAC addresses.

7.

Cloud Computing. Defines cloud computing and covers the primary cloud classifications, common purposes, and security standards.

CHAPTER OUTLINE I.

Network Basics The Physical Connection: Local Networks Faster Connection Speeds Wireless Bluetooth Other Wireless Protocols Data Transmission

II.

How the Internet Works IP Addresses Uniform Resource Locators What Is a Packet?

Basic Communications

III.

History of the Internet

IV.

Basic Network Utilities IPConfig Ping Tracert Netstat

.

2

NSLookup ARP Route PathPing V.

Other Network Devices

VI.

Advanced Network Communications Topics The OSI Model The TCP/IP Model Media Access Control (MAC) Addresses

VII.

Cloud Computing

KEY TERMS 802.11 The IEEE standard that governs wireless Ethernet, or Wi-Fi. ARP Address Resolution Protocol, used to map IP addresses to MAC addresses.

Backbones The central Internet connections to which Internet Service Providers must ultimately connect.

Bluetooth A short-range wireless communication standard used primarily to connect wireless peripherals to computing devices using the 2.4GHz to 2.485GHz frequency.

Client errors Errors that occur on the client side rather than the server side.

Cloud computing A computing model that enables convenient, on-demand network access to a shared pool of computing resources.

Domain Name System (DNS) A protocol that translates names, such as www.pearson.com, into an IP address.

Firewall A device or software that provides a barrier between your machine or network and the rest of the world.

Hub A device for connecting computers.

IEEE Institute of Electrical and Electronics Engineers, an organization that publishes standards for technology.

Internet Protocol Security (IPSec) A protocol critical for securing virtual private networks.

Internet Service Provider (ISP) A company that provides Internet access for clients.

IPv4 address A numerical designation for a computer consisting of four 1-byte binary numbers. .

3

IPConfig A utility that provides extensive information about a computer’s network connection.

MAC address The physical address of a network card. It is a 6-byte hexadecimal number. The first 3 bytes define the vendor. netstat A command that tells what connections a computer currently has.

Network Access Points (NAP) Places where you can connect to a network. This often refers to wireless network connectivity points.

Network interface card (NIC) A device that provides connectivity to a network. nslookup A command that is used to connect with a network's DNS server or verify that it is running.

OSI model A seven-layer model describing network connectivity, devices, and protocols.

Packet A binary piece of data prepared for transmission over a network. pathping A command that provides detailed information regarding latency at hops between source and destination. ping To send a single ICMP packet to a destination, usually to confirm that the destination can be reached.

Port A numerical designation for a connection point on a computer. There are well-defined ports for specific protocols, such as FTP port 21, HTTP port 80, and so on.

Protocol An agreed-upon method of communication in networking.

Proxy server A device that hides internal IP addresses and presents a single IP address to the outside world.

Repeater A device used to boost signal. route A command used to view the IP routing table.

Router A device that connects two networks.

Server errors Errors that occur on the server side rather than the client side.

Subnetting Chopping up a network into smaller portions.

Switch An intelligent hub that can determine where a packet is being sent. tracert A command that traces the path of a network packet from source to destination.

Transmission Control Protocol/Internet Protocol (TCP/IP) A suite of protocols used for various types of Internet and networking communication.

Uniform Resource Locator (URL) An Internet address, such as www.pearson.com.

WEP Wired Equivalent Privacy, an older, less-secure form of wireless encryption.

.

4

WPA Wi-Fi Protected Access, a form of wireless encryption that improves upon WEP and uses Temporal Key Integrity Protocol (TKIP) as a per-packet key.

WPA2: A form of wireless encryption that improves upon WPA and uses Advanced Encryption Standard (AES) as a per-packet key.

TEACHING NOTES I.

Network Basics Teaching Tip: Bring in a cable, hub, switch, or router. Show students how easy it is to hook up PCs to these devices. Demonstrate the difficulty to tell the difference between the three devices on the outside.

Explain that a hub broadcasts all the network traffic to all ports.

Teaching Tip: Explain that TCP and IP are only two layers of the OSI model. However, TCP/IP is a collection of protocols, two of which are TCP and IP. IP is the network layer, responsible for IP addresses and moving the packet to the correct computer. TCP can guarantee delivery at the cost of overhead. ICMP is the “traffic cop”, ensuring the data flow is OK.

II.

How the Internet Works Teaching Tip: Discuss IP addresses and review the differences between IP version 4 (IPv4) and IP version 6 (IPv6). Have students manually convert numbers between binary and decimal, and then for comparison, use the calculator app in Windows.

III.

History of the Internet Teaching Tip: Explain the origins of the Internet and how its roots can be traced to the Cold War. Discuss the major developments that further advanced the Internet and the organizations that were involved. Review the beginnings of HTTP, HTML, and the World Wide Web.

IV.

Basic Network Utilities Teaching Tip: Demonstrate these utilities in class. IPConfig tells you whether your computer is configured correctly. Ping is a great way to tell whether you are actually connected to a computer. Tracert helps to track where there may be a bottleneck or breakdown in the network. Beware that tracert and ping traffic may be blocked at corporate firewalls. Also review the netstat, nslookup, ARP, route, and pathping utilities.

Discuss when you would use each of the utilities.

Teaching Tip: Demonstrate ping of 127.0.0.1 as a way to test whether TCP/IP is running on your local computer.

V.

Other Network Devices Teaching Tip: Emphasize to students that firewalls can be complex devices. Some can filter only by protocol, IP addresses, and port numbers. Others can detect potential attacks at the application level and block them. Proxy servers not only show one face (one IP address) to the Internet for protection of LAN IP addresses, but they also buffer web page information, cutting down on Internet traffic.

VI.

.

Advanced Network Communications Topics

5

Teaching Tip: Explain that the data link, network, and application layers of the OSI model have different addressing (MAC, IP, and URL). As the computer goes through the layers, the URL becomes an IP address, which needs to end up with a MAC address using DNS and ARP. Teaching Tip: Ask what would happen if two houses had the same street address. How do you avoid having two NICs with identical MAC addresses? Each vendor has a code that is the first part of a MAC address, with the second part being like a serial number. In that way, no two NICs have the same address.

VII.

Cloud Computing Teaching Tip: Discuss common uses for cloud computing and review the three primary classifications of clouds—public, private, and community. Also, discuss a few of the common purposes of cloud computing, such as software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS), and provide specific examples of each.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 Should all hubs be replaced with switches?

Answer: Students’ answers may vary. There should be a discussion of cost versus security; a hub is inexpensive but broadcasts all network traffic to all ports.

B. Discussion Question 2 If you were building your home, what cables would you install?

Answer: Students’ answers may vary. The issues are cost, transmission speed, and security. See whether any students come up with “wireless” for an answer.

II.

Web Projects A. Web Project 1 Search online for your state’s building code to find out which type of Cat cable is to be used in new residential and commercial installations.

Answer: This project will further students’ understanding of cable types. A discussion of the answers they find should include possible reasons for the state’s decision and whether students agree with the state building code.

B. Web Project 2 Go to http://www.faqs.org/docs/linux_network/x-087-2-iface.ifconfig.html to find out what the “if” in “ifconfig” stands for. How is it different from ipconfig? Where is it used?

.

6

Answer: This project furthers students’ understanding of this network utility. Students should find answers to the questions asked; the discussion could include Linux in general.

C. Web Project 3 There is talk of the ability of IPv6 saving the Internet from the shortcomings of IPv4. Search online for “IPv5.” What happened to this version of IP? Answer: This project provides more in-depth research into Internet protocols. Students should find the answer to the question asked. They might compare and contrast the different IP versions and find out the reasons for revising IP.

WEB RESOURCES •

http://www.freesoft.org/CIE/Topics/75.htm Freesoft.org, an Internet Encyclopedia; Domain Name Service DNS topic

•

http://www.faqs.org/docs/linux_network/x-087-2-iface.html Linux Network Administrator’s Guide; Chapter 5: Configuring TCP/IP Networking

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

Malek is purchasing cable to use in setting up small office networks. He wants to stock up on commonly used cable. What type of cable do most networks use?

D 2.

You are assigned to attach connectors to segments of cable. What type of connector is used with network cables?

D

3.

What type of cable is used in most networks?

A

4.

John is trying to simply connect three computers in a small network. He does not need any sort of routing capability and is not concerned about network traffic. What is the simplest device for connecting computers?

C

5.

.

Sharice is trying to teach a new technician basic networking terms. What should she tell this new technician NIC stands for?

7

A 6.

Which of the following is a device used to connect two or more networks?

B

7.

Juan has just installed a new T1 line into a doctor's office. The doctor's front desk receptionist has asked what speed they can expect. A T1 line sends data at what speed?

B

8.

Which of the following best describes polycloud?

D

9.

What protocol translates web addresses into IP addresses?

A

10.

What protocol is used to send email, and on what port does it work?

C

11.

Gunther is setting up encrypted remote communications so that the server administrators can remotely access servers. What protocol is used for remotely logging on to a computer in a secure manner?

A

12.

Mohammed needs to open a firewall port so that web traffic can be passed through the firewall. What protocol is used for web pages, and on which port does it work?

B

13.

What is the name for the point where the backbones of the Internet connect?

C

14.

You are examining a list of IP addresses. Some are internal, some are external, and some are not valid.

Which of the following is not a valid IP address?

B

15.

What class of address is the IP address 193.44.34.12?

C

16.

The IP address 127.0.0.1 always refers to your what?

C

17. .

Internet addresses of the form www.chuckeasttom.com are called what?

8

B 18.

Which U.S. government agency created the distributed network that formed the basis for the Internet?

A

19.

Which of the following was one of the three universities involved in the original distributed network set up by a government agency?

A

20.

You are explaining the history of networking to a group of first-year students. What did Vint Cerf invent?

C

21.

You are explaining the history of networking to a group of first-year students. What did Tim Berners-Lee invent?

A

22.

John is working with command-line utilities to gather diagnostic information about a computer that cannot connect to the network. Which utility provides information about a machine’s network configuration?

B

23.

Sheryl is explaining the OSI model to new technicians at her company. She is trying to explain what protocols operate at the various layers of the OSI model. At what layer of the OSI model does TCP operate?

A

24.

Which layer of the OSI model is divided into two sublayers?

A

25.

Which of the following is a unique hexadecimal number that identifies your network card?

B

Exercises

EXERCISE 2.1: USING IPCONFIG Note if the students effectively use the utility; if so, then they have successfully grasped the concept. In this exercise, students should list their computer’s IP address, default gateway, and subnet mask.

EXERCISE 2.2: USING TRACERT As in the previous exercise, note if the students effectively use the utility. In this exercise, students should discuss what hops were taken, what hops are the same, and why some steps were the same for different destinations.

.

9

EXERCISE 2.3: NSLOOKUP The key to this exercise about nslookup is that the student is going beyond merely a cursory description of what the protocol does. See if the student discusses its history, application, or technical nuances.

EXERCISE 2.4: MORE ABOUT IPCONFIG AND EXERCISE 2.5: MORE ABOUT PING Exercises 2.4 and 2.5 are both procedural. If the students are able to use the utilities and the options described with success, they have also successfully completed the exercises.

Projects

PROJECT 2.1: LEARNING ABOUT DNS The key to this project is to go beyond student’s knowledge of basic DNS functionality. The goal for each student is to be able to describe how and why this protocol was developed, who devised it, and when it was invented.

Furthermore, the student should be able to explain which problem it was designed to solve.

PROJECT 2.2: LEARNING ABOUT YOUR SYSTEM This exercise is about the student’s ability to make good equipment choices. In almost all cases, a switch is preferred to a hub.

PROJECT 2.3: LEARNING ABOUT NETSTAT This project asks the students to interpret the information they get from netstat. Students should go beyond simply reporting on what the utility displays. This project is successfully completed when students make accurate assumptions about the network based on the information they get from this utility.

.

10

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 3 CYBER STALKING, FRAUD, AND ABUSE

CHAPTER 3 OBJECTIVES When students finish reading this chapter, they will be able to: •

Know the various types of Internet investment scams and auction frauds

•

Know specific steps you can take to avoid fraud on the Internet

•

Have an understanding of what identity theft is and how it is done

•

Know specific steps that can be taken to avoid identity theft

•

Understand what cyber stalking is and be familiar with relevant laws

•

Know how to configure web browser’s privacy settings

•

Know what laws apply to these computer crimes

CHAPTER OVERVIEW Fraud and identity theft are real and growing problems. The global scope and relative newness of the Internet make these cybercrimes one of the fastest-growing crimes. As with anything new, students must exercise caution when using the Internet. Countries and states are passing laws and training law enforcement to battle these crimes, but it is critical that people take steps to protect themselves against possible danger.

The major sections in this chapter are: 1.

How Internet Fraud Works. This section presents an overview of what constitutes fraud and defines the different types of fraud, such as investment offers and auction fraud.

2.

Identity Theft. This section discusses identity theft and why it is such a fast-growing crime.

3.

Cyber Stalking. This section presents an overview of what constitutes cyber stalking and illustrates real cases that involve cyber stalking.

4.

Protecting Yourself Against Cybercrime. This section provides steps on how students can protect themselves against fraud, identity theft, and cyber stalking.

.

1

CHAPTER OUTLINE I.

How Internet Fraud Works Investment Offers Auction Fraud

II.

Identity Theft Phishing

III.

Cyber Stalking Real Cyber Stalking Cases How to Evaluate Cyber Stalking Crimes Against Children Laws About Internet Fraud

IV.

Protecting Yourself Against Cybercrime Protecting Against Investment Fraud Protecting Against Identity Theft Secure Browser Settings Protecting Against Auction Fraud Protecting Against Online Harassment

KEY TERMS Bid shielding Hiding an item from other bidders by putting a fake but very high bid on it to discourage other bidders.

Bid siphoning Attempting to lure bidders from a legitimate site to a site that may be used for malicious purposes, such as phishing.

Cyber fraud Using the Internet to defraud someone.

Cyber stalking Using the Internet to harass someone.

Identity theft Stealing personal information on someone so that you might pose as that person. Often done to secure credit or make purchases in the victim’s name.

.

2

Phishing Sending emails to people in which the email purports to be from some legitimate financial institution, such as a bank or credit card company, and inducing the recipient to provide personal information.

Pump and dump Artificially inflating the price of a stock so that you may sell your shares at a much higher value than they should have been sold.

Shill bidding A term for a seller putting in fake bids on his own item to drive up the price.

Spyware Software that monitors computer use.

TEACHING NOTES I.

How Internet Fraud Works Teaching Tip: Discuss with students that because cyberspace is a new territory, it is sometimes compared to the Wild West—a frontier before laws and standard practices are put in place. But students should not be afraid to use the Internet. Just as a car can be either safe or dangerous depending on how it is driven, the Internet can be safe if you know how to protect yourself.

Teaching Tip: Why is Internet fraud grabbing the headlines when these crimes have existed long before the Internet? (1) The Internet enables people to commit crimes across many jurisdictions and countries. It becomes hard to prosecute someone in Nigeria for a U.S. victim. (2) Using the Internet, email can be sent to hundreds of thousands of people at almost no cost. If only a fraction of one percent responds, that still represents a great many victims. (3) The Internet allows a sense of anonymity. You do not always know who or where the person is on the other end of that email.

II.

Identity Theft Teaching Tip: In the Internet age, identity theft is a big issue. How can you prove who you are to a loan officer, the police, or a store? Every type of authentication is fast becoming bits in a computer file. How can you protect those bits from being used to authenticate someone else? In the future, how can you ensure that no one can impersonate you over electronic communications?

III.

Cyber Stalking Teaching Tip: Using the Internet, not only can a person find out everything about you, but they can also reach out and harass you without even being near you. The Internet also allows a sense of anonymity. Harassment on the Internet becomes a sticky issue because the text does not convey feelings or intent as adequately as a face-to-face conversation. People may interpret harassment as an “innocent joke” emailed to a coworker.

IV.

Protecting Yourself Against Cybercrime Teaching Tip: Review with students the steps that can be taken to help protect themselves against many forms of cybercrime, including investment fraud, identity theft, auction fraud, and online harassment. Demonstrate how to change settings to make browsers more secure.

.

3

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 What skills does law enforcement need in order to combat cybercrimes?

Answer: Students’ answers may vary. Students should understand that law enforcement professionals must be aware of the methods cybercriminals use.

B. Discussion Question 2 In Germany, many websites are illegal due to “hate crimes” that would be perfectly legal in the United States under laws of “free speech.” How can countries combat crimes on the Internet that span the globe if each country has its own set of laws?

Answer: Students’ answers may vary. Students should discuss the importance of different countries cooperating to keep cybercrime under control.

II.

Web Projects A. Web Project 1 Email fraud that attempts to get you to pay an “advance fee” to receive millions of dollars by helping to transfer funds is called Nigerian or 419 fraud. Search online for “Nigerian fraud” or “419 fraud” to find out why it is named this way. Try to locate one with the most outrageous claims and share it with the class.

Answer: This project provides more in-depth research into the Nigerian scam.

B. Web Project 2 One of the fastest-growing identity thefts is against children. Children do not check their credit history until they apply for a student loan or credit cards. By then, the thief may be gone for many years. Using the Internet, find news stories of young children that now have damaged credit due to identity theft. How can one protect children against identity theft?

Answer: This project provides more in-depth research into identity theft. Students should come up with some ideas for protecting children against identity theft, particularly the importance of not revealing a child’s Social Security number and making sure children do not provide personal information while online.

C. Web Project 3 Ask students to go to a website where they do banking. How can they be sure that the website belongs to their bank? How do they know that the information they type is secure from phishing? Does the bank’s website offer any information about how to protect yourself online?

.

4

Answer: This project provides more in-depth research into the security of websites. Students should provide answers to the questions asked. You might discuss the ease of creating an official-looking site.

WEB RESOURCES •

http://www.usdoj.gov/criminal/cybercrime/ U.S. Department of Justice website on cyber stalking

•

http://www.creditkarma.com Credit Karma; check your credit rating

•

http://www.haltabuse.org/ The Working to Halt Online Abuse website

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

Candice is discussing Internet fraud with a colleague. She is trying to explain the most common types of fraud. What is the term for the most common type of Internet investment fraud?

A 2.

You have become quite active in online investing. You want to get some advice, but are concerned about the veracity of the advice you receive. What is the most likely problem with unsolicited investment advice?

B

3.

Juan is a security officer for an investment firm. He is explaining various scams to the brokers.

What is the term for artificially inflating a stock in order to sell it at a higher value?

C

4.

What is the top rule for avoiding Internet fraud?

A

5.

Which of the following is not one of the Security and Exchange Commission’s tips for avoiding investment fraud?

A

6.

Aliya is active on online auctions. She wants to avoid auction frauds. What are the four categories of auction fraud?

B

.

5

7.

What is the term for a seller bidding on her own item to drive up the price?

C

8.

What is the term for submitting a fake but very high bid to deter other bidders?

B

9.

What is typically the goal of identity theft?

A

10.

According to the U.S. Department of Justice, identity theft is generally motivated by what?

C

11.

Clarence is a police detective with a small-town police department. He is trying to consider how seriously to take reports of cyber stalking. Why is cyber stalking a serious crime?

B

12.

What is cyber stalking?

B

13.

What do law enforcement officials usually require of a victim in order to pursue harassment allegations?

D

14.

If you are posting anonymously in a chat room and another anonymous poster threatens you with assault or even death, is this person’s post harassment?

B

15.

What must exist for cyber stalking to be illegal in a state or territory?

C

16.

What is the first step in protecting yourself against identity theft?

A

17.

What can you do on your local computer to protect your privacy?

C

18.

What is a cookie?

B

.

6

19.

Which of the following is not an efficient method of protecting yourself from auction fraud?

A

20.

What is the top rule for chat room safety?

B

21.

Why is it useful to have a separate credit card dedicated to online purchases?

A

22.

What percentage of cyber stalking cases escalate to real-world violence?

D

23.

If you are a victim of cyber stalking, what should you do to assist the police?

C

24.

What is the top way to protect yourself from cyber stalking?

A

Exercises

EXERCISE 3.1: SETTING WEB BROWSER PRIVACY IN MICROSOFT EDGE This exercise gives the student practice in setting web browser privacy for Microsoft Edge. It is simply a procedural exercise. If students follow the instructions, they should accomplish the task without issues. For further help with this exercise, students can review the description in the chapter, which includes illustrations on the process.

EXERCISE 3.2: USING ALTERNATIVE WEB BROWSERS This application exercise leads the student through using an alternative web browser. The students should download Firefox from the Mozilla website and then set the privacy and security settings. They can also use other browsers, such as Chrome or Safari.

Projects

PROJECT 3.1: FINDING OUT ABOUT CYBER STALKING AND THE LAW The real heart of this project is for students to interpret the cyber stalking laws that they find. Simply quoting laws would be missing the goal. Ask the students to articulate the meaning and application of these laws in their own words.

.

7

PROJECT 3.2: LOOKING FOR AUCTION FRAUD This project focuses on auction fraud and is designed to train students to use analysis to identify potential fraud. Each student should be able to correlate the suspect’s actions/behavior with specific signs of fraud to successfully complete the project.

PROJECT 3.3: EXAMINING CYBER STALKING CASE STUDIES This is a two-part project about cyber stalking. First, ask students to find a case of cyber stalking and to report the facts therein. Second, have students analyze how that situation might have been avoided, corrected, or at least improved. The critical part of this project is for students to share how they would deal with such a situation.

Case Study This case study about identity theft focuses students’ attention on two issues. First, students will research and discuss how individuals can and should protect their identity online—students should note that in the case study, John should not have used his real name, nor given any specific information as to his actual identity (age, location, and profession).

Second, students will assess how employers can assist in preventing identity theft. For example, the students could mention the idea that employers should not put personnel directories online. An employer who publishes such a directory tells an identity thief too much (for example, John Doe, sales manager, B.A. from Yale in 2015, born in Missouri).

.

8

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 4 DENIAL OF SERVICE ATTACKS

CHAPTER 4 OBJECTIVES When students finish reading this chapter, they will be able to: •

Understand how denial of service attacks are accomplished

•

Know how certain denial of service attacks work, such as SYN flood, Smurf, and distributed denial of service attacks

•

Take specific measures to protect against denial of service attacks

•

Know how to defend against specific denial of service attacks

CHAPTER OVERVIEW This chapter describes in depth the workings of the denial of service (DoS) attack. This threat is one of the most common attacks on the Internet due in part to its ease of use and effectiveness in shutting down services. If you can keep a service from reaching customers, you can effectively stop e-business. Therefore, it is prudent for you to understand how DoS attacks work and how to defend yourself against them.

The major sections in this chapter are: 1.

DoS Attacks. Basic overview of how a denial of service attack works.

2.

Illustrating an Attack. Demonstrates a simple way to squelch a web server with the ping utility.

3.

Common Tools Used for DoS Attacks. Many DoS tools are described, including Low Orbit Ion Cannon (LOIC), XOIC, TFN, TFN2K, and Stacheldraht.

4.

DoS Weaknesses. A DoS attack can be stopped and traced back. DDoS attacks are hard to trace back.

5.

Specific DoS Attacks. Many attacks are explained, in addition to how to defend against them.

6.

Real-World Examples of DoS Attacks. Gives examples from past attacks that were successful, including the Google attack and the AWS (Amazon Web Services) attack.

.

1

7.

How to Defend Against DoS Attacks. Gives steps you can take to minimize the danger of DoS attacks, including some information resources.

CHAPTER OUTLINE I.

DoS Attacks

II.

Illustrating an Attack Distributed Reflection Denial of Service Attacks

III.

Common Tools Used for DoS Attacks Low Orbit Ion Cannon XOIC TFN and TFN2K Stacheldraht

IV.

DoS Weaknesses

V.

Specific DoS Attacks TCP SYN Flood Attacks Smurf IP Attacks UDP Flood Attacks ICMP Flood Attacks The Ping of Death Teardrop Attacks DHCP Starvation HTTP POST DoS Attacks PDoS Attacks Registration DoS Attacks Login DoS Attacks Land Attacks

.

2

DDoS Attacks Yo-Yo Attack Login Attacks CLDAP Reflection Degradation of Service Attacks Challenge Collapsar Attack EDoS VI.

Real-World Examples of DoS Attacks Google Attack AWS Attack Boston Globe Attack Memcache Attacks DDoS Blackmail Mirai

VII.

How to Defend Against DoS Attacks

KEY TERMS Denial of service (DoS) An attack that prevents legitimate users from accessing a resource. This is usually done by overloading the target system with more workload than it can handle.

Distributed denial of service (DDoS) A denial of service attack launched from multiple machines, often without the knowledge of the owners of those machines.

Firewall A device or software that provides a barrier between your machine or network and the outside world.

Flood attack An attack that involves sending a large number of packets to a server in an attempt to overload the server.

Hacker One who tries to learn about a system by examining it in detail and reverse engineering.

ICMP flood attacks Attacks that attempt to overload the target system with too many ICMP packets for it to respond to.

.

3

Internet Control Message Protocol (ICMP) A protocol used for various purposes, including “pinging” other computers.

Land attack Sending a packet to a machine with the source host/port being the same as the destination host/port, causing some systems to crash.

Micro block A defensive technique for a TCP SYN flood attack that works by allocating a micro-record instead of allocating a complete connection object (an entire buffer segment) to the SYN object.

Ping Sending a single ICMP packet to a destination, usually to confirm that the destination can be reached.

Ping of death (PoD) Sending an extremely large packet to a target. For some older systems, this would cause the target to crash.

Port A numerical designation for a connection point on a computer. There are well-defined ports for specific protocols, such as FTP port 21 and HTTP port 80.

Router A device that connects two networks.

RST cookies A simple method for alleviating the danger of certain types of DoS attacks.

Smurf attack A specific type of distributed denial of service attack.

SYN cookies A method for ameliorating the dangers of SYN floods.

SYN flood The process of sending a stream of SYN packets (connection requests) and then never responding, thus leaving the connection half open.

SYN+ACK The response a server sends back to a connection request from a client.

Teardrop attack A type of attack against a TCP/IP stack using fragmented packets.

Trojan horse Software that appears to have a valid and benign purpose but has another nefarious purpose.

UDP flood attack A denial of service attack based on sending a huge number of UDP packets.

Virus Software that is self-replicating and spreads like a biological virus.

TEACHING NOTES I.

DoS Attacks Teaching Tip: Explain that students should not attempt a DoS attack on a LAN that is a subnet of any production system. You may need to set up an isolated LAN to demonstrate this.

II.

Illustrating an Attack Teaching Tip: Diagram the different attacks using steps. This gives a temporal understanding of an attack that is hard to get from a book.

.

4

III.

Common Tools Used for DoS Attacks Teaching Tip: Compare the tools used for DoS attacks listed in the text and explain to students the differentiation of each tool.

IV.

DoS Weaknesses Teaching Tip: Review the DoS weaknesses covered in the text from the attacker’s point of view. Explain to the class why hackers may prefer using a DDoS attack.

V.

Specific DoS Attacks Teaching Tip: Explain to students the specific types of DoS attacks and case studies covered in the text.

VI.

Real-World Examples of DoS Attacks Teaching Tip: Explain to students that the reason these examples are still in circulation today is mostly because people still need to update their computers against them. Review the examples shared in the textbook.

VII.

How to Defend Against DoS Attacks Teaching Tip: Explain that there are also many resources from the OS manufacturer and other places on how to “harden” your computer against most DoS attacks.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 Should old or unpatched computers be allowed on a LAN? Answer: Students’ answers may vary. Most will probably agree that old/unpatched computers should not be allowed on a LAN. B. Discussion Question 2 Can there ever be an effective defense against DDoS attacks?

Answer: Students’ answers may vary. They should mention that the attack is launched from several machines without the owner’s knowledge or complicity and that the traffic looks legitimate.

II.

Web Projects A. Web Project 1

.

5

The Ping of Death exploit is an old one. Most modern operating systems are not vulnerable to it.

Search online for “Ping of Death vulnerable operating systems” to see if any of your computers may be vulnerable.

Answer: This project can further students’ understanding of operating system vulnerability. Students should find answers to the question asked.

B. Web Project 2 Search the Web to find out how to configure a firewall to protect against DoS attacks. Look up “Land attack.” What two simple rules for a firewall would stop this type of attack?

Answer: This project can further students’ understanding of the use of firewalls in preventing DoS attacks. Students should find answers to the question asked.

C. Web Project 3 Search online for “DDoS botnets” to find out about networks of compromised PCs. How do these PCs cause websites to fail? Why are these botnets so hard to stop on DDoS attacks?

Answer: This project provides more in-depth research into compromised PCs. Students should find answers to the question asked and provide some opinions on why the attacks are so hard to stop.

WEB RESOURCES •

https://www.sans.org/white-papers/35877/ A page from the SANS site titled Denial of Service Deterrence

•

http://www.iana.org/assignments/port-numbers Internet Assigned Numbers Authority (IANA); current list of port numbers

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

When considering the various attacks that can be executed on your system, it is important to understand which attacks are more common. Of the following, which is one of the most common and simplest attacks on a system?

A 2.

All DoS attacks are predicated on overwhelming a system’s workload capacity. Therefore, measuring the workload of a system is critical. Which of the following is not a valid way to define a computer’s workload?

C

3.

.

What do you call a DoS attack launched from several machines simultaneously?

6

D 4.

It is important to understand the different types of DoS attacks and the symptoms of those attacks. Leaving a connection half open is a symptom of which type of attack?

C

5.

While there are a wide range of different ways to execute a DoS attack, they all are predicated on the same idea. What is the basic concept behind a DoS attack?

B

6.

What is the most significant weakness in a DoS attack from the attacker’s viewpoint?

D

7.

What is the most common class of DoS attacks?

A

8.

A range of countermeasures can help defend against DoS attacks. What are three methods for protecting against SYN flood attacks?

A

9.

Juan is explaining various DoS attacks to security operators at his company. Which attack mentioned in this chapter causes a network to perform a DoS on one of its own servers?

C

10.

What is the name for a defense that depends on a hash being sent back to the requesting client?

D

11.

What type of defense depends on sending the client an incorrect SYN/ACK? C

12.

You are attempting to explain various DoS attacks to a new security technician. You want to make sure she can differentiate between these different attacks and notice the signs of a specific attack. What type of defense depends on changing the server so that unfinished handshaking times out sooner?

A

13.

What type of attack is dependent on sending packets that are too large for the server to handle?

A

14.

.

You want to make sure your team will identify the various DoS attack vectors. What type of attack uses the victim’s own network routers to perform a DoS attack on the target?

7

D 15.

If you are a website developer and concerned about DoS attacks, what is one mitigation technique you can implement in the website itself?

D

16.

How can securing internal routers help protect against DoS attacks?

D

17.

What can you do to your internal network routers to help defend against DoS attacks?

D

18.

Dorothy is a network administrator. Her system has been experiencing an attack that is using bots to send fake requests to the cloud resources her company uses. This is causing disruption of the availability of these resources. How is this attack best described?

B

19.

No attack mitigation strategy is perfect, and you need to allow at least some traffic into and out of your network, or else your network is of no use. What can you do with your firewall to defend against at least some DoS attacks?

D

20.

You are trying to identify all potential DoS attack vectors. In doing so, you hope to provide mitigation for each of these attack vectors. Why will protecting against Trojan horse attacks reduce DoS attacks?

A

Exercises

EXERCISE 4.1: EXECUTING A DOS ATTACK This exercise is best accomplished in a lab with numerous machines available. The target server should be one of low capacity for this exercise.

This exercise is completely procedural. If the student follows the steps outlined, she should successfully stop a target server from responding. The issue is how many machines does it take to do it? Students might also consider opening multiple command prompt windows per machine and using all of them to simulate more machines.

EXERCISE 4.2: STOPPING SYN FLOOD ATTACKS This advanced exercise (to stop DoS flood attacks) requires students to use resources to find out how to establish either the SYN cookie or the RST cookie. If students can find that information, then the students have successfully completed the exercise. Consider allowing less experienced students to work in groups.

.

8

EXERCISE 4.3: USING FIREWALL SETTINGS AND EXERCISE 4.4: USING ROUTER SETTINGS Exercises 4.3 and Exercise 4.4 are both completely procedural. Following the steps outlined can yield a successful outcome. Exercise 4.3 is only for students with access to a firewall. Exercise 4.4 is only for students with access to a lab router.

Projects

PROJECT 4.1: EMPLOYING ALTERNATIVE DEFENSES This project about employing alternative defenses is designed to get students thinking about ways to find more information. Each book or series of books can only provide some pieces of information a security professional needs. As technology changes, a person must keep up to date. In this project, students use the Web to find alternative defenses.

PROJECT 4.2: DEFENDING AGAINST SPECIFIC DENIAL OF SERVICE ATTACKS This project is about defending against specific denial of service attacks. Like the previous project, Project 4.2 helps ensure that students know how to use Web resources to keep up to date on what happens in the security world. In this case, students are asked to locate information about a recent threat, and students should then explain how one might have defended against that specific attack.

PROJECT 4.3: HARDENING THE TCP STACK AGAINST DOS This is a more complex project requiring access to a lab machine. You may consider assigning Project 4.3 only to more advanced students, perhaps as extra credit, or to groups. It requires students to track down detailed operating system information and apply it. They must find a method to alter TCP communications to help prevent DoS attacks.

Then they must implement one of these methods on a lab computer. This project will take longer than other projects.

Case Study In this case study about preventing DoS attacks, students are asked to identify any potential problems with SYN cookies. Students should also identify other precautions that should have been taken by the network administrator in the case, such as securing internal routers and limiting downloads.

.

9

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 5 MALWARE

CHAPTER 5 OBJECTIVES When students finish reading this chapter, they will be able to: •

Understand viruses (worms) and how they propagate, including famous viruses like WannaCry, Pegasus, and Titanium

•

Have a working knowledge of several specific virus outbreaks

•

Understand the dynamics of virus scanners

•

Understand what a Trojan horse is and how it operates

•

Have a working knowledge of several specific Trojan horse attacks

•

Understand ransomware and the latest trends in ransomware

•

Grasp the concept behind the buffer-overflow attack

•

Have a better understanding of spyware and how it enters a system

•

Defend against various attacks through sound practices, antivirus software, and antispyware software

CHAPTER OVERVIEW In this chapter, students will learn how and why virus outbreaks and Trojan horse attacks occur. Other malware will be explored, such as buffer-overflow attacks and spyware. The ability to defend against such attacks will be enhanced by expanding knowledge on how they work. In the exercises at the end of the chapter, students will have the opportunity to research preventative methods for viruses and try out antivirus methods from McAfee and Norton.

The major sections in this chapter are: 1.

Viruses. Details how viruses are spread and covers some recent examples of successful virus attacks. The chapter also includes rules for avoiding viruses.

2.

Trojan Horses. Explores Trojan horse attacks and how to prevent them.

.

1

3.

The Buffer-Overflow Attack. Explains buffer-overflow attacks and how to prevent them.

4.

Spyware. Covers spyware and discusses the use of spyware and key loggers.

5.

Other Forms of Malware. Discusses rootkits, malicious web-based code, logic bombs, and deep fakes.

6.

Detecting and Eliminating Viruses and Spyware. Describes some tools that can be used to detect and remove malware; discusses several useful websites and utilities.

CHAPTER OUTLINE I.

Viruses How a Virus Spreads Types of Viruses Virus Examples The Impact of Viruses Machine Learning and Malware Rules for Avoiding Viruses

II.

Trojan Horses

III.

The Buffer-Overflow Attack The Sasser Virus/Buffer Overflow

IV.

Spyware Legal Uses of Spyware How Is Spyware Delivered to a Target System?

Pegasus Obtaining Spyware Software

V.

Other Forms of Malware Rootkits Malicious Web-Based Code Logic Bombs Spam

.

2

Advanced Persistent Threats Deep Fakes VI.

Detecting and Eliminating Viruses and Spyware Antivirus Software Anti-Malware and Machine Learning Remediation Steps

KEY TERMS Advanced Persistent Threat (APT) A relatively new term for a continuous process of attacking. It can involve hacking, social engineering, malware, or combinations of attacks.

Adware Software loaded onto your machine, often without your knowledge, which causes ads to pop up on your screen. This technology often works in a different manner than web page pop-ups; thus, pop-up blockers will not stop it.

Backdoor A hole in a security system that is deliberately left by the system’s creator.

Buffer-overflow attack An attack that involves loading a buffer with more data than it is designed to hold.

Code The source code for a program; or the act of programming, as in “to code an algorithm.”

Cookie A small bit of data, often in plain text, that is stored by web browsers.

Key logger Software that logs keystrokes on a computer.

Logic bomb A type of malware that executes its malicious purpose when a specific criterion is met.

Malware Any software that has a malicious purpose, such as a virus or a Trojan horse.

Port A numerical designation for a connection point on a computer. There are well-defined ports for specific protocols, such as FTP port 21, HTTP port 80, and so on.

Rootkit A collection of tools that a hacker uses to mask her intrusion and obtain administrator-level access to a computer or computer network.

Spam Unwanted and unsolicited email that is sent out to multiple parties, often used for marketing purposes.

Spyware Software that monitors computer use.

Trojan horse Software that appears to have a valid and benign purpose but has another nefarious purpose.

Virus Software that is self-replicating and spreads like a biological virus.

.

3

TEACHING NOTES I.

Viruses Teaching Tip: Ask students whether any of them have had their PC infected with a virus. What was the result? How did they recover?

Teaching Tip: Explain that many new forms of malware are combinations of viruses, worms, Trojan horse attacks, buffer overflows, and rootkits. Ask students to share the major differences for each of these.

II.

Trojan Horses Teaching Tip: Many Trojan horse attacks are used to pick up IDs and passwords. Reinforce the harm that a Trojan horse attack can cause, such as downloading harmful software from a website, installing a key logger or other spyware, deleting files, and opening a backdoor for hackers.

III.

The Buffer-Overflow Attack Teaching Tip: Explain that buffer-overflow attacks are more challenging to execute than DoS or other malware attacks. The hacker must have a working knowledge of programming languages such as C or C++.

IV.

Spyware Teaching Tip: Discuss the difference between spyware and a network administrator monitoring the system.

V.

Other Forms of Malware Teaching Tip: Explain and compare other types of malware covered in the text, such as rootkits, logic bombs, spam, and APTs. Review the newer technology called “deep fakes.”

VI.

Detecting and Eliminating Viruses and Spyware Teaching Tip: Discuss the available software programs and remediation steps for detecting and removing malware.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 Should parents install spyware on their PC to monitor their children’s activities?

Answer: Students’ answers may vary. The issue is protecting children from legitimate online threats versus what might be viewed as a lack of trust.

B. Discussion Question 2

.

4

Do pop-up blockers block an advertiser’s freedom of speech?

Answer: Students’ answers may vary. Students should discuss the issue from the points of view of both the computer user/owner and the advertiser.

II.

Web Projects A. Web Project 1 Go to https://blog.avast.com/2015/07/09/top-10-most-annoying-browser-toolbars/ and read the article. Pick one of the toolbars mentioned in the article and research it. Is this toolbar malware? Why or why not? Does it do anything useful at all for the user? What is the impact on a system of leaving it installed?

Answer: This project will further students’ understanding of the gray area in defining what malware is. Students should find answers to the questions asked and form an opinion on whether it is malware.

B. Web Project 2 Search online for “hardware keylogger.” You can record keystrokes without installing software using a device that attaches between the keyboard cable and your PC. How much do these devices cost?

How many keystrokes can they record? How can you detect if one is attached without looking at the back of your computer?

Answer: This project provides more in-depth research into key loggers. Students should find answers to the questions asked.

C. Web Project 3 When is it legal to use spyware? In Florida, a wife used spyware to gather evidence. The wife, who installed spyware on her husband’s computer to secretly record evidence of an extramarital affair, violated Florida law. The Florida Appeals Court said she “illegally obtained” records of her husband’s online conversations with another woman. Students should search online for their state and “spyware court.” See if they can determine what the laws in their state say about the legal use of spyware.

Answer: This project will further students’ understanding of the legal issues surrounding the use of spyware. Students should find information on their states’ laws governing the use of spyware. They should formulate an opinion on the issue.

WEB RESOURCES •

https://www.sei.cmu.edu/about/divisions/cert/ Virus information from the CERT Division of Carnegie Mellon University, a reporting center for Internet security problems

•

http://securityresponse.symantec.com/ Information and advice on security threats from Symantec Security Center

•

https://www.webroot.com/us/en/home/products-spysweeper Spy Sweeper software from Webroot, Inc.

.

5

•

https://www.veriato.com Employee monitoring and insider risk management software from Veriato® Inc.

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

John is a network security administrator for a midsized college. He is trying to explain to a new hire what a virus is. Which of the following is the best definition of virus?

D 2.

Isabelle is responsible for cybersecurity at her company. She is concerned that a virus would cause damage to the IT systems. What is the most common damage caused by virus attacks?

A

3.

You are trying to form policies for your organization that will mitigate the threat of viruses. You want to ensure that you address the most common way for a virus to spread. What is the most common way for a virus to spread?

B

4.

Which of the following is the primary reason that Microsoft Outlook is so often a target for virus attacks?

C

5.

Juan is a network administrator for a small graphic design company. In April 2021 his company was hit by a virus that specifically targeted macOS and was a first-stage downloader for other malware components.

What attack was this?

A

6.

What factor about the Wannacry virus is especially interesting to security practitioners?

A

7.

What was the name of the very first virus ever detected?

A

8.

Elizabeth has found malware on a system in her company. The malware blocks about 600 Windows processes and demands ransom. What has Elizabeth found?

A

9.

Mohaned has found malware on his network. This malware encrypts files demanding ransom and also blocks approximately 600 Windows processes. What malware has Mohaned found?

C

.

6

10.

Which of the following is a method that any person can use to protect against virus attacks?

D

11.

You are trying to develop methods to mitigate the threat of viruses in your company. Which of the following is the safest way to send and receive attachments?

A

12.

Shelly is trying to teach new employees how to handle emailed security alerts. Which of the following is true regarding emailed security alerts?

B

13.

Which of the following is something a Trojan horse might do?

A

14.

Jared is explaining various attacks to students in an introduction to cybersecurity class. He wants to make certain they fully understand the different attacks. What does a buffer-overflow attack do?

D

15.

What virus exploited buffer overflows?

C

16.

What can you do with a firewall to help protect against virus attacks?

B

17.

Malek is explaining various malware types to new technical support personnel. He is explaining to them the various types of malware so that they can recognize them. What type of malware is a key logger?

D

18.

Which of the following is a step that all computer users should take to protect against virus attacks?

D

19.

What is the primary way a virus scanner works?

A

20.

In addition to the primary way a virus scanner works, what other way can a virus scanner work?

D

.

7

Exercises

EXERCISE 5.1: USING NORTON ANTIVIRUS AND EXERCISE 5.2: USING MCAFEE ANTIVIRUS These exercises allow the student to practice using antivirus programs from Norton and McAfee. If students follow the steps given, they will have a successful outcome. Students should say what they like or don’t like about these products.

EXERCISE 5.3: PREVENTING SASSER, EXERCISE 5.4: PREVENTING SOBIG, AND EXERCISE 5.5: LEARNING ABOUT CURRENT VIRUS ATTACKS These exercises ask students to use well-known web resources to identify information about potential virus threats.

In Exercises 5.3 and 5.4, students study how to prevent threats from Sasser and Sobig. Students should explain how these viruses spread, the damage caused, and what preventative steps can be taken. These are important exercises for students to master because it is critical that students learn to use the Web to find reliable, up-to-date information.

In Exercise 5.5, students should locate information about a virus that has spread within the last 90 days.

Projects

PROJECT 5.1: ANTIVIRUS POLICIES This activity can be completed by a student working alone or as a group project. Students are asked to write an original antivirus policy for a small business or school. Check that the policies are written to cover both technical and procedural guidelines. The successful completion of this project should include a policy list that covers the following five areas.

•

Downloading files

•

Opening attachments

•

Running antivirus software

•

Keeping antivirus software updated

•

Patching the operating system

Any additional information would indicate an above average performance on this project.

PROJECT 5.2: THE WORST VIRUS ATTACKS Students are asked to discuss the virus that they consider to have been the worst in history. Students should clearly describe why they feel that the chosen virus was one of the worst recent outbreaks. They also should clearly describe how it functioned, its damage, and how widely and quickly it spread.

PROJECT 5.3: WHY WRITE A VIRUS? This project asks students to speculate about virus writers’ motives. There is no clear right or wrong answer. The purpose of this project is to get students thinking about these issues so that they become used to creatively evaluating the activity of hacking from the hacker’s point of view.

.

8

Case Study This case study requires students to consider how to secure a network from virus attacks. To do the case study, students must apply all the knowledge presented in this chapter and gathered from the previous exercises and projects. Check to see if students can determine where the school’s system is still unsecured. Students should identify at least two additional security steps for the security manager of the school. Items the students might notice that were missed in the scenario and should be considered include: •

Antispyware

•

Setting the browser to prevent running active code

•

Perhaps using spyware on students’ machines to note what they are doing.

.

9

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 6 TECHNIQUES USED BY HACKERS

CHAPTER 6 OBJECTIVES When students finish reading this chapter, they will be able to: •

Understand the basic methodology used by hackers

•

Be familiar with some of the basic hacking tools

•

Understand the hacking mentality

•

Explain specific attack methods

CHAPTER OVERVIEW This chapter explores the techniques that hackers use to commit computer crimes. The techniques presented in this chapter give the reader an understanding of how black hat hackers work and also provide a method whereby a network administrator can perform a penetration test on his or her network. By attempting some of these techniques on your network, you can assess your vulnerability. You should only do this if you are comfortable with the techniques in this chapter and only with permission from senior management.

The major sections in this chapter are: 1.

Basic Terminology. Defines the basic terms used to describe hackers.

2.

The Reconnaissance Phase. Explains passive and active scanning techniques.

3.

Actual Attacks. Describes various attack types, including SQL script injection, cross-site scripting, cookie poisoning, and more.

4.

Malware Creation. Explains how hackers use utilities to create malware. Also covers some of the most common ways that Windows systems are hacked.

5

Penetration Testing. Describes standards that can be used as a guide for a penetration test.

6.

The Dark Web. Explains how the Dark Web works and the dangers involved in surfing there.

.

1

CHAPTER OUTLINE I.

Basic Terminology

II.

The Reconnaissance Phase Passive Scanning Techniques Active Scanning Techniques

III.

Actual Attacks SQL Script Injection Cross-Site Scripting Cross-Site Request Forgery Directory Traversal Cookie Poisoning URL Hijacking Command Injection Wireless Attacks Cell Phone Attacks Password Cracking

IV.

Malware Creation Windows Hacking Techniques

V.

Penetration Testing NIST 800-115 The NSA Information Assessment Methodology PCI Penetration Testing Standard

VI.

The Dark Web

KEY TERMS Black hat hacker Someone who uses hacking skills for malicious and illegal purposes; also known as a cracker. .

2

Command injection An attack designed to inject and execute commands specified by the attacker in a vulnerable application.

Cross-site scripting When an attacker injects client-side scripts into web pages viewed by other users.

Cross-site request forgery Attacks the website based on the site’s user trust.

Dark Web An area of the Internet only accessible via onion routing.

Enumeration The process of finding out what is on the target system.

Gray hat hacker A hacker who usually obeys the law but sometimes crosses the line into black hat hacking.

Hacker Someone who tries to learn about a system by examining it in detail and reverse engineering.

Hacking The process of attempting to learn about a system by examining it and often exploiting flaws. This usually involves attempts to compromise the target system in some way.

Input validation Prevents an attacker from entering SQL commands rather than a username and password.

Onion routing Routes packets through a series of proxy servers to ensure anonymity. ophcrack A popular tool for cracking Windows passwords.

Penetration testing Assessing the security of a system by attempting to break into the system.

Phreaking Hacking into telephone systems.

Port A numerical designation for a connection point on a computer. There are well-defined ports for specific protocols, such as FTP port 21, HTTP port 80, and so on.

Port scanning The process of attempting to contact each network port on the target system to see which ones are open.

Script kiddy A slang term for an unskilled person who purports to be a skilled hacker.

SQL script injection A type of attack that allows malicious SQL statements to be executed.

Vulnerability assessment Checking a system to see if it is vulnerable to specific attacks.

White hat hacker A hacker who does not break the law; often synonymous with “ethical hacker”.

TEACHING NOTES I.

Basic Terminology Teaching Tip: Make certain students have mastered the basic terminology, particularly the variations on hacker.

.

3

II.

The Reconnaissance Phase Teaching Tip: It is recommended that you have a test machine set up for scanning. While scanning public sites is not illegal, it often is not well regarded by site administrators.

III.

Actual Attacks Teaching Tip: It is recommended that you have a test machine set up for practicing several types of attacks, including SQL injection, cross-site scripting, and ophcrack.

IV.

Malware Creation Teaching Tip: Review the process that hackers use to create malware, including some popular utilities.

V.

Penetration Testing Teaching Tip: Explain the standards that penetration testers use to guide a penetration test, such as NIST 800-115, NSA information assessment methodology, and the Payment Card Industry Data Security Standard (PCI DSS).

VI.

The Dark Web Teaching Tip: Explain how the Dark Web is only accessible via onion routing. Emphasize the danger of surfing the Dark Web and that it should only be done on a machine that is completely isolated from the host operating system.

DISCUSSION QUESTION AND WEB PROJECT I.

Discussion Question A. Discussion Question 1 Some people say that to be a truly great penetration tester, you need to have experience as a black hat hacker. Ask students to discuss whether they think this is true and why. When someone is a black hat hacker, they may have motivations that drive them to put in many hours at hacking. How can someone who wants to start out as a white hat hacker find similar motivation?

Answer: Students’ answers may vary. Try to gently guide students to the belief that you do not have to participate in illegal activities to become a good penetration tester.

II.

Web Project A. Web Project 1 Ask students to search online for more information about red team/blue team exercises for penetration testers and to locate a list of objectives and job roles for each team. If more than one source of this information is found, note how the sources differ.

.

4

Answer: Students’ answers may vary. This project invites students to learn more about the red team/blue team exercise scenario for penetration testers.

WEB RESOURCES •

https://www.offensive-security.com/information-security-certifications/ Offensive Security penetration testing certification

•

https://www.sans.org/cyber-security-courses/enterprise-penetration-testing/ SANS Institute penetration testing certification

•

www.eccouncil.org EC-Council’s Certified Ethical Hacker penetration testing certification

•

www.2600.com 2600, a magazine for white hat hackers

•

https://www.shodan.io Shodan, a search engine for vulnerabilities

•

http://www.hellboundhackers.org/ A site for practicing hacking techniques

•

http://www.hackthissite.org/ Another practice site for hacking techniques

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

Elizabeth is describing web-based attacks to a group of students in a computer security course.

What does an SQL injection attack require?

B 2.

Juan is using a rainbow table to circumvent passwords on a Windows computer. What is the best description of a rainbow table?

A

3.

You are responsible for security on an e-commerce system. You want to mitigate as many attacks as you can. How can you prevent cross-site scripting?

A

4.

What is an advantage of using Shodan.io?

B

5.

.

Perez is exploring different password cracking tools. A friend has told him about ophcrack. ophcrack depends on the attacker doing what?

5

A 6.

If you wish to view items that have been removed from a website, what is the best way to do so?

D

7.

Malek needs a port scanner so he can scan open ports on his own network. Which of the following is a popular port scanner?

D

8.

Jane wants to mitigate as many attacks as she can. A colleague suggested she block ICMP packets. Blocking incoming ICMP packets will prevent what type of scan?

B

9.

It is important that you understand cybersecurity terminology, including terms for different actors in cybersecurity. What is the correct term for a person who uses hacking techniques for illegal activities?

D

10.

What is the term for a person who hacks into phone systems?

C

11.

Penelope is teaching an introductory cybersecurity course and is trying to explain the terminology to students. What is the term for a person who uses tools to hack without understanding the underlying technology?

A

12.

What is the name for the process of trying to list all the servers on a network?

B

13.

Terrance is performing a scan. What response will a Windows machine give to a FIN scan?

D

14.

Jaron is trying to do a port scan of his own company. He wants to test to see if the company’s security systems will be able to detect his scan. Which of the following is considered the stealthiest port scan?

A

15.

What is the stealthiest way to find out what type of server a website is running?

C

.

6

Exercises EXERCISE 6.1: USING WWW.ARCHIVE.ORG This exercise gives students practice in using the www.archive.org site. Have them go to www.archive.org and pull up at least two previous versions of your college's/university's website. What information can they find that is no longer on the website?

EXERCISE 6.2: USING NMAP This exercise introduces students to the Nmap tool. Students should download and install Nmap. Then have them run at least three different scans on either their computer or on a designated lab computer.

NOTE: While it is not illegal to scan a computer, it may violate some security policies for some colleges and universities. Make certain you only scan a designated lab computer.

EXERCISE 6.3: USING OPHCRACK Have students download ophcrack to a CD. Then have them reboot their own machine to ophcrack and attempt to crack their local passwords.

NOTE: It is critical that you only use this on your machine or a designated lab machine. Using it on other machines would probably violate security policies at your college/university/company.

EXERCISE 6.4: USING NETCRAFT.COM Have students visit www.netcraft.com and search at least three different websites. Have them note what information they can gather about the website.

Projects

PROJECT 6.1: PASSIVE RECONNAISSANCE Have students select a local organization and conduct a passive reconnaissance. This should include searching job boards, the organization's website, user groups/bulletin boards, social networking sites, www.archive.org, and more. Students should gather as much information about the target network as they can.

PROJECT 6.2: PORT SCANNERS Instruct students to use their favorite search engine to locate at least two other port scanners. Have them download and install them, then try them on their machine or a designated lab computer. Students should compare and contrast these tools to Nmap. Are they easier to use? More informative?

Case Study Student answers will vary. Some ways to protect the system include blocking ports at the firewall and running an IDS. Some other protective methods include building security into application development, using physical security, and applying the principle of least privileges to permissions assignments.

.

7

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 7 INDUSTRIAL ESPIONAGE IN CYBERSPACE

CHAPTER 7 OBJECTIVES When students finish reading this chapter, they will be able to: •

Understand what is meant by industrial espionage

•

Explain the dangers of industrial espionage

•

Understand the low-technology methods used to attempt industrial espionage

•

Be aware of how spyware is used in espionage

•

Know how to protect a system from espionage

CHAPTER OVERVIEW Industrial espionage is a real and growing problem. Company economic goals are frequently dependent on accurate and often sensitive data. With billions of dollars at stake, private companies may engage in industrial espionage. It can be difficult to accurately assess just how great a problem it is. For obvious reasons, companies that perpetrate corporate espionage do not share that they do it, and companies that are victims of such espionage often do not want to reveal that fact. To protect themselves and their company, students must learn about espionage methods and safeguards. In the exercises at the end of this chapter, students run antispyware, key loggers, and screen capture software to become familiar with how they work.

The major sections in this chapter are: 1.

What Is Industrial Espionage? This section describes industrial espionage and why it is an IT security problem.

2.

Information as an Asset. This section describes how to determine the value of your data.

3.

Real-World Examples of Industrial Espionage. Five examples of real-world espionage are used.

4.

How Does Espionage Occur? High- and low-tech methods for the collection of corporate data are covered.

.

1

5.

Protecting Against Industrial Espionage. Describes several ways to protect your company from industrial espionage.

6.

Trade Secrets. Explains methods for protecting trade secrets.

7.

The Industrial Espionage Act. Describes The Industrial Espionage Act of 1996 was the first U.S. law to criminalize the theft of commercial trade secrets.

8.

Spear Phishing. Explains how spear phishing differs from phishing.

CHAPTER OUTLINE I.

What Is Industrial Espionage?

II.

Information as an Asset

III.

Real-World Examples of Industrial Espionage Example 1: Hacker Group Example 2: Company Versus Company Example 3: Nuclear Secrets Example 4: Uber Example 5: Foreign Governments and Economic Espionage Trends in Industrial Espionage Industrial Espionage and You

IV.

How Does Espionage Occur?

Low-Tech Industrial Espionage Spyware Used in Industrial Espionage Steganography Used in Industrial Espionage Phone Taps and Bugs Spy for Hire

V.

Protecting Against Industrial Espionage

VI.

Trade Secrets

VII.

The Industrial Espionage Act

.

2

VIII.

Spear Phishing

KEY TERMS Asset identification The process of listing the assets that you believe support your organization. This is a critical step to secure any system.

Encryption The act of encrypting a message. Encryption usually involves altering a message so it cannot be read without the key and the decryption algorithm.

Industrial espionage The use of spying techniques to find out key information that is of economic value.

Key logger Software that logs keystrokes on a computer.

Social engineering The use of persuasion on human users to gain information required to access a system.

Spear phishing Uses the same technology as phishing to obtain information but in a targeted manner.

Steganography A way of keeping messages secret; protects communications by obscuring them.

TEACHING NOTES I.

What Is Industrial Espionage?

Teaching Tip: Review the definition of industrial espionage and discuss the most common form of espionage—when an employee leaves a company and takes sensitive data with him.

II.

Information as an Asset Teaching Tip: Find out what students feel is the value of the information on their home PCs. Ask them how long it took to compile their data, how easily it might be replaced, and how other people might value it.

III.

Real-World Examples of Industrial Espionage Teaching Tip: Discuss the five real-world examples of industrial espionage presented in the text.

IV.

How Does Espionage Occur?

Teaching Tip: Most industrial espionage is done by low-tech social engineering. You can read the book by Kevin D. Mitnick titled The Art of Deception: Controlling the Human Element of Security.

The book provides many real-world examples of how to obtain information from employees.

V.

.

Protecting Against Industrial Espionage

3

Teaching Tip: Let students know that it is impossible to make corporate data completely safe.

Internal employees make up the majority of security leaks. No technology can compensate for an angry employee who has access to corporate data.

VI.

Trade Secrets Teaching Tip: Review the methods used to protect trade secrets, including using document passwords, marking documents as confidential, and securing data.

VII.

The Industrial Espionage Act Teaching Tip: Read through the Industrial Espionage Act of 1996, as quoted in the textbook, and discuss how the law provides significant penalties for violators.

VIII.

Spear Phishing Teaching Tip: Compare the terms phishing, spear phishing, and whaling, with examples of each.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 A nondisclosure agreement (NDA) helps protect corporate information from leaving the company. At what point does this NDA hinder an employee from getting a new job or using their skill and knowledge on their new job?

Answer: Students’ answers may vary. Students should articulate the issue from the point of view of the employer and the employee. The nature of the industry might also come into play.

B. Discussion Question 2 Does a nondisclosure agreement keep corporate information safe? Did it help in the five examples in the textbook?

Answer: Students’ answers may vary. This is a gray area, and from the examples given, it appears to be difficult to prosecute.

C. Discussion Question 3 Does corporate security that is built on a “need-to-know” basis stifle creativity, ingenuity, or productivity?

Answer: Students’ answers may vary. They may argue that any time information is withheld or limited, there are negative ramifications.

D. Discussion Question 4

.

4

How would a company policy specifying that an employee cannot take home any sensitive company data impact the company?

Answer: Students’ answers may vary, and answers may vary depending on the industry. In some organizations, it is expected that employees work at home.

II.

Web Projects A. Web Project 1 Search online for the current data capacity for USB drives. Where are they being used? Can they be concealed easily? What can prevent someone from walking up to a PC when an employee is taking a break and copying their data to a USB drive?

Answer: This project requires students to think in depth about the ease of copying data.

Students should find answers to the questions asked and formulate ways to prevent this problem.

B. Web Project 2 Search online for how to send an email with a “return address” similar to “IBM IT networking department.” Ask students to see whether they can send themselves an email that looks like it came from the IT department. They should include in the text, “We need your ID and password verified.”

Answer: This project can further students’ understanding of how easy it is to send officiallooking emails. You might have students give other examples of social engineering as espionage.

C. Web Project 3 Search online to find a story about employees being fired for blogging or posting sensitive company information on a newsgroup.

Answer: This project provides more in-depth research into the problem of employees as the number one issue in computer security.

WEB RESOURCES

.

•

https://www.veracrypt.fr VeraCrypt, a free tool for encrypting drives, folders, or partitions

•

https://diskcryptor.org DiskCryptor, an open-source drive encryption application

5

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

Terrance is trying to explain industrial espionage to a group of new security techs. What is the ultimate goal of espionage?

D 2.

In order to truly understand industrial espionage, you need to understand the mindset of the spy.

What is the best outcome for a spy attempting an espionage activity?

A

3.

What is the usual motivating factor for corporate/industrial espionage?

C

4.

Which of the following types of information would be a likely target for industrial espionage?

D

5.

Accurate statistics on corporate espionage are difficult to obtain. One reason is that the victims don’t always report the crime, as they often don’t want the incidents to become public. Which of the following is a likely reason that an organization might be reluctant to admit it has been a victim of corporate espionage?

C

6.

What is the difference between corporate and industrial espionage?

A

7.

Information is a valuable asset. It can be useful to calculate that value in order to determine how much effort should be put into protecting it. What formula can you use to calculate the value of information?

A

8.

If a company purchases a high-end UNIX server to use for its research and development department, what is probably the most valuable part of the system?

B

9.

Information is an asset to your company if it…

A

10.

What is the greatest security risk to any company?

A

.

6

11.

Which of the following is the best definition for spyware?

B

12.

What is the highest level of security you can expect to obtain?

A

13.

In the context of preventing industrial espionage, why might you wish to limit the number of company CD burners and control access to them in your organization?

A

14.

Why would you want to scan an employee’s computer when he leaves the organization?

B

15.

What is the reason for encrypting hard drives on laptop computers?

D

Exercises

EXERCISE 7.1: LEARNING ABOUT INDUSTRIAL ESPIONAGE In this exercise, students locate an espionage case not already mentioned in the chapter. Instructors may even opt to allow any form of espionage rather than industrial espionage. The preference would be cases involving technology in some way. Successful students find a case and report the facts of that case, especially a discussion of the case’s technical aspects and how the spying was conducted.

EXERCISE 7.2: USING ANTISPYWARE This exercise walks students through using antispyware. If the steps are followed, and the antispyware is successfully downloaded and installed, students have succeeded. Students should note if the software located any spyware on their computers.

EXERCISE 7.3: LEARNING ABOUT KEY LOGGERS In this exercise, students try out key loggers. If the steps are followed, and the key logger is successfully downloaded and installed, then students have succeeded. Students can run the antispyware from Exercise 7.2 and see if that software detects the key logger.

EXERCISE 7.4: SCREEN CAPTURE SPYWARE Screen capture software is practiced in this exercise. If the steps are followed and the screen capture spyware is successfully downloaded and installed, students have succeeded. Students can run antispyware and see if that software detects the screen capture software.

.

7

EXERCISE 7.5: LEARNING ABOUT HARDWARE-BASED KEY LOGGERS In this exercise, the student learns about hardware-based key loggers. Successful students find the requested information and convey that information in an essay. Perceptive students should grasp how this hardware could be used for both security purposes as well as espionage.

Projects

PROJECT 7.1: PREVENTING CORPORATE ESPIONAGE In looking at the advice about espionage deterrence, on the Web or from other resources, successful students concentrate on guidelines related to informational security/espionage. Further, check if students examined what steps are recommended to prevent espionage incidents.

PROJECT 7.2: HANDLING EMPLOYEES This project encourages students to make up their own rules about how to work with employees to safeguard the system. Successful students discuss items such as freezing passwords, blocking access, and scanning the computers of recently terminated employees. It is even prudent, in some cases, to keep that employee’s computer in isolation for some time, in case it is later needed in some investigation.

If it is possible for students to visit the IT and/or personnel department of a company, they should then create a list of guidelines used by that company. This list should then be compared and contrasted with the list they created.

PROJECT 7.3: ASSET IDENTIFICATION IN YOUR ORGANIZATION This project is about getting students to recognize what data is valuable and hence what data requires special protective measures. Items such as personnel records, financial records, credit card numbers, and research data are the obvious items. Perceptive students will also include sales data, statistical analysis, planning documents, and more.

Case Study This case study about espionage should get students to consider two things. The first is to consider steps that can be taken that make corporate espionage more difficult. The more difficult it is to execute such schemes, the more secure an organization’s data. Look for students to discuss how they would have investigated this case. The second thing students need to consider is how to identify potential espionage perpetrators before they commit any acts. Disgruntled, unhappy employees, such as David Doe in this case study, are the most frequent sources of data-compromising incidents. In this project, skilled students will discuss preventing this type of offense.

.

8

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 8 ENCRYPTION

CHAPTER 8 OBJECTIVES When students finish reading this chapter, they will be able to: •

Explain the basics of encryption

•

Discuss modern cryptography methods

•

Select appropriate cryptography for your organization

CHAPTER OVERVIEW In this chapter, students learn a basic element of computer security called encryption. This chapter provides basic information on how cryptography works. Encrypting data when transmitting is a must when it is sent over public networks, and it is an integral part of any security plan. Several types of encryption are covered.

The major sections in this chapter are: 1.

Cryptography Basics. Explanation of cryptography, with descriptions of encryption, decryption, symmetric cryptography, and asymmetric cryptography.

2.

History of Encryption. Some history, with examples of different encryption methods and examples for these methods, such as the Caesar cipher and Atbash.

3.

Modern Cryptography Methods. Covers the different types of modern cryptography. The concepts of a single key and public keys are explained, plus a discussion on finding a good encryption standard.

4.

Public Key (Asymmetric) Encryption. Details public key cryptography with coverage of encryption algorithms such as RSA and Diffie-Hellman.

5.

Hashing. Cryptographic hashes are discussed.

6.

Steganography. History and modern methods are covered.

7.

Cryptanalysis. Describes the types of cryptographic success and tools for breaking many ciphers.

.

1

CHAPTER OUTLINE I.

Cryptography Basics

II.

History of Encryption The Caesar Cipher Atbash Multi-Alphabet Substitution Rail Fence Scytale Polybius Cipher Enigma Binary Operations

III.

Modern Cryptography Methods Single Key (Symmetric) Encryption Modification of Symmetric Methods

IV.

Public Key (Asymmetric) Encryption

V.

PGP

VI.

Legitimate Versus Fraudulent Encryption Methods

VII.

Digital Signatures

VIII.

Hashing MD5 SHA RIPEMD

IX.

MAC and HMAC Rainbow Tables

X.

Steganography Historical Steganography

.

2

Steganography Methods and Tools XI.

Cryptanalysis Frequency Analysis Modern Cryptanalysis Methods

XII.

Cryptography Used on the Internet

XIII.

Quantum Computing Cryptography

KEY TERMS Binary numbers Numbers using the base 2; made of only 0s and 1s.

Block cipher A cipher that encrypts blocks of text at a time.

Blowfish A well-known symmetric key encryption algorithm that uses a variable-length key and was invented by Bruce Schneier.

Caesar cipher One of the oldest encryption algorithms. It uses a basic mono-alphabetic cipher.

Cipher Synonym for “cryptographic algorithm.”

Cipher text Encrypted text.

Cryptanalysis Involves searching for some means to break through encryption.

Cryptography The study of encryption and decryption.

Data Encryption Standard (DES) A block cipher developed in the 1970s. It uses a 56-bit key on 64-bit blocks. It is no longer considered secure enough.

Decryption To break encryption by reversing the scrambling protocol and making the message comprehensible.

Encryption The act of encrypting a message. Encryption usually involves altering a message so it cannot be read without the key and the decryption algorithm.

Hash A type of cryptographic algorithm that has some specific characteristics.

Internet Protocol Security (IPSec) A method used to secure VPNs. Mono-alphabet substitution A primitive encryption algorithm in which there is one single substitute character for all plain text characters.

Multi-alphabet substitution Encryption method that uses more than one substitution alphabet.

.

3

Point-to-Point Tunneling Protocol (PPTP) An extension to Point-to-Point Protocol (PPP) for VPNs. Pretty Good Privacy (PGP) A widely used public key encryption algorithm.

Public key encryption Encryption algorithm that uses two keys. One is publicly distributed and is used to encrypt messages. The other is kept private and is used to decrypt the messages.

Single-key encryption An encryption method in which the same key is used to both encrypt and decrypt a message. This is also referred to as symmetric key encryption.

Steganography The art and science of writing hidden messages in such a way that no one, apart from the sender and intended recipient, suspects the existence of the message.

Stream cipher A cipher that encrypts data as a stream of bits, one bit at a time.

Substitution alphabet The characters used to replace plain text in a substitution or multi-substitution encryption algorithm.

TEACHING NOTES I.

Cryptography Basics Teaching Tip: Let students know that they can still use cryptography even if they do not understand the math behind it. Tell students that it is like using a calculator to do square roots, even if most could not do one with paper and pencil. They should, however, understand the basic types of cryptography (for example, block versus stream, single versus public) and how to use them to keep their systems secure.

II.

History of Encryption Teaching Tip: The history of encryption is the history of secrets. Point out that many wars were won or lost by cracking coded messages. A great example of encryption is the enigma machine used in WWII. Teaching Tip: Compare the Caesar cipher to a secret decoder ring. You would line up the letters and twist the ring so far to decode and encode “secret” messages.

Teaching Tip: Demonstrate that text in a computer is stored as 8-bit binary numbers. With the ASCII chart, you can show that sorting from a through z puts the characters into numerical order.

Demonstrate or have students convert a few ASCII words from text to numbers.

Teaching Tip: A simple way to demonstrate XOR is the following: Where there is a “1,” toggle the number (that is, if there is a 1 in the XOR, then a 1 becomes a 0 and a 0 becomes a 1). Otherwise, leave the binary digit alone. This shows students that if you XOR twice, you flip back to the original binary number.

III.

.

Modern Cryptography Methods

4

Teaching Tip: Single-key encryption is easy and fast for a computer. However, stress that it is hard to deliver the one key to the people that need it. This continued to be a problem with cryptography, even through WWII. Keys would get intercepted, and messages would get decrypted.

IV.

Public Key (Asymmetric) Encryption Teaching Tip: Public key encryption is based on “hard to reverse” mathematical formulas, such as factoring products of large prime numbers. Ask students to factor 1147, and then ask them to multiply 31 times 37.

Teaching Tip: Public key programs need a great deal of processing, and therefore there are better ways to send messages. The best way to send messages is to use public key encryption to pass (secretly) the single-key encryption keys used to encrypt messages. Note that if you hand out the encryption key, you can have anyone send you an encrypted message that only you can decode. If you hand out a decryption key, then anyone can decode a “signature” that only you (the holder of the encryption key) could have encrypted. This is the basis for electronic signatures.

V.

Hashing Teaching Tip: Explain that storing Windows passwords is just one application of hashing. Review the common hashing algorithms, MD5 and Secure Hash Algorithm (SHA).

VI.

Steganography Teaching Tip: Steganography is the art and science of writing hidden messages in such a way that no one, apart from the sender and intended recipient, suspects the existence of the message. Explain some tools available for implementing steganography, such as QuickStego and Invisible Secrets.

VII.

Cryptanalysis Teaching Tip: Cryptanalysis is the process of breaking encryption. Discuss how it is much more difficult than guessing a password because the strings are typically longer, and there's usually no pattern to them like there is with passwords. Review the differences between the known plain text attack, the chosen plain text attack, cipher text only, and a related-key attack.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 Should governments restrict the use of “strong encryption?”

Answer: Students’ answers may vary. Students who support government encryption will likely argue the problem strong encryption can cause for law enforcement investigations.

Those who oppose government restriction might argue that the need for privacy and the security of personal information outweigh the problems strong encryption causes for law enforcement investigations.

.

5

B. Discussion Question 2 Should network administrators have decryption keys for files on your company computer?

Answer: Students’ answers may vary. Students should consider what would happen if an employee is suddenly gone and has left behind important encrypted files but no key to access them.

II.

Web Projects A. Web Project 1 It is easy to use encryption to hide messages inside of other objects. Steganography is the art of hidden writing. You can get Hide In Picture (HIP) at https://hide-in-picture.soft112.com/.

You can then encrypt a message or even a program that can be extracted by using an encryption key. Download HIP, hide a text message in a picture, and send the picture and key to someone to see whether they can extract the secret message. How could you detect hidden messages in web page images?

Answer: This project should reinforce the idea that most encrypted information requires a key to decode hidden information.

B. Web Project 2 ROT13 is an interesting encryption algorithm in that it has no key. It uses a form of the Caesar cipher to encrypt text. Try encoding a message by entering text in the box at http://www.rot13.com/. Exchange your encrypted message with someone else in the class.

Then enter their coded message you’ve received into the text box. The message will be revealed. If you apply ROT13 to the text message, it comes out encrypted. But if you reapply the same ROT13 a second time to the encrypted message, it comes out decrypted. Now, why would anyone use an encryption method that is so trivial to crack?

Answer: Students’ answers may vary. This method may be used to encrypt information that is not critical. For instance, someone posting to a newsgroup or blog might encrypt the end of a movie they are discussing. Readers who want to find out what happened can easily decrypt the text, but those who do not want to find out the ending are protected from a spoiler.

C. Web Project 3 Download and install the free Cryptainer software from http://www.cypherix.co.uk/. This software sets up an encrypted “virtual drive” on your computer using 128-bit Blowfish encryption. Take a text file and put it into the encrypted “drive.” Click Unload. Then try to access the encrypted disk file using Notepad. Do you see any of the text here? Can anyone read a file in this virtual drive if your laptop were stolen?

Answer: No one could access the file on a stolen laptop because the drive is password protected.

.

6

WEB RESOURCES •

https://access.redhat.com/blogs/766093/posts/1976023 Features a brief history of cryptography from Red Hat, a commercial Linux version

•

https://www.sans.org/white-papers/730/ A history of encryption from the SANS Institute

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

It is important to understand the concepts and application of cryptography. Which of the following most accurately defines encryption?

A 2.

Which of the following is the oldest encryption method discussed in this text?

C

3.

Many classic ciphers are easy to understand, but not secure. What is the main problem with simple substitution?

D

4.

Classic ciphers were improved with the addition of multiple shifts (multiple substitution alphabets).

Which of the following is an encryption method that uses two or more different shifts?

B

5.

Which binary mathematical operation can be used for a simple (but unsecured) encryption method and is in fact a part of modern symmetric ciphers?

C

6.

Why is binary mathematical encryption not secure?

A

7.

Which of the following is most true regarding binary operations and encryption?

B

8.

What is PGP? A

9.

.

Which of the following methods is available as an add-in for most email clients?

7

D 10.

Which of the following is a symmetric key system using 64-bit blocks?

B

11.

What is the advantage of a symmetric key system using 64-bit blocks?

A

12.

What size key does a DES system use?

C

13.

What type of encryption uses different keys to encrypt and decrypt the message?

B

14.

Which of the following methods uses a variable-length symmetric key?

A

15.

What should you be most careful of when looking for an encryption method to use?

D

16.

Which of the following is most likely to be true of an encryption method advertised as unbreakable?

C

17.

Which of the following is most true regarding certified encryption methods?

D

18.

Which of the following is most true regarding new encryption methods?

A

Exercises

EXERCISE 8.1: USING THE CAESAR CIPHER This exercise is simply procedural. Students should discover that the Caesar cipher is easy to break.

EXERCISE 8.2: USING MULTI-ALPHABET CIPHERS This exercise is simply procedural. Students should discover that multi-alphabet ciphers are harder than Caesar ciphers to break.

.

8

EXERCISE 8.3: USING PGP This exercise is simply procedural. Students should have little problem finding, downloading, and installing a PGP module. The Internet is replete with PGP add-ins for many software packages.

EXERCISE 8.4: FINDING GOOD ENCRYPTION SOLUTIONS This exercise is about teaching students to recognize signs of unwarranted claims made by an encryption vendor. The Internet is replete with claims about encryption methods, often significantly exaggerated. The key in this exercise is for students to identify specific factors that make them suspicious about the encryption advertised.

Projects

PROJECT 8.1: RSA ENCRYPTION This project is designed to teach students to use the Web as a resource to find out more details about RSA encryption. Students should easily find a wealth of information about this encryption method.

PROJECT 8.2: PROGRAMMING CAESAR CIPHER This project, for students with some programming background, is meant to show students the basic concepts involved in programming an encryption algorithm. It should be stressed to students that the Caesar cipher is not at all secure. (Exercise 1 should have taught them that but it makes a good teaching tool.)

PROJECT 8.3: OTHER ENCRYPTION METHODS Students should identify the essentials of how the algorithm they choose works, when it was invented, by whom, and why it was invented. They do not necessarily need to know all the detailed mathematics behind the encryption.

Case Study This case study is designed to allow students to practice selecting appropriate encryption methods. The point is not so much what choice students make but how they make that choice. Particular attention should be paid to their rationale for a given choice.

.

9

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 9 COMPUTER SECURITY TECHNOLOGY

CHAPTER 9 OBJECTIVES When students finish reading this chapter, they will be able to: •

Evaluate the effectiveness of a scanner based on how it works

•

Choose the best type of firewall for a given organization

•

Understand antispyware methods

•

Employ intrusion detection systems to detect problems on a system

•

Understand honey pots

CHAPTER OVERVIEW If you try to secure your network, you need more details on the different types of security devices and software you might choose. To secure any system, you must have antivirus and antispyware scanners, firewalls, and an intrusion detection system (IDS). This chapter reviews these items with enough detail to allow you to make informed decisions to choose the best products for your organization.

The major sections in this chapter are: 1.

Virus Scanners. This section describes different types of virus scanners and how they work. Examples include commercial and free scanners.

2.

Firewalls. This section describes different types of firewalls, where they go, and how they work. Examples include commercial, built-in, and free firewalls.

3.

Antispyware. This section briefly describes antispyware scanners and why you need them.

4.

IDSs. Describes different types of intrusion detection systems (IDSs), including their functionality and use.

Examples include commercial and free IDSs. This segment also covers intrusion policies used for detection and preemptive action.

5.

Digital Certificates. Describes the types of digital certificates and the basic items in an X.509 certificate.

.

1

6.

SSL/TLS. This section covers the asymmetric systems SSL (Secure Sockets Layer) and TLS (Transport Layer Security), including the steps involved in establishing an SSL/TLS connection.

7.

Virtual Private Networks. This section describes virtual private networks used to secure remote connections: PPTP, L2TP, and IPsec.

8.

Wi-Fi Security. Covers the types of protocols used to secure wireless networks.

CHAPTER OUTLINE I.

Virus Scanners How Does a Virus Scanner Work?

Virus-Scanning Techniques Commercial Antivirus Software

II.

Firewalls Benefits and Limitations of Firewalls Firewall Types and Components Firewall Configurations Types of Firewalls Commercial and Free Firewall Products Firewall Logs

III.

Antispyware

IV.

IDSs IDS Categorization Identifying an Intrusion IDS Elements Snort Honey Pots Database Activity Monitoring SIEM

.

2

Other Preemptive Techniques Authentication V.

Digital Certificates

VI.

SSL/TLS

VII.

Virtual Private Networks Point-to-Point Tunneling Protocol Layer 2 Tunneling Protocol IPsec

VIII.

Wi-Fi Security Wired Equivalent Privacy Wi-Fi Protected Access WPA2 WPA3

KEY TERMS Active IDS An IDS that takes the added step of shutting down the suspect communication.

Antispyware Scans a computer to see whether spyware is running on the machine and removes the spyware or prompts the user to remove it.

Application gateway A program that runs on a firewall and authenticates entire client applications (also known as “application proxy” or “application-level proxy”).

Bastion host A gateway between an inside network and an outside network. Used as a security measure, it is designed to defend against attacks aimed at the inside network.

Breach To successfully break into a system; to get past security.

Digital certificate A method of distributing a public key and providing a means for authenticating the certificate holder.

Dual-homed host A firewall running on a server with at least two network interfaces.

Firewall A device or software that provides a barrier between your machine or network and the rest of the world.

.

3

Honey pot A system or server designed to be very appealing to hackers that is a trap to catch them.

Internet Protocol Security (IPsec) A method used to secure VPNs. Intrusion Detection System (IDS) A system for detecting attempted intrusions.

Kerberos A type of authentication used particularly with Microsoft operating systems.

Layer 2 Tunneling Protocol (L2TP) A protocol designed to enhance PPTP and used with VPNs. Network host-based firewall A software solution installed on an existing machine with an existing operating system.

On-demand virus scanners Runs only when you launch the program.

Ongoing virus scanner Runs in the background and is constantly checking a PC for any sign of a virus.

Passive IDS An IDS that monitors suspicious activity and logs it.

Point-to-Point Tunneling Protocol (PPTP) A secure extension to PPP (Point-to-Point Protocol) for VPNs. Proxy server A device that hides internal IP addresses and presents a single IP address to the outside world.

Screened host A firewall, usually on the perimeter of a network that combines a packet-filtering router with an application gateway located on the protected subnet side of the router.

Spyware Software that monitors computer use.

SSL/TSL Secure Sockets Layer/Transport Layer Security; technologies that encrypt traffic between a browser and the web server.

Stateful packet inspection (SPI) A type of firewall that not only examines packets but knows the context within which the packet was sent.

Terminate and stay resident (TSR) A program that stays loaded in memory after it executes.

Virtual private network (VPN) A way to use the Internet to create a secure virtual connection between a remote user or site and a central location.

Virus scanner Software that tries to prevent a virus from infecting a system.

TEACHING NOTES I.

Virus Scanners Teaching Tip: No computer connected to a LAN or the Internet should be without a virus scanner and a good antispyware system. Ask students what programs they use and how they like them.

.

4

Teaching Tip: List the different types of antivirus software on a “Pros-Cons” chart, such as “Signature-based: Pro—few false positives, Con—will not catch brand new viruses.”

II.

Firewalls Teaching Tip: It will be helpful to draw an example network with PCs, servers, routers, cables, and so on, and then demonstrate where different types of firewalls, proxies, and IDS systems go.

Then you can easily show the strengths and weaknesses of the various types of systems and how to place them.

III.

Antispyware Teaching Tip: Most antispyware works by checking the system for known spyware files. Ask students if they subscribe to an antispyware program and which programs they use. In some cases, antivirus solutions now also check for spyware.

IV.

IDSs Teaching Tip: Review the IDS categorizations (active versus passive) and ask students to explain how they would identify an intrusion and what they would do about it.

V.

Digital Certificates Teaching Tip: Explain that the digital certificate contains the user’s public key for encrypting messages. Demonstrate to students how they can create their digital certificate.

VI.

SSL/TLS Teaching Tip: Review the basic process of establishing an SSL/TLS connection. Discuss the steps in Figure 9.10 and ask students to explain how this process might be used on bank websites.

VII.

Virtual Private Networks Teaching Tip: Compare the PPTP, L2TP, and IPsec protocols used to create VPNs. Ask students if they have used a VPN connection and, if so, what purpose it served.

VIII.

Wi-Fi Security Teaching Tip: Nearly all wireless access points and routers use WPA2 nowadays. Show students how to check to see which protocol a router uses and suggest that they check their home routers.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 Is it better to have your ISP filter your email, buy email virus scanner software for your PC, or just manually delete spam and email that contains bad attachments?

.

5

Answer: Students’ answers may vary. Many will come up with the response that a combination of all three is best.

B. Discussion Question 2 How often should IDS, antivirus, or antispyware signature files be updated?

Answer: Students’ answers may vary. Subscribing to a service that provides routine updates works for most users.

II.

Web Projects A. Web Project 1 Search online for articles on honey pots. Find out the legal and ethical issues involved with evidence collected by using a honey pot system. Is it an intrusion if you set one up to be broken into? Is this a form of entrapment? Do honey pots encourage break-ins?

Answer: This project will further students’ understanding of honey pots. They should find enough information to formulate an opinion on the topic.

B. Web Project 2 Many IT people say Windows and Microsoft Edge are more susceptible to viruses and spyware than Linux and Firefox. Search online for articles on Windows versus Linux security. Which operating system and browser is safe?

Answer: This project can further students’ knowledge of security issues. After doing some research, students should formulate an opinion on the topic.

C. Web Project 3 Anomaly detection involves actual software that works to detect intrusion attempts and notify the administrator. Any activity that does not match the pattern of normal user access is noted.

Search online for information on anomaly detection and then answer the question: How does the IDS define “normal” use?

Answer: This project provides more in-depth research into anomaly detection.

WEB RESOURCES •

Free firewall software resources: http://www.firewallguide.com/freeware.htm https://www.antivirussoftwareguide.com/best-free-firewall-protection-software https://www.zonealarm.com/software/free-firewall

•

http://www.snort.org/ IDS site; Snort can be downloaded for free

.

6

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

Which of the following is the most common way for a virus scanner to recognize a virus?

A 2.

What is one way of checking emails for virus infections?

C

3.

What are TSR programs?

D

4.

What is the name for scanning that depends on complex rules to define what is and is not a virus?

B

5.

Which of the following is not one of the basic types of firewalls?

C

6.

Which of the following is the most basic type of firewall?

A

7.

George is responsible for security on a midsized network. He has more than two dozen systems that generate logs. What technology would be most helpful for him in analyzing these logs?

A

8.

What does SPI stand for?

A

9.

What is the term for a firewall that is software installed on an existing server?

D

10.

What is a major weakness with a network host-based firewall?

A

11.

What is the term for blocking an IP address that has been the source of suspicious activity?

A

12.

.

What is the term for a fake system designed to lure intruders?

7

A 13.

Which of the following is the correct term for simply making a system less attractive to intruders?

A

14.

What method do most IDS software implementations use?

A

15.

How do most antispyware packages work?

B

Exercises

EXERCISE 9.1: SETTING UP A FIREWALL This is a procedural exercise, and completion success is defined by simply following the instructions and filtering incoming packets.

EXERCISE 9.2: ROUTER-BASED FIREWALLS This is a procedural exercise, and completion success is defined by simply following the instructions and setting up the router firewall.

EXERCISE 9.3: EVALUATING FIREWALLS This exercise asks students to evaluate differing firewall solutions. The key is not what the students answer but how they support their answers. Even experts can disagree about what solution is best for a given situation. Give students the opportunity to practice evaluating different possibilities in an informed and logical manner, as well as verbalizing and explaining their stance and findings.

EXERCISE 9.4: ACTIVE CODE The successful paper will explain that active code can do anything on a client machine that any program might do, including changing settings, deleting files, and so on.

EXERCISE 9.5: HARDWARE USED BY A COMPANY The purpose of this exercise is for students to gain an understanding of how the software and hardware discussed in this chapter (as well as throughout the book) are used by companies in the real world. Their essay should reflect what they have learned.

Projects

PROJECT 9.1: HOW DOES THE MICROSOFT FIREWALL WORK? This project is designed to teach students how the Microsoft Windows firewall works. This means successful students will have details about what type of firewall this is and how it filters ports. .

8

PROJECT 9.2: HOW DOES ANTIVIRUS SOFTWARE WORK? In this project, students use vendor documentation to find out exactly what methods both Norton and McAfee use. Students are then asked to apply that knowledge and select the appropriate virus scanner for a given situation.

PROJECT 9.3: USING SNORT Snort is not the only IDS available, but it is free and is widely recommended by many experts. Therefore, students must learn about it. Entire books have been written about Snort, but the basic installation and configuration instructions can be found on its website.

Case Study This case study asks students to apply the knowledge they have gained. They are asked to evaluate the appropriateness of Jane Smith’s security selections. In this case study, the firewall Jane has selected is probably fine. Additional recommendations students might make could include: •

Turn on packet filtering on each machine.

•

Install antispyware.

•

Establish policies regarding downloads and email attachments.

•

Set security on all browsers.

•

Use an IDS.

.

9

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 10 SECURITY POLICIES

CHAPTER 10 OBJECTIVES When students finish reading this chapter, they will be able to: •

Recognize the importance of security policies

•

Understand the various policies and the rationale for them

•

Know what elements go into good policies

•

Create policies for network administration

•

Evaluate and improve existing policies

CHAPTER OVERVIEW This chapter covers the essentials of security policies and disaster recovery.

The major sections in this chapter are: 1.

Important Standards. This section reviews industry standards for creating security policies, including ISO 17799, a standard for developing policies.

2.

Defining User Policies. This section explains the areas that effective user policies must cover.

3.

Defining System Administration Policies. This section covers the types of policies that must be defined for system administrators and their work.

4.

Security Breaches. This section reviews the main types of security breaches and what actions you should take for each.

5.

Standards, Guidelines, and Procedures. This section explains how to classify data as public or private, and what the subcategories might look like within the private category.

6.

Disaster Recovery. This section explains the importance and components of a disaster recovery plan and standards.

.

1

7.

Important Laws. This section discusses major laws and regulations affecting data security.

CHAPTER OUTLINE I.

What Is a Policy?

II.

Important Standards ISO 17999 NIST SP 800-53 ISO 27001 ISO 27002 ISO 17799

III.

Defining User Policies Passwords Internet Use Email Usage Installing/Uninstalling Software Instant Messaging Desktop Configuration Bring Your Own Device Final Thoughts on User Policies

IV.

Defining System Administration Policies New Employees Departing Employees Change Requests

V.

Security Breaches Virus Infection DoS Attacks

.

2

Intrusion by a Hacker VI.

Defining Access Control

VII.

Development Policies

VIII.

Standards, Guidelines, and Procedures Data Classification DoD Clearances

IX.

Disaster Recovery Disaster Recovery Plan Business Continuity Plan Impact Analysis Disaster Recovery and Business Continuity Standards Fault Tolerance

X.

Zero Trust

XI.

Important Laws HIPAA Sarbanes-Oxley Payment Card Industry Data Security Standards

KEY TERMS Business continuity plan (BCP) A plan designed to get minimal business functions back up and running at least at some level so you can conduct business.

Disaster Any event that significantly disrupts an organization’s operations.

Disaster recovery plan (DRP) A plan in place to return the business to normal operations after a disaster occurs.

Guideline A general suggestion about how to achieve certain standards.

Procedures Specific instructions on how to handle specific issues.

Security policy A document that defines how an organization will deal with some aspect of security. .

3

Standard A general statement of the desired level of operation.

TEACHING NOTES I.

Important Standards Teaching Tip: Provide students with a copy of ISO 17799 and review the areas of security management. Have each student pick one of the areas and select one recommendation within the document to share with the class.

II.

Defining User Policies Teaching Tip: Have students choose one of the user policy areas from the following list: passwords, Internet use, email usage, installing/uninstalling software, instant messaging, desktop configuration, and bring your own device (BYOD). Then have each student propose a rule or policy in that area and explain why it would be helpful for an organization to have that policy.

III.

Defining System Administration Policies Teaching Tip: Ask students to name some risks or threats to consider when developing policies for processing new and departing employees in the IT systems.

IV.

Security Breaches Teaching Tip: Ask students to list the steps they would take after an intrusion by a malicious hacker has been discovered. Some answers may include scanning, copying logs, documentation, password changes, and informing management.

V.

Standards, Guidelines, and Procedures Teaching Tip: Have students list the DoD clearance levels in the order of their hierarchy of classification, from lowest to highest. Ask them which level(s) require a polygraph test.

VI.

Disaster Recovery Teaching Tip: Ask students to define the term “disaster” and provide examples. Have them list and describe the three primary backup types—full, differential, and incremental.

VII.

Important Laws Teaching Tip: Review the critical computer laws mentioned in the text—HIPAA, Sarbanes-Oxley, and Payment Card Industry Data Security Standards (PCI DSS). Ask students what the letters in HIPAA stand for.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

.

Discussion Questions 4

A. Discussion Question 1 What rules would be useful to put into a business's policy on personal Internet use when on company-owned computers?

Answer: Students’ answers may vary. The answers should balance security, productivity, and employee satisfaction.

B. Discussion Question 2 Why is it important to have administrative policies that apply to the work of IT professionals?

Answer: Students’ answers may vary. One answer might be that IT professionals have a lot of responsibility and can dramatically impact the health and security of a system, so there should be standardized processes they follow to ensure that individual technicians do not make subjective judgment calls based on their personal preference.

II.

Web Projects A. Web Project 1 Search online for some sample software development policies that ensure secure programming. What do the policies have in common, and how do they differ?

Answer: This project will further students’ understanding of developmental policies by distinguishing standard practice versus preferences of a specific organization.

B. Web Project 2 Suppose you needed a Secret security clearance for a job you have just accepted. How would you go about this? Find several web resources that explain the process.

Answer: Student answers should include URLs for at least two different websites that describe this process.

WEB RESOURCES

.

•

https://www.secretservice.gov/ United States Secret Service

•

https://www.fbi.gov/ Federal Bureau of Investigation

•

http://www.fbi.gov/news/stories/2009/august/rcfls_081809 FBI Computer Forensics Labs

5

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

Which of the following does not demonstrate the need for policies?

C 2.

Grace is a network administrator who is trying to implement a Zero Trust architecture. Which of the following standards would be most helpful for Grace?

C

3.

Which of the following is not an example of a user password policy?

C

4.

What should an employee do if she believes her password has been revealed to another party?

B

5.

What standard is the most appropriate when considering security controls?

A

6.

Which of the following is the best reason users should be prohibited from installing software?

B

7.

Which of the following is not a significant security risk posed by instant messaging?

A

8.

What must all user policies have in order to be effective?

B

9.

Which of the following is the appropriate sequence of events for a new employee?

A

10.

Which of the following is the appropriate sequence of events for a departing employee?

B

11.

Which of the following is the appropriate sequence for a change request?

B

12.

.

What is the first step when discovering a machine(s) has been infected with a virus?

6

D 13.

What is the rule in access control?

B

14.

After dealing, on a technical level, with any security breach, what is the last thing to be done for any security breach?

C

15.

Which of the following is a list of items that should be implemented in all secure code?

B

Exercises

Each exercise is intended to give students experience writing limited portions of a policy.

Combined, the exercises create a complete policy for a college campus computer network.

EXERCISE 10.1: USER POLICIES This exercise gives students practice not only in writing policies but in using critical thinking to develop policies. If time permits, have students trade documents and critique each other's work.

Ask students to play the role of an organization employee who is trying to find a loophole or unclear area of the policy to circumvent it. What wording is unclear that allows an inroad?

EXERCISE 10.2: NEW STUDENT POLICY Students should think about the balance between usability and convenience, along with security.

The principle of least privileges dictates that only minimal permissions should be granted based on the student's needs. What resources should a student have access to, and what resources should they not be able to access?

EXERCISE 10.3: LEAVING STUDENT POLICY When writing this policy, students should consider the psychology of someone leaving campus prematurely.

What is likely to be their state of mind? Will they be more likely to be angry and want to attempt harm to the school and its systems? With that in mind, what preventive measures can be taken?

EXERCISE 10.4: NEW FACULTY/STAFF POLICY The policy that students write should be flexible enough to accommodate a variety of faculty and staff positions and their differing needs for IT access. For example, rather than stating specifically that there should be access to certain systems, the policy might generalize about which systems are appropriate for access or might have a table of possibilities to choose from depending on the department or job title.

EXERCISE 10.5: LEAVING FACULTY/STAFF POLICY This policy might include a timetable for shutting down access. Should the employee continue to have limited access to certain resources after departure? This may depend on the reason for the faculty/staff .

7

leaving. For example, a retiring professor might be allowed continued access to their email account for one month after departure, to tie up any loose ends, but this might not be appropriate for someone whose employment has been involuntarily terminated.

EXERCISE 10.6: STUDENT LAB USE POLICY Students should think about all the possible activities that someone might use a computer for, and then explicitly allow or deny each activity.

Projects

PROJECT 10.1: EXAMINING POLICIES Note that the EarthLink link in the textbook points to an Acceptable Use Policy that is no longer on their website in that form. Instead, AUP information is rolled into policies for each specific type of service (DSL, dial-up, etc.). Students should pick one of these service agreements, such as the High-Speed Service Agreement, and look at the AUP portions of that agreement.

The SANS Institute resource provides policy templates. Students can examine one of these templates and compare it to the EarthLink policy's structure. Look under the General heading at the Acceptable Use Policy.

The Information Security Policy World link is not currently active, so advise students to leave this resource out of the project.

PROJECT 10.2: REAL-WORLD SECURITY POLICIES Answers will vary depending on the policies that the student studies. Some schools have extremely tight security policies, whereas others may have significant leeway. Point out to students that the tightest security policies are not always the best; usability must also be considered.

PROJECT 10.3: CREATING SECURITY POLICIES Because of the broad scope of this project, it should be implemented either as a group project or assigned as a final capstone project option, or as an honors extra-credit project. You can also narrow its scope to cover only a certain section or area when assigning it.

Case Study Student answers will vary, and may include some of the following:

.

•

Employees’ personal devices used on company networks are scanned for company-owned content.

•

Any administrator passwords for shared resources to which the employee had access are changed, such as network hardware.

•

The employee's name is removed from any entry control rosters maintained by security staff at the facility entrances.

8

•

.

The employee's smart card or RFID-enabled badge credentials are revoked for any entry control systems.

9

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 11 NETWORK SCANNING AND VULNERABILITY SCANNING

CHAPTER 11 OBJECTIVES When students finish reading this chapter, they will be able to: •

Understand how to verify the security of a system

•

Probe a system for vulnerabilities

•

Use vulnerability scanning tools

•

Evaluate potential security consultants

CHAPTER OVERVIEW Companies must assess and patch their own organization’s vulnerabilities in order to avoid compromising the security of their systems. This chapter looks at some commonly used tools for compromising security and for a security-conscious network administrator to find and patch vulnerabilities. Students examine a variety of port scanners as well as vulnerability scanners. It is critical that you know how to use them.

The major sections in this chapter are: 1.

Basics of Assessing a System. This section explains the six stages of assessing a system's security: Patch, Ports, Protect, Policies, Probe, and Physical.

2.

Securing Computer Systems. This section examines various security specifics for an individual workstation, a server, and a network.

3.

Scanning Your Network. This section shows tools you can use to check for vulnerabilities and flaws.

4.

Testing and Scanning Standards. This section covers the most prominent standards for vulnerability scans and penetration tests.

5.

Getting Professional Help. Includes guidelines for locating and evaluating an outside professional to help set up and test a system’s security.

.

1

CHAPTER OUTLINE I.

Basics of Assessing a System Patch Ports Protect Policies Probe Physical

II.

Securing Computer Systems Securing an Individual Workstation Securing a Server Securing a Network

III.

Scanning Your Network NESSUS OWASP Zap Shodan Kali Linux Vega OpenVAS

IV.

Testing and Scanning Standards NIST 800-115 NSA-IAM PCI-DSS National Vulnerability Database

V.

.

Getting Professional Help

2

KEY TERMS Disaster recovery plan A plan for recovering data in case of a disaster.

Hardening Securing a computer system against hackers, malware, and other intruders.

Password age The length of time a password has been in effect without having been changed.

Password history A list of previously used passwords.

Port A numerical designation for a connection point on a computer. There are well-defined ports for specific protocols, such as FTP port 21 and HTTP port 80.

TEACHING NOTES I.

Basics of Assessing a System Teaching Tip: Ask students to name the "six Ps" of assessing a system and write them on the board. Then fill in the details for each one of them by asking students what role each one plays in the system assessment.

Teaching Tip: Discuss why automatic patching is not appropriate on some networks. Ask students to describe scenarios where automatic patching might cause problems.

Teaching Tip: Demonstrate how to shut down a Windows service configure the Windows firewall and other firewall software.

II.

Securing Computer Systems Teaching Tip: Discuss the differences between securing a workstation and a server. As you talk about each technique for securing a computer, indicate whether it applies to workstations, servers, or both. Then include securing a network in the mix and discuss techniques that apply specifically to networks.

III.

Scanning Your Network Teaching Tip: Review and demonstrate the various network scanning tools mentioned in the chapter, such as Nessus, OWASP Zap, Shodan, and Kali Linux.

IV.

Testing and Scanning Standards Teaching Tip: Review the standards for vulnerability scans and penetration tests. Ask students what information they can find on the National Vulnerability Database website.

V.

Getting Professional Help Teaching Tip: Ask students how they would go about finding a qualified professional to set up and test a system’s security.

.

3

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 How would securing a home or small business workstation differ from securing a workstation on a domain-based LAN? Answer: Students’ answers may vary. Discussion should include how networks handle user credentials vs. domains, and automatic patching vs. managed patching.

B. Discussion Question 2 Should network scanning tools such as Nessus and Shodan be available over the Internet for free?

Answer: Students’ answers may vary. They might discuss that it would be counterproductive to discontinue providing network administrator tools on the Internet just because they can be misused by hackers.

II.

Web Projects A. Web Project 1 Some Linux distributions are built specifically for penetration testing/hacking and include many tools that can perform vulnerability scans and even launch attacks. Which distributions fit this description and where would you acquire them?

Answer: This project will further students’ understanding of Linux distributions that include hackerfriendly tools. A common distribution for hacking is Kali Linux.

B. Web Project 2 Search online for “Chuck Easttom.” Then go to his website http://www.chuckeasttom.com. What information can you find out about the author?

Answer: This project will further students’ understanding of what information can be gathered about individuals using web searches and websites. Many students may have their own sites or are a part of some website, and they should formulate an opinion on the topic.

WEB RESOURCES

.

•

http://news.netcraft.com Netcraft; provides information about web servers

•

http://www.visualware.com/ Visualware; performs a visual traceroute on a website

•

http://www.internic.net/ InterNIC; provides IP registration information

•

http://www.iana.org/assignments/port-numbers IANA; lists port numbers 4

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

Which of the following is not one of the phases listed in NIST 800-115?

C 2.

John is now responsible for system security at a small bookkeeping firm. He wants to ensure that he implements good fundamental security. What is the most basic rule of computer security?

A

3.

You work in the network security department of a large bank. One of your jobs is to keep all systems patched. How might you ensure that system patches are kept up to date?

A

4.

Teresa is explaining basic security to a new technician. She is teaching him how to secure ports on any server or workstation. What is the rule about ports?

C

5.

Miguel is trying to secure a web server. He has decided to shut down any services that are not needed. His supervisor has told him to check dependencies first. Which of the following is a good reason to check dependencies before shutting down a service?

B

6.

If your machine is not used as a server and is not on a local network, what packet-filtering strategy should you use?

A

7.

You are trying to implement good fundamental security for a small company. Which of the following is the least essential device for protecting your network?

D

8.

Mohammed is responsible for security policies at a university. He is trying to ensure proper access policies.

What is the rule of thumb on data access?

C

9.

What are the main phases of the NSA-IAM process?

D

10.

What is the minimum frequency for system probing and audits?

B

.

5

11.

An audit should check what areas?

C

12.

Jerod is setting up security for a server room for a university. Which of the following is true of the room in which the server is located?

D

13.

Elizabeth is responsible for security policies at her organization. She is trying to implement sound end-user security policies. What would be most important to block end users from doing on their own machine?

D

14.

What is the preferred method for storing backups?

B

15.

Which of the following is a step you would definitely take with any server but might not be required for a workstation?

A

16.

Which of the following is a step you might take for large networks but not for smaller networks?

B

17.

Which of the following is a common way to establish security between a web server and a network?

C

18.

What is the rule on downloading from the Internet?

C

19.

Which of the following certifications is the most prestigious?

A

20.

Which of the following set of credentials would be best for a security consultant?

D

Exercises

EXERCISE 11.1: PATCHING SYSTEMS This exercise provides practice in finding and applying patches to a single machine. It also includes an essay component that has students think about how the process may be streamlined if there are many machines to be patched.

.

6

EXERCISE 11.2: LEARNING ABOUT POLICIES, EXERCISE 11.3: LEARNING ABOUT DISASTER RECOVERY, AND EXERCISE 11.4: LEARNING ABOUT AUDITS Each exercise asks students to find examples of documents, analyze them, and then write essays giving their opinions of the documents.

These resources may be useful for these exercises: • •

www.cert.org/ www.sans.org/

EXERCISE 11.5: SECURING YOUR COMPUTER In this exercise, students will take the steps to secure a computer. This includes patching the system (see Exercise 11.1), shutting down unneeded services, installing antivirus and antispyware software, and setting password permissions.

EXERCISE 11.6: SECURE PASSWORDS In this exercise, students research why longer passwords are harder to break, and then discover other things to do to make a password stronger. They then write an essay describing what makes a perfect password.

EXERCISE 11.7: SECURING A SERVER This exercise is for students who have access to a lab server. It is similar to Exercise 11.5 except it operates on a server rather than a workstation.

EXERCISE 11.8: BACKUPS In this exercise, students formulate a backup plan for a web server.

EXERCISE 11.9: USER ACCOUNTS In this exercise, students locate the local user accounts on a lab computer and disable all the default accounts (Guest, Administrator).

Projects

PROJECT 11.1: WRITING AND EXECUTING AN AUDIT PLAN In this project, students use the knowledge they have gained so far in the course to devise an audit plan that includes all steps in an audit. Then they will take their audit plan and use it for auditing a network. This audit can be conducted for any organization but works best with a small network (fewer than 100 users). The second part of this project is contingent upon getting permission from some organization to allow them to audit its security. It is also ideal for a group project.

PROJECT 11.2: FORMING A DISASTER RECOVERY PLAN In this project, students create a disaster recovery plan for an organization. The same basic guidelines apply for Project 11.1: Choose an organization with a relatively small IT department (fewer than 100 users).

.

7

PROJECT 11.3: WRITING A SECURITY POLICY DOCUMENT This project is designed to be a group project. Students will write a complete set of security policies for an organization. A real organization is better than a fictitious one. This set of policies must cover user access, password policies, frequency of audits (both internal and external), minimum security requirements, guidelines for web surfing, and so on.

PROJECT 11.4: SECURE WEB SERVERS Using the information in this chapter and other resources, develop a strategy specifically for securing a web server.

This strategy should include the security of the server itself as well as securing the network from the server.

PROJECT 11.5: ADDING YOUR OWN GUIDELINES This chapter has outlined some general procedures for security. Ask students to write an essay detailing their own additional guidelines. These can be guidelines for individual computers, servers, networks, or any combination thereof.

This project is ideal for a group project.

Case Study Students’ answers will vary. Some areas where students may suggest beefing up security include locking down unused ports via the firewall, requiring password complexity, as well as length, logging all system activity, establishing and implementing backup policies, and disabling unneeded accounts.

.

8

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 12 CYBER TERRORISM AND INFORMATION WARFARE

CHAPTER 12 OBJECTIVES When students finish reading this chapter, they will be able to: •

Explain what cyber terrorism is and how it has been used in some actual cases

•

Understand the basics of information warfare

•

Have a working knowledge of some plausible cyber terrorism scenarios

•

Have an appreciation for the dangers posed by cyber terrorism

•

Explain future trends in cyber warfare

CHAPTER OVERVIEW As the world becomes more dependent upon computer systems, the danger of cyber terrorism grows. There must be a much stronger emphasis on computer security. In addition to the basic security measures recommended in this book, this chapter provides recommendations for preparing for and protecting systems against cyber terrorism. This chapter explores computers’ possible and actual use for terrorism, information warfare, propaganda, information control, and disinformation. The chapter also includes a review of the history, as well as the future trends in cyber terrorism, and some steps to take to combat it.

The major sections in this chapter are: 1.

Actual Cases of Cyber Terrorism. This section reviews old and modern cases of cyber warfare, espionage, and terrorism.

2.

Weapons of Cyber Warfare. This section explains some of the most common and effective tools used in cyber terrorism and warfare, such as Stuxnet and Flame.

3.

Economic Attacks. Using credible scenarios, this section depicts how terrorists could endanger our economy.

4.

Military Operations Attacks. This section depicts how our military operations could be compromised through less secure minor systems.

.

1

5.

Information Warfare. This section covers the use and misuse of information for propaganda, information control, and divulging disinformation to the enemy.

6.

Future Trends. This section describes the impact of machine learning and artificial intelligence on cyber warfare and covers both positive and negative trends in the ongoing battle with cyber terrorism.

7.

Defense Against Cyber Terrorism. This section describes what an IT professional can do to help protect systems against cyber terrorism.

8.

TOR and the Dark Web. This section provides an information on the Dark Web and explains the role of TOR in accessing it.

CHAPTER OUTLINE I.

Actual Cases of Cyber Terrorism China's Advanced Persistent Threat India and Pakistan Russian Hackers Iran-Saudi Tension

II.

Weapons of Cyber Warfare Stuxnet Flame StopGeorgia.ru Malware FinFisher BlackEnergy Regin NSA ANT Catalog

III.

Economic Attacks

IV.

Military Operations Attacks

V.

General Attacks

VI.

Supervisory Control and Data Acquisitions (SCADA)

VII.

Information Warfare

.

2

Propaganda Information Control Disinformation VIII.

Actual Cases of Cyber Terrorism

IX.

Future Trends Machine Learning/Artificial Intelligence Positive Trends Negative Trends

X.

Defense Against Cyber Terrorism

XI.

Terrorist Recruiting and Communication

XII.

TOR and the Dark Web

KEY TERMS Advanced persistent threat (APT) An attack that takes place over a long period of time using multiple advanced techniques.

Cyber terrorism The use of computers and the Internet connectivity between them to launch a terrorist attack.

Footprinting The process of gathering information—some from public sources, others by scanning the target system/network.

Information warfare Attempts to influence political or military outcomes via information manipulation.

TOR The Onion Router, a system of routing packets on the Internet that obscures their source.

TEACHING NOTES I.

Actual Cases of Cyber Terrorism Teaching Tip: Ask students to describe one of the actual cyber terrorism cases covered in the textbook. How was the attack accomplished and what was the result?

II.

Weapons of Cyber Warfare Teaching Tip: Have students list and describe weaponized malware that has been used in conflicts. Some examples include Stuxnet, Flame, and Regin.

.

3

III.

Economic Attacks Teaching Tip: Our economy is based on trust. Trust is built on good information. Point out that the economic crash of the 1930s happened largely due to a breakdown in trust in the stock market and banks. Many peoples’ economic lives were ruined when that trust was broken. Now imagine that terrorists could break our economic trust in the banking system or start a rumor that the banking system was ready to fail. What would be the outcome?

IV.

Military Operations Attacks Teaching Tip: How many computerized systems are used by the military to keep the army running and well-informed? Have students list as many systems as they can think of.

V.

Information Warfare Teaching Tip: Ask students whether news reports have influenced their thoughts about war. See whether the class can recall any conflicting war reports plus the source of those reports.

VI.

Future Trends Teaching Tip: As hackers have shown, there are always unknown vulnerabilities in our computer systems. What can the government do to help protect U.S. systems and the Internet? Can we completely protect cyberspace? Should we spend resources if most cyber terrorism acts are not fatal?

VII.

Defense Against Cyber Terrorism Teaching Tip: Ask students how security measures for cyber terrorism differ from other security measures.

VIII.

TOR and the Dark Web Teaching Tip: Remind students that TOR (The Onion Router) is a system of routing packets on the Internet that uses encryption to obscure the source. Ask students about the connection between TOR and the Dark Web and why it is risky to browse the Dark Web.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 Are we better prepared against cyber terrorism since 9/11? How? Answer: Students’ answers may vary. There should be a discussion of specific measures and whether students think they will be effective.

.

4

B. Discussion Question 2 What is the most vulnerable computer system to cyber terrorism? What could be the results if attacked?

Answer: Students’ answers may vary. They should defend their opinions with facts.

II.

Web Projects A. Web Project 1 Search online to find articles about whether cyber terrorism is a real risk or is overhyped.

Answer: This project can further students’ understanding of cyber terrorism. Students should formulate an opinion based on the information they find.

B. Web Project 2 Search online to find out about the software backdoor that the U.S. installed in a U.S.S.R. oil pipeline program during the Cold War. How does U.S. involvement in cyber warfare impact our interests in other countries?

Answer: This project can further students’ understanding of information warfare. The discussion could include the sometimes opposing interests of defending the U.S. and being a part of the global economy.

C. Web Project 3 Search “Digital Pearl Harbor” online. What are the assumptions? Is it realistic? What could be the impact?

Answer: This project provides more in-depth research into the possibilities of information warfare. Students’ answers should include their reasons for thinking it is or is not realistic and specifics about the impact.

D. Web Project 4 Search online to find out how terrorists use the Internet for communications and coordination.

Answer: This project provides more in-depth research into cyber terrorism. Students should find answers to the question posed.

WEB RESOURCE •

.

https://www.unodc.org/e4j/en/cybercrime/module-14/key-issues/cyberterrorism.html United Nations Office on Drugs and Crime cyberterrorism site

5

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

What is the most likely damage from an act of cyber terrorism?

C 2.

Which of the following is not an example of financial loss due to cyber terrorism?

C

3.

Which of the following military/government systems would most likely be the target of a successful computer hack?

C

4.

Which of the following might be an example of domestic cyber terrorism?

D

5.

What differentiates cyber terrorism from other computer crimes?

B

6.

Which of the following is a political group that has already used the Internet for political intimidation?

A

7.

What is information warfare?

B

8.

Which of the following would most likely be considered an example of information warfare?

A

9.

Which of the following is a likely use of Internet newsgroups in information warfare?

A

10.

Sending a false message with weak encryption, intending it to be intercepted and deciphered, is an example of what?

C

11.

Which of the following best describes the communication goal of any intelligence agency?

B

.

6

12.

Which of the following conflicts had a cyber warfare component?

B

13.

Which of the following agencies has allegedly had one of its cyber spies actually caught?

D

14.

Which of the following is a cyber attack that would likely cause loss of life?

C

Exercises

EXERCISE 12.1: FINDING INFORMATION WARFARE This exercise is designed to get students thinking about what information warfare constitutes. Success in this exercise is determined by how well students can identify a potential instance of information warfare and how well students can support their conclusion.

EXERCISE 12.2: CYBER TERRORISM THREAT ASSESSMENT The purpose of this exercise is to show students how to use the Internet as an information source on groups that could potentially be perpetrators of cyber terrorism. Warn the students not to attempt to contact any of these groups in any way and discuss the risks and consequences if they decide to do otherwise. Students should simply use the Internet to gather information and assess why they think that particular group might choose to use the Internet as a vehicle for a specific terrorist act.

EXERCISE 12.3: FINDING INFORMATION POLICIES Exercises in previous chapters have asked students to learn about security policies. This exercise is meant to show students how to apply security policies to the problem of cyber terrorism.

EXERCISE 12.4: HOW COMPANIES DEFEND AGAINST CYBER TERRORISM Students must get a sense of real-world applications for what they are learning and for them to move beyond the theoretical. Everything learned will be of much more value if students can see where it is applied by real companies. If it is at all possible, students should complete this exercise. Students should enumerate the security measures taken by the IT staff at the company they visited. They should make the link between these security policies and how they present a defense against cyber terrorism and information warfare.

EXERCISE 12.5: PULLING IT ALL TOGETHER This exercise should be the culmination of all that students have learned thus far—both from the text and from their research. The point is to drive home the importance of security and to have them demonstrate knowledge of the elements involved in establishing a computer system that is as secure as possible.

.

7

Projects

PROJECT 12.1: COMPUTER SECURITY AND CYBER TERRORISM Successful students will take security measures mentioned in this book and show how they might be useful in defending against cyber terrorism. This project is designed to teach students to refocus knowledge they have already gained, on a more specific computer security application.

PROJECT 12.2: THE LAW AND CYBER TERRORISM This project is designed to accomplish two tasks. The first is to familiarize students with existing computer security-related laws. The second is to get them thinking about what additional laws might be necessary.

PROJECT 12.3: CYBER TERRORISM SCENARIO This exercise aims to get students to consider what responses should be taken to a cyber terrorism attack.

Successful students will detail specific steps and describe how they would address a specific threat.

Case Study This case study is designed to get students to think about the requirements of environments that need more security than the average business. Students should come up with a wide range of security precautions.

These precautions might include: •

Antispyware on all machines

•

All transmissions encrypted

•

Monthly security audits

•

Intrusion Detection Systems

.

8

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 13 CYBER DETECTIVE

CHAPTER 13 OBJECTIVES When students finish reading this chapter, they will be able to: •

Find contact information on the Web

•

Locate court records on the Web

•

Locate criminal records on the Web

•

Use Usenet newsgroups to gather information

•

Understand sources on the Internet

CHAPTER OVERVIEW To perpetrate identity theft, criminals use a small amount of information they obtained about their target to acquire even more information. This chapter describes how to find additional information about a person or company on the Internet using tools available to hackers or identity thieves. Students should understand this process so they can better defend themselves against ID theft and know what information is available about them online.

The major sections in this chapter are: 1.

General Searches. This section details how to find names, addresses, and phone numbers using many popular websites, such as US Search and Spokeo.

2.

Company Searches. This section describes how to locate information on a specific company.

3.

Court Records and Criminal Checks. Using government sites, this section shows how to look up sex offenders or people that may have criminal and civil court records.

4.

Usenet. This section describes how Usenet can be accessed to find postings from or about a target.

5.

Google. This section explains how to use Google search parameters to refine searches.

.

1

CHAPTER OUTLINE I.

General Searches Email Searches

II.

Company Searches

III.

Court Records and Criminal Checks Sex Offender Registries Civil Court Records Other Resources

III.

Usenet

IV.

Google

V.

Maltego

KEY TERMS Dumpster diving Searching trash for valuable information to use in identity theft.

Sex offender A person who has been convicted of a crime for which offenses are tracked in a sex offender registry for the locale in which the conviction occurred.

Usenet A global group of bulletin boards that exist on any subject you can imagine.

TEACHING NOTES I.

General Searches Teaching Tip: Let students know that looking up someone’s phone number or address on the Internet is usually acceptable, as it is equivalent to a phonebook search in order to contact an individual . It has, however, become a common term to “Google someone” to find out information about a person by typing their name in a Google search. Have students type in their name, city, and state on Google.com to see what information displays. Lead a discussion to see how much personal information is acceptable to look up without crossing the line of an invasion of privacy.

II.

Company Searches Teaching Tip: Ask students to name some company search sites mentioned in the textbook and why they might want to use such websites in the future.

.

2

III.

Court Records and Criminal Checks Teaching Tip: Court records are public information. See what local court sites students can find on the Internet using Google.com or the links in this chapter. Note that URLs printed in textbooks can quickly become obsolete.

IV.

Usenet Teaching Tip: There are tens of thousands of discussion groups on Usenet. Students can use Google or Yahoo tools to search Usenet. Ensure that students understand that most users post anonymously or under an alias name. Also, any posts on Usenet or any other discussion board should be treated as hearsay unless verified by a reliable source.

As with any Internet source, just because it is posted does not make it true.

II.

Google Teaching Tip: Review the common Google search parameters that help target a search.

Ask students which Google search operator they would use to search only within a given website.

DISCUSSION QUESTIONS AND WEB PROJECTS I.

Discussion Questions A. Discussion Question 1 What would students do if they looked up information about their best friend on the Internet and found something bad?

Answer: Students’ answers may vary. Discussion should include that anything posted on the Internet must be verified before any action is taken.

B. Discussion Question 2 Should there be consumer data warehouses that compile masses of data about civilians and then sell the information to companies or governments?

Answer: Students’ answers may vary. Most will probably think this is a bad idea; for argument’s sake, you might ask for reasons why this would be a good thing to do.

II.

Web Projects A. Web Project 1 Search online to find articles on LexisNexis. LexisNexis aggregates data from hundreds of sources on millions of Americans. The reports are then sold to thousands of companies and government agencies that want to know more about their clients, customers, or employees.

Find out what type of information they contain, how they protect privacy, and how to correct errors that they may have in the database. One place to start is http://risk.lexisnexis.com.

.

3

Answer: This project provides more in-depth research into the information that can be found on individuals. Students should find answers to the questions asked.

B. Web Project 2 Access Usenet and find all the groups that someone might post to that pertain to attending this college or this class. How many did students come up with? How many total posts were contained in all the groups? What is the best way to filter these posts to find those that pertain to one person?

Answer: This project will further students’ understanding of the difficulty of filtering information found on Usenet groups. Students should find answers to the questions asked.

WEB RESOURCES General search resources: •

http://www.yahoo.com A popular site often used for to search for people

•

http://www.infobel.com A site providing addresses and phone numbers from around the world

Other name, phone number, and address lookup sites: •

http://www.yellowpages.com

•

http://www.ussearch.com

•

http://www.whitepages.com

Court records and criminal checks: •

https://www.fbi.gov/scams-and-safety/sex-offender-registry online state sex offender registries

•

http://www.oscn.net/applications/oscn/casesearch.asp Oklahoma court records site

An exhaustive FBI list of individual

Other websites that should help with a search for court records: •

http://pacer.gov PACER Service Center is the Federal Judiciary's registration, billing, and technical support center for electronic access to U.S. District, Bankruptcy, and Appellate court records

•

http://www.bop.gov/ Prison records from the Federal Bureau of Prisons

•

http://www.searchsystems.net/ Free public records directory

.

4

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

How might an identity thief use the Internet to exploit his victim?

A 2.

Which of the following is not an ideal place to seek out phone numbers and addresses?

B

3.

Why do you not want too much personal data about you on the Internet?

B

4.

How could a hacker use information about you found through Internet searches?

D

5.

If you are hiring a new employee, which of the following should you do?

D

6.

Which of the following would be least important to know about a potential business partner?

B

7.

What information would provide the most accurate results for locating a person?

B

8.

Of the websites listed in this chapter, which would be the most useful in obtaining the address and phone number of someone who does not live in the United States?

C

9.

Where would you go to find various state sex offender registries?

A

10.

What is most important to learn about a person listed in a sex offender registry?

D

11.

Which web search approach is best when checking criminal backgrounds?

C

12.

.

What advantages are there to commercial web search services?

5

B 13.

Which would you use to begin a search for information on a United States court case?

A

14.

Which of the following is the most accurate description of Usenet?

D

15.

Which of the following is the most helpful data you might get from Usenet on a person you are investigating?

A

Exercises For all exercises and projects in this chapter, students will concentrate their investigation on a specific person.

It is best if they investigate themselves. Students should substitute their name for John Doe or Jane Doe in the projects and exercises.

EXERCISE 13.1: FINDING PHONE NUMBERS AND EXERCISE 13.2: CRIMINAL RECORDS CHECKS These exercises are procedural. The students should search online for information on phone numbers, addresses, and criminal records using their own name. Most searches yield too much data rather than too little, so students should filter out unrelated data.

EXERCISE 13.3: CHECKING COURT CASES INFORMATION ON USENET

AND

EXERCISE 13.4: FINDING BUSINESS

Like the first two exercises, these exercises are also procedural, but here, the focus is on a business of a person rather than the actual person. Again, the challenge will be to filter out unrelated data and determine what is relevant.

EXERCISE 13.5: BLOCKING INFORMATION To complete this exercise students must delve a little deeper into the websites discussed and perform some research to determine other means of blocking access to their personal information. The purpose of this chapter is to enlighten students about the wealth of information that is available to anyone online. This exercise aims to enable students to begin to see ways in which they can guard their own information.

Projects

PROJECT 13.1: INVESTIGATING A PERSON AND PROJECT 13.2: INVESTIGATING A COMPANY With both of these projects, the key is to use multiple search modalities, in conjunction, to find accurate and relevant data on themselves. The students should filter out irrelevant data.

.

6

PROJECT 13.3: THE ETHICS OF INVESTIGATION There is no clear right or wrong answer in this project. Because this chapter has focused on techniques that might have ethical ramifications, it is important that students think about those ramifications before they go out and begin applying the skills they learned in this chapter.

Case Study This case study requires students to bring together the elements involved in a logical investigation of a potential employee in one brief essay. Although there are no absolute answers, students should recognize that an investigation should begin with the broader-based websites and then be narrowed down to the more specific ones (that is, a state court case website). They should also mention the significance of confirming any information found and that, a high ethical standard should be expected for a person in human resources—and a record that reflects this standard and shows no lapses in judgment.

.

7

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 14 INTRODUCTION TO FORENSICS

CHAPTER 14 OBJECTIVES When students finish reading this chapter, they will be able to: •

Understand basic forensics principles

•

Make a forensic copy of a drive

•

Use basic forensics tools

•

Prepare a forensics report

•

Avoid common forensics mistakes

CHAPTER OVERVIEW This chapter covers the fundamentals of computer forensics, including concepts, laws, and basic techniques.

The major sections in this chapter are: 1.

General Guidelines. This section offers general principles of forensic investigation.

2.

Finding Evidence on a PC. This section explains how to locate evidence on a PC.

3.

Finding Evidence in System Logs. This section describes the various types of system logs and what information they contain.

4.

Getting Back Deleted Files. This section explains how to recover deleted files to uncover evidence.

5.

Operating System Utilities. This section describes several utilities that can be useful in gathering forensic data.

6.

The Windows Registry. This section explains how to find forensically useful information in the Windows Registry.

7.

Mobile Forensics: Cell Phone Concepts. This section explains the identifiers and specifications used for cellular networks and how they can be forensically useful.

.

1

8.

Additional Types of Forensics. This section explains network and virtual forensics.

CHAPTER OUTLINE I.

General Guidelines Don’t Touch the Suspect Drive Imaging a Drive with Forensic Toolkit Can You Ever Conduct Forensics on a Live Machine?

Document Trail Secure the Evidence Chain of Custody FBI Forensics Guidelines U.S. Secret Service Forensics Guidelines EU Evidence Gathering Scientific Working Group on Digital Evidence Locard’s Principle of Transference The Scientific Method Standards Forensics Reports Tools

II.

Finding Evidence on a PC Finding Evidence in a Browser

III.

Finding Evidence in System Logs Windows logs Linux Logs

.

IV.

Getting Back Deleted Files

V.

Operating System Utilities 2

net sessions openfiles fc netstat VI.

The Window Registry Specific Entries

VII.

Mobile Forensics: Cell Phone Concepts Cell Phone State Cell Phone Components Cellular Networks iOS Android What You Should Look For

VIII.

The Need for Forensic Certification

IX.

Expert Witnesses Federal Rule 702 Daubert

X.

Additional Types of Forensics Network Forensics Virtual Forensics

KEY TERMS Chain of custody Documentation of who had access to the evidence, how they interacted with it, and where it was stored.

Computer forensics The process of examining computer devices using scientific methods to extract evidence in such a way that the evidence can be presented in court.

Cyber forensics Another term for the field of computer forensics. .

3

Hives The five major sections of the Windows Registry, such as HKEY_CLASSES_ROOT. Integrated circuit card identification (ICCID) The unique number assigned to a SIM during manufacturing.

International mobile subscriber identity (IMSI) A 15-digit number that is used to uniquely identify a phone.

International mobile equipment identity (IMEI) A unique number used to identify GSM, UMTS, LTE, and satellite phones by hardware.

Locard's Principle of Transference A principle that states that you cannot interact in any environment without leaving something behind.

Subscriber identity module (SIM) A removable chip in a phone that is used to identify it to the network.

Virtualization A way to provide various IT resources independent of the user’s physical machinery.

TEACHING NOTES I.

General Guidelines Teaching Tip: Discuss the possible ramifications of touching the suspect drive in ways that might modify it. The evidence could be considered invalid and unable to be used in a court case, and the person handling the evidence may be subject to discipline.

Teaching Tip: Demonstrate how to image a drive with Forensic Toolkit or some other imaging utility that is forensically defensible.

Teaching Tip: Discuss some of the reasons why students might have to perform forensics on a live machine.

II.

Finding Evidence on a PC Teaching Tip: Have students list ways to collect evidence from a PC, and then demonstrate those methods on a test machine.

III.

Finding Evidence in System Logs Teaching Tip: Demonstrate finding information in various Windows log files. Then do the same on a Linux system.

IV.

Getting Back Deleted Files Teaching Tip: Demonstrate using DiskDigger or some other utility to recover deleted files.

V.

.

Operating System Utilities

4

Teaching Tip: Demonstrate as many of the utilities listed in this section as time permits, and have students try out some of them independently and report back.

VI.

The Windows Registry Teaching Tip: Open the Regedit tool. Show the hive files and the hierarchical structure of the Windows Registry. Explain the use of Registry keys. Review the specific entries covered in the text and emphasize that there is no Undo when editing the Registry.

VII.

Mobile Forensics: Cell Phone Concepts Teaching Tip: Have students use their own phones to determine information about them, such as SIM, IMSI, ICCID, and IMEI.

VIII.

Additional Types of Forensics Teaching Tip: Demonstrate one or two common tools for network analysis, such as Wireshark and CommView.

DISCUSSION QUESTION AND WEB PROJECT I.

Discussion Question A. Discussion Question 1 Of what value would it be to attain a certification in digital forensics?

Answer: Students’ answers may vary. Discussion should include that a certified witness may be more credible in a court case and that preparing for the certification exam can enhance the candidate's skill and experience. Mention Federal Rule 702; certification may help someone qualify under it.

II.

Web Project A. Web Project 1 Search online to find companies that perform professional computer forensics investigations.

What types of services are offered and how much do they typically cost? Ask students if they think this would be a career they would be interested in and have them explain why they would or wouldn’t be interested in a computer forensics career.

Answer: This project provides a real-world perspective on careers in the computer forensics industry.

WEB RESOURCES •

http://www.secretservice.gov United States Secret Service

.

5

•

https://www.us-cert.gov/sites/default/files/publications/forensics.pdf Computer Forensics: USCERT

•

http://www.fbi.gov/news/stories/2009/august/rcfls_081809 FBI Computer Forensics

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

C 2.

Ian is performing a forensic examination on a Linux server. He is trying to recover emails. Where does Linux store email server logs?

A

3.

Why should you note all cable connections for a computer you want to seize as evidence?

B

4.

Pedro is examining a Windows 10 computer. He has extracted the index.dat file and is examining that file. What is in the index.dat file?

B

5.

What is the name of the standard Linux command that is also available as a Windows application that can be used to create bitstream images and make a forensic copy?

D

6.

When cataloging digital evidence, the primary goal is to do what?

B

7.

Mahmoud is using a range of Windows utilities to extract information from a computer he is triaging. He has just used the openfiles command. What does the command openfiles show?

B

8.

“Interesting data” is what?

A

9.

.

Which of the following are important to the investigator regarding logging?

6

D

Exercises

EXERCISE 14.1: DISKDIGGER Have students download DiskDigger and search their computers for deleted files. They should attempt to recover one file of their choice.

EXERCISE 14.2: MAKING A FORENSIC COPY This exercise requires two computers. Students must also download either Kali Linux or Knoppix. (Both are free.) They should attempt to make a forensic copy of computer A by sending its data to computer B.

EXERCISE 14.3: OSFORENSICS Students should download a trial copy of OSForensics from https://www.osforensics.com/osforensics.html.

Using tutorials at https://www.osforensics.com/faqs-and-tutorials/video_demonstrations.html, have students perform basic forensics on their own computers with OSForensics.

.

7

Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 15 CYBERSECURITY ENGINEERING

CHAPTER 15 OBJECTIVES When students finish reading this chapter, they will be able to: •

Understand basic systems engineering concepts

•

Be able to integrate systems engineering into cybersecurity

•

Utilize engineering tools in cybersecurity

•

Explain the use of standards in cybersecurity engineering

CHAPTER OVERVIEW This chapter defines cybersecurity engineering as a technical discipline and explains the components of its study.

It defines the parameters of cybersecurity as an academic discipline and provides some models and diagrams to help further define it.

The major sections in this chapter are: 1.

Defining Cybersecurity Engineering. This section defines cybersecurity and engineering and explains how they fit together to form a subdiscipline of systems engineering.

2.

Standards. This section reviews cybersecurity engineering standards, including RMF, ISO 27001, ISO 27004, and NIST SP 800-63B.

3.

SecML. This section introduces information about Security Modeling Language (SecML) and presents several diagrams for understanding how to create cybersecurity models.

4.

Modeling. This section identifies three approaches to threat modeling: STRIDE (short for spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privileges), PASTA (Process for Attack Simulation and Threat Analysis), and DREAD (short for damage potential, reproducibility, exploitability, affected users, and discoverability).

.

1

CHAPTER OUTLINE I.

Defining Cybersecurity Engineering Cybersecurity and Systems Engineering Applying Engineering to Cybersecurity

II.

Standards RMF ISO 27001 ISO 27004 NIST SP 800-63B

III.

SecML SecML Concepts Misuse-Case Diagram Security Sequence Diagram Data Interface Diagram Security Block Diagram

IV.

Modeling STRIDE PASTA DREAD

KEY TERMS Security Modeling Language (SecML) A modeling language for describing cybersecurity attack scenarios and defense postures.

Systems engineering An interdisciplinary approach and means to enable the realization of successful systems.

Systems Modeling Language (SysML) One of the primary modeling methods used in systems engineering. SysML is an extension of the earlier Unified Modeling Language (UML).

.

2

Unified Modeling Language (UML) A set of diagrams used to model software.

Work Breakdown Structure (WBS) A diagram that takes a large process and breaks it into smaller, manageable pieces.

TEACHING NOTES I.

Defining Cybersecurity Engineering Teaching Tip: Ask students to list as many different engineering disciplines as possible and discuss how cybersecurity relates to them. The relationship will be much closer for some than for others, but almost every engineering discipline that includes a computer component may have a connection.

Teaching Tip: Review the formulas for mean squared deviation, mean percentage error, and mean time between failures (formulas 1 and 2) and discuss their application to cybersecurity.

II.

Standards Teaching Tip: Ask students to compare the four cybersecurity engineering standards described in the text and explain how they differ from each other.

III.

SecML Teaching Tip: Explain the need for a modeling language that can be used to effectively describe computer security attacks and their defenses. Ask students to think about how other engineering disciplines use modeling languages, and how this may carry over to security.

IV.

Modeling Teaching Tip: Ask students which threat modeling approach described in the text was created by Microsoft and have them explain what the acronym STRIDE stands for.

DISCUSSION QUESTION AND WEB PROJECT I.

Discussion Question A. Discussion Question 1 What is the benefit of applying quantitative measurement and analysis to security?

Answer: Students’ answers may vary and may include a discussion of being able to measure the success or failure of security measures and tweak them to improve over time.

II.

.

Web Project 3

A. Web Project 1 Search online to see what other approaches people have taken to modeling cybersecurity in addition to SecML. Answer: This project provides more in-depth research into modeling cybersecurity and SecML. Students should find answers to the question posed.

WEB RESOURCES •

https://www.incose.org/ International Council on Systems Engineering

•

https://www.abet.org/ Accreditation Board for Engineering and Technology

•

http://www.omgsysml.org/INCOSE-OMGSysML-Tutorial-Final-090901.pdf Modeling Language tutorial

OMG Systems

CHAPTER REVIEW/ANSWERS TO TEST YOUR SKILLS Multiple Choice 1.

What type of diagram is used to show how any entity might interact with a system?

A 2.

What is the most appropriate tool for capturing the requirements of any security process or system?

D

3.

Which of the following cybersecurity activities would be most accurately described as engineering?

C

4.

Which modeling language is used by systems engineers?

B

5.

What does this symbol represent in SecML?

C

.

4

6.

What does this symbol represent in SecML?

B 7.

What does this system represent in SecML?

C 8.

What standard has 14 domains?

B

9.

How many assurance levels are there in NIST 800-63B? B

10.

Which are the elements of STRIDE? A

Exercises

EXERCISE 15.1: MISUSE-CASE DIAGRAM Have students create a misuse-case diagram for a specific type of attack. They can choose any attack described in this book.

EXERCISE 15.2: REQUIREMENTS GATHERING Have students consider the cybersecurity requirements of a college campus. They should create a requirements traceability matrix for penetration testing a campus computer network.

.

5