Corporate Computer Security, 5th edition Randall J Boyle Solution Manual

Type:

Solution Manual

Resource:

Corporate Computer Security

Edition:

5th Edition

Author(s):

Randall J. Boyle Raymond R. Panko

.

Instructor’s Manual

Chapter 1

The Threat Environment Learning Objectives By the end of this chapter, the student should be able to: ➢ Define the term threat environment. ➢ Describe the impact of data breaches. ➢ Describe threats from employees and ex-employees. ➢ Describe threats from malware writers. ➢ Describe traditional external hackers and their attacks, including break-in processes, social engineering, and denial-of-service attacks. ➢ Know that criminals have become the dominant attackers today, describe the types of attacks they make, and discuss their methods of cooperation. ➢ Distinguish between cyberwar and cyberterror.

Teaching Suggestions Special Issues This chapter is packed with information, but students already know much of it, and the individual concepts are not difficult. There are only two things that tend to puzzle students a little. First, they have a difficult time understanding the implications of intentionality in the definition of hacking. It is important to have students work through multiple examples. Second, some find the distinction between carding and identity theft difficult.

.

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Role in the Book Chapter 1 looks at the threat environment—the attackers and attacks that corporations face. The remainder of the book follows the traditional plan-protect-respond cycle that corporations use to defend against the threats that this chapter describes.

This book, then, is about defense rather than offense. Students like to work with attack software, and I know that some teachers build their courses around attacks.

However, attacks change constantly, and knowing how to attack does not teach a student how to defend. Defense is complex, and it needs a whole course.

Teaching the Material Flow of Material ➢ The chapter begins with a definition of the threat environment. It then introduces basic terminology, including confidentiality, integrity, availability, compromises, incidents, breaches, countermeasures, safeguards, and controls. ➢ The chapter then covers the data breach at Target, including the factors that led to it, a short primer on spear phishing, and the consequences the company faced after a massive privacy breach. ➢ Next, the chapter covers threats from employees and ex-employees. This section introduces the importance of internal threats. It specifically covers several attacks, including sabotage, hacking, financial theft, theft of intellectual policy (especially trade secrets), extortion, sexual or racial harassment, computer and Internet abuse, and data loss through lost media. ➢ The chapter discusses malware, which is a general term for “evil” software. This includes the usual suspects of viruses and worms and the payloads they carry. It also includes Trojan horses, including remote access Trojans, downloaders, spyware, and rootkits. It ends with a discussion of mobile code and social engineering in malware. ➢ Next come traditional external hackers and their attacks, including break-in processes, social engineering, and denial-of-service attacks. ➢ The chapter emphasizes that criminals have become the dominant attackers today.

The section on career criminals notes that criminal attacks often use international criminal black markets. Criminals engage in fraud (in which the attacker deceives the victim into doing something against the victim’s self-interest), financial theft, the theft of intellectual property, and extortion. The section then discusses stealing private customer and employee data for use in carding (credit card number theft) and identity theft. ➢ The chapter ends with the nightmare scenarios of cyberwar and cyberterror.

Cyberwar, which is waged by national governments, could produce unprecedented damages. In cyberterror, terrorists use IT to attract converts, conduct direct attacks, make physical attacks worse by creating confusion, and engage in cybercrime to finance their terrorism.

1–2 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Covering the Material This is a great chapter for student brainstorming. The chapter is organized around the types of attackers the company faces and the attacks they use against you.

First, have the class come up with a list of people who may attack them. Write them on the board, leaving room for attacks below the names. After they have exhausted their list, complete it.

Second, have them generate the attacks each will use. When they get to hacking, go over the book’s definition closely and work out some examples to see why the concept is complex.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master. Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report.

The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report. Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

Answer Key

Introduction 1.

a) Why is it important for firms to understand the threat environment?

Until you understand the threats you face, you cannot defend yourself. b) Name the three common security goals.

Confidentiality, integrity, availability.

1–3 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

c) Briefly explain each goal.

Confidentiality means that people cannot read sensitive information, either while it is on a computer or while it is traveling across a network.

Integrity means that attackers cannot change or destroy information, either while it is on a computer or while it is traveling across a network. Or, at least, if information is changed or destroyed, then the receiver can detect the change or restore destroyed data.

Availability means that people who are authorized to use information are not prevented from doing so. Neither a computer attack nor a network attack will keep them away from the information they are authorized to access. d) What is an incident?

When a threat succeeds in causing harm to a business, this is called an incident. e) What are the synonyms for incidents?

Breaches or compromises. f) What are countermeasures?

The methods companies use to thwart attacks are called countermeasures. g) What are the synonyms for countermeasure?

Synonyms for countermeasures include safeguards, protections, or controls. h) What is the goal of countermeasures?

To thwart attacks. i) What are the three types of countermeasures?

Preventative Detective Corrective

Data Breaches 2. a) What is a data breach?

A data breach happens when an unauthorized person views, alters, or steals secured data.b) Why are data breaches so costly? Direct costs of handling a data breach include paying for notification, detection, escalation, remediation, legal fees, and consultation. Indirect costs are related to loss of reputation, abnormal customer turnover, and increased customer acquisition activities. c) Why do data breaches happen? More than 67 percent of data breaches come from hackers trying to make money. Hackers are primarily looking for personally identifiable information (PII), or data that can be used to identify a person. This 1–4 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

includes names, addresses, dates of birth, Social Security numbers, credit card numbers, health records, bank account numbers, PINs, and e-mail addresses. But credit card fraud isn’t the only way criminals make money from data breaches.

Stolen data is commonly used for identity theft, extortion, and industrial espionage. Any organization with valuable data may be a target. d) How do data breaches happen? Each one is different because hackers are continually developing new tools and techniques that enable them to steal more data. They experiment with new attack vectors, or ways of attacking a target. They might use a phishing scam one week in an effort to trick users into donating funds for a natural disaster. Then, the following week, they might develop an exploit, which is software used to take advantage of a newly discovered vulnerability in a target’s application or operating system. e) Explain how data was stolen from Target. The attackers first purchased malware designed specifically for the attacks they planned to carry out. They then used spear phishing, or a targeted phishing attack aimed at a single individual, to infect a Target third-party vendor named Fazio Mechanical Services (which provides refrigeration and HVAC services). Attackers placed a piece of malware called Citadel on Fazio’s system to gather keystrokes, login credentials, and screenshots from Fazio users. The attackers then used the stolen login credentials from Fazio to access a vendor portal (or server) on Target’s network. The attackers escalated privileges on that server (i.e., took over the server) and gained access to Target’s internal network. f) What was the fallout from the Target data breach? Target was forced to upgrade its payment terminals to support chip-and-PIN-enabled cards (to prevent cloning cards from stolen information), which cost more than $100 million. From 2015 through 2017 Target settled multiple lawsuits, including $67 million to Visa, $40 million to banks and credit unions, $19 million to Mastercard, $18 million to state governments, and $10 million to customers in a class action lawsuit. Adding to that $154 million in settlement payments, it also had to pay increased insurance premiums, pay legal fees, pay for consumer credit monitoring, and pay regulatory fines. They faced a loss in consumer confidence, a drop in revenue, and substantial costs related to changes in leadership.

Employee and Ex-Employee Threats 3.

a) Give four reasons why employees are especially dangerous.

(1) They have extensive knowledge of the IT systems.

(2) They often have access to sensitive parts of the system.

(3) They know corporate control mechanisms and so often know how to avoid detection.

1–5 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

(4) They are trusted by companies and can benefit from that trust when not following proper security protocol. b) What type of employee is the most dangerous?

IT support personnel, and specifically IT security personnel, are the most dangerous employees. c) What is sabotage?

Sabotage is the destruction of hardware, software, or data. d) Give the book’s definition of hacking.

Hacking is intentionally accessing a computer resource without authorization or in excess of authorization. e) What is intellectual property?

Intellectual property (IP) is information owned by the company and protected by law. f) What two types of things are employees likely to steal?

Money and trade secrets. g) Distinguish between intellectual property in general and trade secrets.

IP includes formally protected information such as copyrights, patents, trade names, and trademarks. Trade secrets are pieces of sensitive information that a firm acts to keep secret. h) What is extortion?

In extortion, the perpetrator tries to obtain money or other goods by threatening to take actions that would be against the victim’s interest. i) What is employee computer and Internet abuse?

Abuse consists of activities that violate a company’s IT use policies or ethics policies. j) Who besides employees constitute potential “internal” threats?

Many companies use contract employees who, while not employees of the company, often share many of the same access benefits.

Malware 4.

a) What is malware?

Malware is a generic term for “evil” software. b) Distinguish between viruses and worms.

Viruses are programs that attach themselves to legitimate programs on the victim’s machine and are usually spread via email messages. Worms are full programs that do not attach themselves to other programs and can 1–6 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

propagate through the same mechanisms as viruses, but can also selfpropagate, making them able to spread much faster. c) How do most viruses spread between computers today?

Most viruses spread between computers via email messages, but can also be spread via instant message, file sharing programs, downloading infected programs from a malicious website, or from “free software” or pornography downloaded by users. d) Describe how directly propagating worms move between computers.

Directly propagating worms jump directly to computers that have vulnerabilities; they then use these computers to jump to other computers. e) Why are directly propagating worms especially dangerous?

Direct-propagation requires no user action, so these worms can spread extremely rapidly. f) What is a virus or worm payload?

Payloads are pieces of code that do damage. After propagating, mobile malware may execute a payload.

Trojan Horses and Rootkits Test Your Understanding 5. a) How can nonmobile malware be delivered to computers?

It can be on webpages that users download. b) What is a Trojan horse?

A Trojan horse is a program that hides itself by deleting a system file and taking on the system file’s name. Trojan horses are difficult to detect because they look like valid system files. c) What is a RAT? A RAT is a remote access Trojan. A RAT gives the attacker remote access control of your computer. d) What is a downloader?

A downloader usually consists of small programs that, after installed, download a larger Trojan horse program capable of doing much more damage. e) What is spyware?

Spyware refers to a broad spectrum of Trojan horse programs that gather information about you and make it available to an attacker. f) Why can cookies be dangerous?

Cookies can record too much sensitive information about you and could become spyware. g) Distinguish between keystroke loggers, password-stealing spyware, and data 1–7 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

mining spyware.

Keystroke loggers capture all your keystrokes. Hackers then look through the keystroke log files to obtain usernames, passwords, SSNs, credit card numbers, and other sensitive information.

Password-stealing spyware tells you that you have been logged out of the server you are visiting and asks you to retype your username and password, which then gets sent on to the attacker.

Data mining spyware searches your hard drives for the same types of information captured by keystroke loggers and sends the information on to the attacker. h) Distinguish between Trojan horses and rootkits.

Trojan horses replace legitimate programs. Rootkits take over the root account and use its privileges to hide themselves. They do this primarily by preventing their operating system’s file viewing methods from detecting their presence. i) Why are rootkits especially dangerous?

Rootkits are especially dangerous because rootkits take over the root account to hide themselves from normal inspection and detection.

Mobile Code Social Engineering in Malware Test Your Understanding 6. a) What is mobile code?

Mobile code is code that executes on whatever machine downloads the webpage. b) What is social engineering?

Social engineering attacks take advantage of flawed human judgment by convincing the victim to take actions that are counter to security policies. c) What is spam?

Spam is unsolicited commercial e-mail. d) What is phishing?

Phishing attack victims receive an email message that appears to come from a bank or another firm with which the victim does business. e) Distinguish between normal phishing and spear phishing.

Phishing uses email messages that appear to come from banks or other valid firms and directs the user to go to an authentic-looking website or other ruse to obtain sensitive information from the victim. f) Why are hoaxes bad?

1–8 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Hoaxes give false information. They may even try to persuade the victim to damage their own system.

Hackers and Attacks Traditional Motives Test Your Understanding 7. a) What were the motivations of traditional external hackers?

Traditional external hackers were motivated by ego, the thrill of the breakin, and validation of their skills. b) Did traditional external hackers engage in theft?

They often did.

Anatomy of a Hack Test Your Understanding 8. a) Distinguish between IP address scanning and port scanning.

IP address scanning is used to determine the IP addresses of a firm’s network, primarily using ICMP Echo messages (a.k.a. pings). Port scanning determines which applications are either running or authorized on a specific host. b) What is an exploit?

The specific attack method that the attacker uses to break into the computer is called the attacker’s exploit, and the act of implementing the exploit is called exploiting the host. c) What does “owning” a computer mean?

Being able to do anything the attacker wishes on the computer. d) What is IP address spoofing?

Sending packets with false IP source addresses. e) Why is IP address spoofing done?

So that the attacker cannot determine the identity of the attacker. f) When can an attacker not use IP address spoofing?

Attackers cannot use IP address spoofing when they are trying to read replies of probe packets. g) When attackers must use valid IP source addresses in probe or exploit packets, how do they conceal their identities?

1–9 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

When attackers must use valid IP source addresses, they typically use chains of computers previously compromised by the attacker; the chain is best when it is 15 or more computers. The response packets from an attack will have to be tracked through the entire chain of compromised hosts, which is very difficult.

Social Engineering in an Attack Test Your Understanding 9. a) How can social engineering be used to get access to a sensitive file?

Simply by asking someone to send the file or to give access to the file. b) What is piggybacking?

Following someone through the door to a secure area without authenticating oneself. c) What is shoulder surfing?

Watching someone type his or her password in order to learn the password. d) What is pretexting?

In pretexting, an attacker calls claiming to be a certain person in order to ask for private information about that person.

Denial-of-Service Attacks Test Your Understanding 10. a) What is a DoS attack?

A denial-of-service (DoS) attack attempts to make a server or network unavailable to serve legitimate users by flooding it with attack packets. b) Describe a DDoS attack.

In a typical DDoS, an attacker controls many computers with bots. The attacker (or “botmaster”) sends the bots a command to attack. All the bots then send the victim a flood of attack packets. c) Describe a SYN flooding attack in some detail.

In a TCP SYN flooding attack, an attacker uses bots to flood a server with TCP connection-opening (SYN) requests. A server reserves a certain amount of capacity each time it receives a SYN segment. Flooding a server with SYN segments can cause the server to run out of resources and crash or be unable to open valid requests. A SYN flood can shut down an entire network if strong enough. d) Why do many botnets have multiple owners over time?

Typically, a botmaster will use the botnet for his or her purpose, then sell the botnet to someone else.

1–10 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Skill Levels Test Your Understanding 11. a) What are the two primary characteristics of skilled hackers?

Expert hackers are characterized by strong technical skills and dogged persistence. b) Why are script kiddies dangerous? (Give two reasons.)

Script kiddies are dangerous because of their sheer numbers and because their many attacks make it difficult to recognize the few attacks that are highly sophisticated. c) Why are malware and exploit toolkits expanding the danger of script kiddies?

They are making it much easier for script kiddies to act.

The Criminal Era Dominance by Career Criminals Test Your Understanding 12. a) What is the dominant type of attacker today?

The career criminal. b) Is cybercrime negligible today compared to noncomputer crime?

No. According to the U.S. Treasury Department, cybercrime proceedings surpassed those from illegal drug sales in 2005. c) Why are international gangs difficult to prosecute?

It is difficult to prosecute someone in another country. d) Why do international gangs use transshippers?

International gangs use transshippers in the United States because many online sellers will not ship to addresses outside of the U.S. e) How do they use transshippers?

Transshippers receive shipped goods at U.S. offices and then ship them to the criminal gang in another country. f) How do they use money mules?

Money mules transfer foreign money into U.S. money, and vice versa, for a small fee.

1–11 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Fraud, Theft, and Extortion Test Your Understanding 13. a) What is fraud? Be specific.

In fraud, the attacker deceives the victim into doing something against the firm’s security policy. b) What is click fraud?

In webpage advertising, a webpage owner posts an electronic advertisement. If a visitor clicks on it, this takes the visitor to a sponsor website. The sponsor website pays a small fee to the webpage owner. In click fraud, the webpage owner writes a program to “click” repeatedly on the ad and go to the sponsor website. This gives the webpage owner unearned money. c) How do criminals engage in online extortion?

Computer extortionists threaten to do at least temporary harm to the victim company’s IT infrastructure unless the victim pays the attacker.

Stealing Sensitive Data about Customers and Employees Test Your Understanding 14. a) What is carding?

Carding is stealing credit card numbers. b) Describe bank account theft and online stock account theft.

In bank account theft, the attacker controls the victim’s bank account and withdraws money.

In online stock account theft, the attacker takes over the victim’s online stock account and withdraws money. c) Distinguish between credit card theft and identity theft.

Credit card theft gives criminals access to a specific credit card. Identity theft is much worse, as it allows the criminal to impersonate the victim sufficiently enough to engage in large financial transactions, such as taking out large loans or making large purchases in the name of the victim. d) Why is identity theft more serious than credit card number theft?

Identity theft can cause victims massive damages because the thieves are able to use the victim’s information to take out large loans. e) How do criminals usually get the information they need for credit card theft and identity theft?

Traditionally, criminals got the information physically, say by copying the credit card account numbers of someone visiting a merchant who has a dishonest employee. Computer credit card and identity theft enables criminals to get information on large numbers of people very quickly.

1–12 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

f) How can companies be harmed if they allow personal information in their control to be stolen?

Companies that allow personal information in their control to be stolen can receive significant backlash from customers and investors. The firms can be subject to government fines, lawsuits, costly audits and regulation, and the possibility of having to fire managers and other key employees. g) What is corporate identity theft?

When someone impersonates a corporation and carries out business transactions in the name of the company.

Competitor Threats Commercial Espionage Denial-of-Service Attacks Test Your Understanding 15. a) Distinguish between public intelligence gathering and trade secret espionage.

Public intelligence gathering takes advantage of publicly available information to get information about a company.

Trade secret espionage consists of obtaining trade secret information that a company takes reasonable measures to protect. b) What must a company do to its trade secrets if it wishes to be able to prosecute people or companies who steal it?

It must take reasonable precautions. c) How strong do those protections have to be?

They must be reasonable. d) Who is likely to engage in espionage against a firm?

Corporate competitors and national governments (see cyberwar).

1–13 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Cyberwar and Cyberterror Cyberwar Cyberterror Test Your Understanding 16. a) Distinguish between cyberwar and cyberterror.

In cyberwar, attacks are made by national governments.

In cyberterror, attacks are made by terrorists. b) How can countries use cyberwar attacks?

Countries can engage in espionage before a war, damaging the enemy’s financial infrastructure, disrupting the enemy’s communication infrastructure, and engaging in propaganda attacks. c) How can terrorists use IT? Terrorists can damage a country’s financial, utilities, and IT infrastructure.

They can recruit members. They can make physical attacks more confusing by damaging the communications infrastructure. They can turn to computer crime to finance their terrorism.

Synopsis Thought Questions 1.

An attacker breaks into a corporate database and deletes critical files. What security goal is this attack focused on?

Integrity—because the information is changed.

Availability—because the information is no longer available to the firm.

2.

How can detective countermeasures act as preventive countermeasures? (The answer is not in the text.)

Detective countermeasures can act as preventive countermeasures by scaring hackers—if they are caught, they can be prosecuted. a) If you accidentally find someone’s password and use it to get into a system, is this hacking? Explain.

Yes, because hacking is intentionally accessing a computer resource without given authorization. Getting a password is not the same as getting authorization. b) Someone sends you a “game.” When you run it, it logs you into an IRS server.

Is this hacking? Explain.

1–14 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

3.

4.

1

No, because it was not intentional. But if you glance around, it will be considered hacking. c) Could you be prosecuted for doing this?

Yes, you run the risk of being prosecuted, but they would have to prove intentionality. d) You have access to your home page on a server. By accident, you discover that if you hit a certain key, you can get into someone else’s files. You spend just a few minutes looking around. Is this hacking? Explain.

Yes, because although it was an unintentional access of information, you intentionally spent a few minutes looking around. Therefore, you were in excess of your authorization.

Addamark Technologies found that its webservers had been accessed without authorization by an employee of competitor Arcsight.1 Arcsight’s vice president for marketing dismissed the hacking, saying, “It’s simply a screen that asked for a username and password. The employee didn’t feel like he did anything illicit.”

The VP went on to say the employee would not be disciplined. Comment on the Arcsight VP’s defense.

Arcsight VP’s defense is weak because the employee intentionally accessed a computer resource without authorization, especially because it was the competitor’s webserver. If a screen asks for a secret password, this indicates that access is not authorized to anyone except those to whom the password is given. On the other hand, one can understand why Arcsight VP said that the employee would not be disciplined—he may have helped their company, even though they could get sued.

Give three examples of social engineering not listed in the text.

Credit Card (by phone): Call random people in the phone book and ask for the given person in the phone book. Say you are Visa or MasterCard, updating their system, and ask them to verify their information, including card number, expiration date, secret number/PIN, full name and address.

Serial Number (by phone): Call someone on campus. Identify yourself as an ITS staff and say that you need to verify the user’s copy of Windows XP, Office, or any other program that may be installed on their computer because there are duplicate serial numbers going around that they need to update for legal purposes. Go through the process of getting into the program, and then clicking through Help and About the Program. After they tell you the serial number for a given program, you can now use it for your own computer at home.

Password (by phone): Call the helpdesk and ask who the manager is that day and how late the manager will be available, then hang up. Call back later when the main manager is out, and tell the student that you are working with “Manager’s Name” to help a user with a password and that

Addamark Technologies, “Even Security Firms at Risk for Break In,” E-week, February 17, 2003.

1–15 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

5.

6.

7.

8.

the user is getting furious and yelling. Say that the user is in the other room, but said to call for the user’s password. The user’s name is John Doe and the username is jdoe. What is the password?

Person pretends to be a tech rep for a base’s IT services. Since he has no badge, he convinces a clueless door guard to escort him to the server room. He then uses the name of the organization’s Communication department head (readily available on the Internet) as justification for the work to be completed. Once inside the server room, he cross-connects an isolated system with a compromised system using a basic cross-connect cable. (This example is based on a true story.)

Reverse social engineering (from the website http://www.securityfocus.com/infocus/1527): “This is when the hacker creates a persona that appears to be in a position of authority so that employees will ask him for information, rather than the other way around.”

Hackers have used online forms wherein they use a phony sweepstakes to get a user’s name, email address, and password. The intent of this tactic is that many users use the same user id and password for many websites, so the information the hacker gets may provide great access, including possibly corporate account information that provides user IDs in the format of the corporate email address. (This tactic found on http://www.securityfocus.com/infocus/1527) Why do you think DDoS attackers use zombies to attack victims instead of sending attack packets directly to victims? Come up with two reasons.

To mask their IP address and MAC address so they will not get caught.

To launch an attack of a greater size with a greater chance of success.

Why would using a script created by a hacker not give you the experience of expert hacking?

You would not have an expert hacker’s knowledge of many attacks to try if one failed, you would not be able to execute sophisticated attacks, and you would not have the dogged persistence needed to succeed.

What do you think are the pros and cons of paying off extortionists?

Pros: If you pay off extortionists, you are usually safe for a short period of time.

Cons: If you pay off extortionists, they may ask for more money once they receive your first payment. They could easily post the critical data anyway, even after they have the money. Also, it promotes extortion.

A competitor goes to your public website and discovers that they can get into a directory that you did not know could be reached. There, they find a list of customers and use the list to their advantage. Have they hacked your webserver?

What problem may you encounter in suing them for the theft of trade secrets?

Yes, they hacked your server by gaining access without authorization.

1–16 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

To sue, you would have to prove that you used reasonable protection to guard the information. If they got in that easily, you may have a difficult time proving reasonable protection.

Hands-on Projects NOTE: Screenshots and IP addresses for individual students will vary.

PROJECT 1 Nmap® is a well-known port scanner that has been around for many years and is available on a variety of operating systems. It has a GUI interface that makes it user-friendly.

Nmap can tell you which operating system a machine is running, which services are available, and can give you a graphical representation of a network. Nmap has long been an industry staple for IT security professionals. **Warning** Remember to scan ONLY your own computers or machines designated by your instructor. Many organizations (corporations, governments, universities, etc.) have intrusion detection systems that will notice these scans. You will set up honeypots and IDSs later and test them with these port scanners.

Note: If you get an error, you can get the latest version of WinPcap from http://www.winpcap.org. Nmap should work correctly after you install WinPcap. You may have to close Nmap to get WinPcap to install correctly. You will need to restart Nmap once you have installed WinPcap.

1. Download Nmap from https://nmap.org.

2. Click on the download link labeled nmap-7.70-setup.exe. (It's likely that a newer version will be available. Download the latest version. Mac and Linux versions are also available further down the page. If you are uncertain which version to get, please ask your instructor.)

3. Click Save.

4. Select your download folder.

5. Browse to your download folder.

6. Double-click nmap-7.70-setup.exe.

7. Click Run, and Run. 8. Click I Agree, Next, Install, and Yes (if you are asked to replace WinPcap).

9. Click Next, Close, Next, Next, and Finish.

10. Click I Agree, Install, and Close.

11. Double-click the Nmap-Zenmap® icon on your desktop.

1–17 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

12. Enter the IP address of another computer on your home network, a classmate's computer (with permission), or a computer designated by your instructor into the Target text box. The IP address used in this example (10.0.1.11) belongs to a computer the author uses on an internal system. Do not scan this IP address. It is nonroutable and won’t return correct results. Ask your instructor for an IP address if you are unsure what to enter as your target.

13. Take a screenshot.

14. In the Profile box select Regular Scan.

15. Press Scan.

16. Take a screenshot after the scan completes.

17. Click on the Ports/Hosts tab.

18. Take a screenshot.

19. Click on the Host Details tab.

20. Take a screenshot.

21. Swap IP addresses with another classmate/friend and scan his or her computer.

22. Take a screenshot.

PROJECT 2 If you are new to the IT security field or just want a more accessible (i.e., less technical) news feed, you might want to read the Security sections of The Register®, eWeek.com®, or Computerworld®. The Register’s Security section gives a good synopsis of some of the more important IT security developments in an easy-to-read format.

1. Open a Web browser and go to www.theregister.co.uk/security/.

2. Click on an article that interests you.

3. Take a screenshot.

4. In the Search box enter “DDoS” and press Enter.

5. Click on an article that interests you.

6. Take a screenshot.

7. Open a web browser and go to www.eweek.com/security..

8. Click on an article that interests you.

9. Take a screenshot.

10. Open a web browser and go to https://thehackernews.com.

11. Click on an article that interests you.

12. Take a screenshot.

13. Open a web browser and go to the dynamic threat map hosted by ThreatCloud here: https://threatmap.checkpoint.com/ThreatPortal/livemap.html.

14. Click on a country that interests you.

15. Take a screenshot.

Project Thought Questions 1. How many ports are there on a computer?

There are 65,535 ports on every computer.

1–18 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

2. What programs (services) run over each port?

Well-known ports run from 0 to 1023. You can find which services run over specific ports by searching for “well known ports” on the Internet.

3. Can hackers use ports to spread malware? How? Yes, certain types of malware are known to access computers through specific ports.

4. How do you close ports that may already be open?

You can remove the program that opened the port, or you can set your firewall to block that specific port.

5. How much time does your employer give you to read about current events related to your job?

Most employers do not want you to spend the day surfing the Internet. IT security professionals need to spend at least one hour reading current events related to IT security.

6. How does reading current news articles help IT security professionals in their daily jobs?

Current news articles can directly impact the daily lives of IT security professionals. News about the spread of a new virus can affect most large organizations, so staying current is critical.

Case Discussion Questions 1. How could the banks mentioned in this case have mitigated or prevented the thefts?

Multiple valid responses can be offered by students. The banks could have kept the information fully encrypted at all times and treated it as if it were subject to PCI-DSS. They could have secured their webservers more thoroughly.

2. How would smart cards be safer than magnetic swipe cards? Why? Yes, smart cards would be much safer because the criminals could not have encoded the data so easily on smart cards. It could have prevented the actual theft of the cash.

3. Why would this type of distributed bank theft be faster and incur larger losses than a traditional strong-arm bank robbery?

Yes, a distributed attack would be much faster because the money could be withdrawn all within a short period of time from seemingly legitimate transactions. Authorities may not be alerted to it for several hours. In an armed bank robbery, the authorities know they are being robbed immediately. The bank robbers are also limited in the amount of money they can carry.

4. Are cybercrime efforts becoming more targeted? Why?

1–19 .

Chapter 1: The Threat Environment Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Yes, targeting cybercrime is much more lucrative for criminals because they can focus their efforts on fewer targets. They draw less attention, can customize the attack, increase the chances of the attack working, and can quickly identify low-risk/high-reward targets.

5. Why are organizations hesitant to report losses related to cybercrime?

Organizations may believe they will be subject to regulatory penalties, be forced to invest in additional expensive security infrastructure, suffer reputational losses, and possibly lose customers if they report data losses.

6. Why are malicious insiders a focus of security experts?

Malicious insiders are uniquely qualified to commit certain types of crimes because they have internal knowledge of the victim’s systems, protocols, and procedures. They are also likely to have better access to vulnerable systems than external attacks. In the case where the internal employee is disgruntled, they may have a unique motive for attacking the corporation.

Perspective Questions 1. What was the most surprising thing for you in this chapter?

Student answers will differ.

2. What was the most difficult thing for you in this chapter?

Student answers will differ.

1–20 .

.

Instructor’s Manual

Chapter 2

Planning and Policy Learning Objectives By the end of this chapter, the student should be able to: ➢ Justify the need for formal management processes. ➢ Describe compliance laws and regulations. ➢ Describe organizational security issues. ➢ Describe risk analysis. ➢ Describe technical security infrastructure. ➢ Explain policy-driven implementation. ➢ Know governance frameworks.

Teaching Suggestions Special Issues This is a longer chapter than the others and may require additional time to cover it adequately.

Role in the Book Chapter 1 surveyed the security threats that corporations face today. Chapter 2 and the remaining chapters deal with the management of defenses against these and future threats.

.

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

The book is organized around the plan-protect-respond cycle for security management. Chapter 2 introduces the plan-protect-respond cycle and discusses the planning phase of the cycle.

Teaching the Material Flow of Material ➢ The chapter begins with a broad look at security management. This section discusses why management is difficult to think about, the need for comprehensive security, weakest link failures, and the plan-protect-respond cycle that will dominate this book and that also dominates practical IT security. It also talks about vision in planning and strategic IT security planning.

➢ The chapter then discusses the most fundamental management decisions regarding how to organize the IT security function. A key theme is maintaining independence for IT security, because it is difficult to accuse one’s boss of security violations. ➢ The next section, on risk analysis, is absolutely central to network management. The concept of risk management should be emphasized throughout the course. ➢ Next comes planning the technical security architecture—the mix of tools a company can use to plan its technical aspects of security. This section covers topics that come up frequently in security technology planning, including defense in depth, single points of vulnerability, the need to minimize security burdens, and having realistic goals. ➢ IT security planning and execution is driven by policies that give high-level directives for how security should be implemented. Policy-based thinking permeates IT security, this book, and almost any IT security course. It is crucial to have students understand policy-based implementation backwards and forwards. Although implementers need freedom to select the best way to implement specific policies, 2–2 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

given current technologies and products, additional implementation guidance is needed to restrict implementer discretion through guidelines, standards, procedures, processes, baselines, and other methods. Policies also govern the oversight needed to keep the security process on target. ➢ To avoid reinventing the wheel in IT security, many companies use one or more IT governance frameworks to guide them in what to do and how to do it. The final section looks through these frameworks. Each framework adds something to the picture, but no framework does everything.

Covering the Material Quite simply, this chapter covers a great deal and requires a great deal of lecture time. It is important to keep students from getting lost in the details by putting up posters of general frameworks, such as the policy-based information field, and frequently helping students keep abreast of where they are in the framework.

Much of the material is dry, and students can read much of the material without difficulty. This means that you can jump over the obvious stuff and spend more time on the more difficult and important stuff. For instance, focus on why security metrics are important, what auditing means, the surprising importance of anonymous protected hotlines, why behavioral cues often predate security violations, why vulnerability tests are dangerous, and specific types of sanctions. Explain a concept and then have students tell you why it is important.

For the discussion of policies, have students bring security policies from their university and other sources and have them discuss why each section is in it to see if they can spot anything missing. Typically, they only have access to the university’s acceptable use policy, which is oriented toward users. If you can get other policies from other firms, that would be good.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master. Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report. The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report.

Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

2–3 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key

Introduction Defense 1.

a) Why does the book focus on defense instead of offense?

This book focuses on defense rather than offense because after students master the principles and practices of defense well, a detailed understanding of attacks will help them very much. Also, this book is preparing students for their real job, which is security defense. b) Can IT Security be too secure? How? Yes, if security is too strict, rigid, or time consuming, it may reduce an organization's effectiveness. For example, if all staff computers were set to automatically lock after 2 minutes of inactivity, it could lead to widespread frustration. Users would also spend considerable amounts of time continually logging in. Even worse, they might look for ways around the new security measures.

Management Processes 2.

a) For what reasons is security management hard?

Security management is hard and abstract. You cannot show pictures of devices or talk in terms of detailed concepts or software algorithms. There are fewer general principles to discuss, and most of these principles cannot be put into practice without well-defined and complex processes. b) What is comprehensive security, and why is it needed?

Comprehensive security is comprised of closing all routes of attack into an organization’s systems from attackers. Comprehensive security is needed because attackers constantly look for one or more weaknesses that can provide initial system access and lead to greater control of system resources.

Companies must understand all of their possible vulnerabilities because this is exactly what hackers are doing to determine the best course of action to attack a system. c) What are weakest-link failures?

Weakest-link failures occur when a single security element failure defeats the overall security of a system.

2–4 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

The Need for a Disciplined Security Management Process 3.

a) Why are processes necessary in security management?

Security is too complicated to be managed informally. Companies must develop and follow formal processes (planned series of actions) in security management. b) What is driving firms to use formal governance frameworks to guide their security processes?

One external factor that is motivating firms to formalize their security processes is a growing number of compliance laws and regulations. Many compliance regimes require firms to adopt a specific formal governance framework to drive security planning and operational management.

The Plan–Protect–Respond Cycle 4.

a) List the three stages in the plan-protect-respond cycle.

Planning, protection, and response b) Is there a sequential flow between the stages?

No. They interact constantly. c) What stage consumes the most time?

Protection d) How does this book define protection?

Protection is defined as the plan-based creation of operation and countermeasures. e) How does the book define response?

Response is defined as recovery according to plan.

Vision in Planning 5.

a) How can good security be an enabler?

Good security provides not only a sense of confidence in network reliability, but can allow safe and effective implementation of progressive business tactics, such as inter-organizational system connectivity. By having good security, firms can innovate their business practices without having to incur a significant material risk. b) What is the key to being an enabler?

The key to being an enabler in security is getting involved early within the project. c) Why is a negative view of users bad?

Viewing users as the enemy is corrosive. Users often are the first to see security problems, and if they feel that they are part of the security team, they can give early warnings to the security staff. Also, users need to be trained in

2–5 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

security self defense so that they can protect their own assets from threats. If “stupid” means “poorly trained,” this is the security department’s fault. d) Why is viewing the security function as a police force or military organization a bad idea?

Police and military organizations are often considered oppressive in enforcing their policies. Creating a police-like security atmosphere relies upon fear of internal reprisal when enforcing policy, versus fostering a proactive partnership between employees and security personnel to protect the organization from the real bad guys who seek to harm everyone in the firm.

Strategic IT Security Planning 6.

a) In developing an IT security plan, what should a company do first?

It must first assess the current state of its security. b) What are the major categories of driving forces that a company must consider for the future?

A company must consider the threat environment, the growth of compliance laws and regulations, changes in the corporate structure, mergers, and anything else that will change things in the future. c) What should the company do for each resource?

Once company resources are enumerated, they must be classified in terms of sensitivity. Not all resources are equally important, and with limited budgets, one must be able to prioritize. d) For what should a company develop remediation plans?

A company should develop remediation plans for all security gaps and for every resource, unless it is well protected. e) How should the IT security staff view its list of possible remediation plans as a portfolio?

By viewing the list of possible remediation plans as a portfolio, security staff can assess which remediation plans should get funding and action first, and which projects will provide the greatest gains in security based on the investment.

Compliance Laws and Regulations Driving Forces 7.

a) What are driving forces?

Driving forces are things that require a firm to change its security planning, protections, and response. b) What do compliance laws do?

2–6 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Compliance laws and regulations create requirements to which security must respond. In many cases, without compliance laws, many companies would not spend the time or effort to address serious security issues.

These create requirements to which security must respond. c) Why can compliance laws and regulations be expensive for IT security?

Because some firms need to improve their security to be in compliance with security laws and regulations, these improvements can be very expensive.

Sarbanes–Oxley 8.

a) In Sarbanes-Oxley, what is a material control deficiency?

It is a material deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement in the annual or interim financial statements will not be prevented or detected. b) Why was Sarbanes-Oxley important for IT security?

Under Sarbanes-Oxley, companies have had to take a detailed look at their financial reporting processes. In doing so, they’ve uncovered many security weaknesses and, in many cases, realized that these security weaknesses extended to other parts of the firm. Given the importance of Sarbanes-Oxley compliance, most firms have been forced to increase their security efforts.

Privacy Protection Laws 9.

a) What have privacy protection laws forced companies to do?

These laws have forced companies to look at how they protect personal information, including where this information is stored and how they control access to it. b) What did they find when they did so?

In many cases, they have discovered that this information is stored in many places, including word processing documents and spreadsheets. They also discovered that access controls and other protections are either weak or nonexistent. c) What institutions are subject to the Gramm-Leach-Bliley Act? The GLBA specifically addresses strong data protection requirements at financial institutions. d) What institutions are subject to HIPAA? Healthcare organizations.

Data Breach Notification Laws 10.

a) What do data breach notification laws require?

These laws require companies to notify affected people if sensitive, personally identifiable information is stolen or even lost.

2–7 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

b) Why has this caused companies to think more about security?

The repercussions of data breaches have companies rethinking security. Loss of personal data can be extensive, which can lead to large government penalties, damaged reputations, and expensive lawsuits.

The Federal Trade Commission 11.

a) When can the Federal Trade Commission act against companies?

The FTC can act against companies that fail to take reasonable precautions to protect privacy information. b) What financial burdens can the FTC place on companies that fail to take reasonable precautions to protect private information?

The FTC can impose hefty fines on firms and has the power to require that firms pay to be audited annually by an external firm for many years, and to be responsive to these audits.

Industry Accreditation 12.

Besides HIPAA, what external compliance rules must hospitals consider when planning their security?

Hospitals must comply with all other external compliance rules that apply to other businesses that perform similar functions or transactions. For example, hospitals that process credit cards for payment must meet PCI-DSS standards, physical security requirements that come with treating prisoners, etc.

PCI–DSS 13.

What companies does PCI-DSS affect?

All companies that accept credit card payments are subject to PCI-DSS.

FISMA 14.

a) Who is subject to FISMA? Organizations subject to FISMA include all information systems used or operated by a U.S. Federal Government agency or a contractor or any other organization on behalf of a U.S. Government agency. b) Distinguish between certification and accreditation in FISMA. Certification in FISMA is certification of the organization itself or by an outside party. Once the system is certified, the organization’s IT security is reviewed by an accrediting official. If the official is satisfied with the certification, the accrediting official will issue an authorization to operate (ATO). c) Why has FISMA been criticized?

2–8 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

FISMA has been criticized heavily for focusing on documentation rather than protection.

Organization Chief Security Officers (CSOs) 15.

a) What is the manager of the security department usually called?

Chief security officer (CSO) b) What is another title for this person?

Chief information security officer (CISO)

Should You Place Security within IT? 16.

a) What are the advantages of placing security within IT? One advantage of placing security within IT is that it is attractive because security and IT possess many of the same qualities and technological skills.

Another advantage would be the centralizing of security and IT under the CIO. The CIO would have IT implement security and is likely to back the security department in its effort to create a strong and safe information system for the organization. b) What are the disadvantages of placing security within IT? The disadvantage of placing security within IT is that security has no independence from IT and it is hard to blow the whistle on security issues occurring within the IT department or by the CIO. Having security reside in the IT department creates a situation wherein no one is watching the watchers (who are also the implementers). c) What do most IT security analysts recommend about placing or not placing IT security within IT? Most IT security analysts recommend placing IT security functions outside of the IT department. d) How are security roles allocated in the hybrid solution to placing IT security inside or outside of the IT department?

In the hybrid solution of IT security, the IT department is given the operational aspects such as maintaining firewalls, while planning, policymaking, and auditing functions are placed outside of IT.

Top Management Support 17.

a) Why is top management support important?

2–9 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Top management support is important because few efforts as pervasive as IT security succeed unless top management gives strong and consistent support.

The proof of top management support comes in subsequent actions. b) What three things must top management do to demonstrate support?

In order to demonstrate support, top management must ensure that security has an adequate budget, supports security when there are conflicts between the needs of security and the needs of other business functions, and follows security procedures themselves.

Relationships with Other Departments 18.

a) Why is the human resources department important to IT security?

HR is important to IT security because this department is responsible for the hiring and training of employees in security, which makes this process very critical. IT security must work with HR in hiring and terminating to ensure that security issues are taken into account. b) Distinguish between the three main types of corporate auditing units.

Internal auditing: examines organizational units for efficiency, effectiveness, and adequate controls.

Financial auditing: examines financial processes for efficiency, effectiveness, and adequate controls.

IT auditing: examines IT processes for efficiency, effectiveness, and adequate controls. c) What is the advantage of placing IT security auditing in one of these three auditing departments?

The advantage is that it will bring more independence to security auditing. It will allow IT security auditing to blow the whistle on the IT security department or CSO if necessary. d) What relationships can the IT security have to the corporation’s uniformed security staff?

The company’s uniformed security staff will execute policies regarding building access. The uniformed security staff is also needed to seize computers that IT security finds to be involved in financial crime or abuse. In the other direction, IT security can help uniformed security with surveillance cameras and the forensics analysis of equipment that may have been used to commit a crime. e) What can the security staff do to get along better with other departments in the firm?

To get along with other departments, security should combine policies with financial benefits analyses and realistic business impact statements. f) What are business partners?

2–10 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Business partners include buyer organizations, customer organizations, service organizations, and even competitors. g) Why are they dangerous?

Business partners are dangerous because they’re often granted access to resources within your firm. h) What is due diligence?

Due diligence entails investigating the IT security of external companies and the implications of close IT partnerships before implementing interconnectivity.

Outsourcing IT Security 19.

a) What is an MSSP? It is a managed security service provider. It is an outsourced alternative for delegating controls. b) What are the two main benefits of using an MSSP? One benefit of using an MSSP is that they have expertise and practice-based knowledge. Another benefit is that they have complete independence from the IT security department. c) Why are MSSPs likely to do a better job than IT security department employees?

If the MSSP is doing its job, it will examine several hundred suspicious events each day. It will quickly identify most as obvious false positives. Still others will be classified as negligible threats, such as minor scanning attacks. On a typical day, only one or two potentially serious threats may be brought to the attention of the client via pager or e-mail alerts, depending on their potential severity. By distilling the flood of suspicious incidents into a handful of important events requiring client action each day, MSSPs free the security staff to work on other matters. d) What security functions typically are outsourced?

Intrusion detection and vulnerability testing e) What security functions usually are not outsourced?

Policy and planning f) What should a firm look for when selecting an MSSP? The firm should look at the contract with the outsourcing firm to see if the MSSP scans log files daily or otherwise according to contract. The firm should also see if the MSSP is sending alerts about the company’s security.

2–11 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Risk Analysis Reasonable Risk 20.

a) Why is information assurance a poor name for IT security?

This is a poor name because it is never possible to eliminate risks and completely assure information. b) Why is reasonable risk the goal of IT security?

Reasonable risk is the goal of IT security because not only is it technically impossible to protect against all current and future risk, but if you could, the comprehensive security protections would be prohibitively expensive and most likely impede some functionality that is necessary for business operations. c) What are some negative consequences of IT security?

Most obviously, security tends to impede functionality. Living in a highsecurity environment is always unpleasant and is usually inefficient. If you live in a quiet and safe neighborhood, putting bars on your windows would create a lock-down feeling, and requiring you to remember a long password to get into your house would slow you down every time you went into your house. Besides these psychic and productivity costs, security is never free and seldom cheap. Security devices are expensive, and the labor to implement and operate them is far more expensive.

Classic Risk Analysis Calculations 21.

22.

a) Why do we annualize costs and benefits in risk analysis computations?

To see if countermeasures will alter the likelihood of losses or decide whether countermeasures produce benefits that exceed costs. b) How do you compute the ALE? The ALE is calculated by multiplying the single loss expectancy value by the annualized probability of occurrence.

An asset has a value of $1,000,000. In an attack, it is expected to lose 60 percent of its value. An attack is expected to be successful once every ten years. Countermeasure X will cut the amount lost per incident by two-thirds. Counter measure Y will cut the frequency of successful attack in half. Countermeasure X will cost $30,000 per year, while Countermeasure Y will cost $5,000 per year. Do an analysis of these countermeasures and then give your recommendation for which to select (if any).

The analysis is shown below. Countermeasure Y should be implemented. It reduces expected damage less than Countermeasure X but costs much less than Countermeasure X. While Countermeasure X is expected to save $20,000 per year, Countermeasure Y is expected to save $25,000.

Base Case

2–12 .

Countermeasure

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

X

Y

Asset Value

AV

$1,000,000

$1,000,000

$1,000,000

Exposure Factor

EF

60%

20%

60%

Single Loss Expectancy

SLE

$600,000

$200,000

$600,000

Annualized Rate of Occurrence

ARO

10%

10%

5%

Annualized Loss Expectancy

ALE

$60,000

$10,000

$30,000

ALE Reduction for Countermeasure

--

NA

$50,000

$30,000

Annualized Countermeasure Cost Annualized Net Countermeasure Value

--

NA

$30,000

$5,000

--

NA

$20,000

$25,000

Problems with Classic Risk Analysis Calculations 23.

a) Why is it a problem if benefits and costs both occur over several years?

When there are uneven cash flows over a number of years, decision makers turn to discounted cash flow analysis, also called return on investment (ROI) analysis. This requires either the computation of net present value (NPV) or internal rate of return (IRR). b) Why should the total cost of an incident (TCI) be used in place of exposure factors and asset values?

TCI should be used because it gives a better estimate of the complete cost of a compromise, including the cost of repairs, lawsuits, and other factors. The problem is coming up with a realistic value for TCI. c) Why is it not possible to use classic risk analysis calculations for firewalls?

Classical risk analysis assumes a one-to-one relationship between countermeasures and threats. However, reality is that many countermeasures address many threats, such as the firewall, which protects both servers and clients. d) What is the worst problem with the classic approach?

The worst problem with the classic approach is that it is rarely possible to estimate the annualized rate of occurrence for threats. e) Why is hard-headed thinking about security ROI dangerous?

Hard-headed thinking, based upon ROI estimates for security implementation, is dangerous because the risks from having poor security are complex and somewhat implicit. As described above, whether using classical risk analysis calculations or improved TCI values, it is incredibly hard to calculate the damage a significant breach can have on a company (from minimal to catastrophic). In reality, one can mostly calculate the cost of a compromise after the fallout is through, which could take years, and even then, there are implicit effects that are hard to quantify (e.g., reputation damage).

2–13 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Responding to Risk 24.

a) What are the four ways of responding to risk?

Risk reduction: Adopt active countermeasures.

Risk acceptance: Used when the impact is small and cost of countermeasure is prohibitive.

Risk transference: Use insurance to have someone else absorb the risk.

Risk avoidance: Don’t take actions that are risky. b) Which involves doing nothing?

Risk acceptance c) Which involves insurance?

Risk transference involves insurance. d) Why is insurance not a way to not deal with security protections?

Insurance is not a complete way to deal with security because insurance companies often require customers to install reasonable countermeasures before they provide coverage. Also, insurance companies will give higher deductibles if a firm’s protections are inadequate. e) What is risk avoidance?

Risk avoidance is not taking the action that is risky. f) Why does risk avoidance not endear IT security to the rest of the firm?

Risk avoidance does not endear IT security to the rest of the firm because even though it is a good viewpoint, it means a company has to forego an innovation that would be attractive had security problems not gotten rid of it.

The Technical Security Architecture Technical Security Architectures 25.

a) What is a firm’s technical security architecture?

It will include all of a company’s technical countermeasures—including firewalls, hardened hosts, intrusion detection systems, and other tools—and how these countermeasures are organized into a complete system of protection. b) Why is a technical security architecture needed?

Without a technical security architecture, companies will not be able to create a comprehensive wall with no holes for attackers to walk through. c) When is the best time to create one?

Before a company begins to create individual countermeasures d) Why do firms not simply replace their legacy security technologies immediately?

2–14 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

No company can afford to replace its legacy security technologies all at once; replacement must be tiered based on risk analysis.

Principles 26.

a) Why is defense in depth important?

Defense in depth is important because every security measure has occasional vulnerabilities; while a vulnerability in one countermeasure is being fixed (or you are unaware of it), the others in the line of defense will remain effective to repel attacks. b) Distinguish between defense in depth and weakest-link problems.

Defense in depth requires multiple countermeasures to be defeated for an attack to succeed.

Weakest-link analysis is a single countermeasure composed of multiple interdependent components in series that require all components to succeed if the countermeasure is to succeed. c) Why are central security management consoles dangerous?

They are dangerous because they create a single point of vulnerability—an element of the architecture at which an attacker can do a great deal of damage by compromising a single system. d) Why are they desirable?

Any security architecture whose devices are not controlled centrally might implement inconsistent policies, and many actions taken to thwart an ongoing attack require a systemic response that can work only through a central point of control. e) Why is it important to minimize the burdens that security places on functional units in the firm?

It is important to do this because to some extent, security almost always reduces productivity and may slow down the pace of innovation by requiring that security issues be addressed before innovations are rolled out. Minimizing security burdens can avoid these losses.

It can also reduce resistance to security. f) Why do you think it is important to have realistic goals for reducing vulnerabilities?

It is impossible to eliminate all security threats immediately. Having realistic goals will allow a company to focus on the most critical threats.

Elements of a Technical Security Architecture 27.

a) Why is border management important?

To stop or at least reduce external attacks b) Why isn’t it a complete security solution?

2–15 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

First, many attackers are inside the firm, and border firewalls do nothing to stop them.

Second, there are many ways for attackers to break through border firewalls and to avoid border firewalls, such as by coming in through an unsecured access point and entering the network directly without passing through the border firewall. c) Why are remote connections from home especially dangerous?

Individual employees working from their homes and hotel rooms represent a special problem, especially when employees put personal software on their remote access computers. In fact, they often use their own home computers to access corporate sites. The general lack of security discipline among home users can be mitigated by the management of remote access technology. d) Why are interorganizational systems dangerous?

These are dangerous because in interorganizational systems two companies link some of their IT assets. In interorganizational systems, neither organization can directly enforce security in the other. In fact, they often cannot even learn the details of security in the other company. e) Why is central security management attractive?

It is able to manage security technologies from a single security management console or at least from relatively few security management consoles that each manages a cluster of security technologies. Centralized security management enforces policies directly on a firm’s devices, bringing consistency to security.

It also lowers the cost of security management by reducing travel, and allows security management actions to affect devices immediately.

Policy-Driven Implementation Policies 28.

a) What are policies?

Policies are statements of what should be done under specific circumstances. b) Distinguish between policies and implementation.

Policies are statements of what should be done; implementation describes the actions that are taken to place the policy guidance into operation. c) Why should policies not specify implementation in detail?

Policies set goals and vision, but they should not wrongly constrain future implementation changes as conditions change (such as technology improvements).

2–16 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Categories of Security Policies 29.

a) Distinguish between the corporate security policy and major security policies.

The goal of corporate security policy is to emphasize a firm’s commitment to strong security, and it is brief and to the point. Major security policies are specific policies about major concerns and are more detailed than corporate security policies. b) Distinguish between major security policies and the acceptable use policies.

Major security policies are very detailed and provide guidance to various stakeholders on required or recommended actions. Acceptable use policies provide users with a summary of the key points of various major security policies. c) What are the purposes of requiring users to sign the AUP? The signing provides legal protection so that the user cannot say that he or she never knew company policies. Of equal importance, signing creates a sense of ceremony that is memorable. Required signing also emphasizes the company’s commitment to IT security. d) Why are policies for individual countermeasures and resources needed?

Policies for individual countermeasures and resources are needed because major policies are not sufficiently detailed to cover the requirements of a single countermeasure, such as a firewall. The major policies should provide the guidance, while the individual policies describe in detail the implementation of the major policies.

Policy-Writing Teams 30.

Why is it important to have corporate teams write policies?

Policies written by corporate teams carry much more weight with employees than policies written only by IT security. They are also more likely to be effective because they are not based on IT security’s limited viewpoint.

Implementation Guidance 31.

a) Distinguish between standards and guidelines.

Standards are mandatory implementation guidance, while guidelines are discretionary. b) For guidelines, what is mandatory?

It is mandatory for decision makers to consider guidelines. c) When are guidelines appropriate?

Guidelines are appropriate in complex and uncertain situations for which rigid standards cannot be specified.

2–17 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Types of Implementation Guidance 32.

a) Distinguish between procedures and processes.

Procedures specify the low-level detailed actions that must be taken by specific employees. Processes are high-level descriptions of what should be done. b) When would each be used?

Procedures are used to steer a well-defined action, such as the steps required to issue a new employee a password. Processes are used to provide high-level descriptions of what should be done, such as the process of nominating a new product for development. c) What is segregation of duties, and what is its purpose?

Segregation of duties requires two or more people to complete a specific act.

This prevents one person from acting alone to do harm. d) When someone requests to take an action that is potentially dangerous, what protections should be put into place?

Limit the number of people who can request an approval.

Limit the number of people who can approve such actions even more.

Ensure the person who approves is not the same as the requestor. e) Why is it important to enforce mandatory vacations or job rotation?

It is important to enforce mandatory vacations or job rotations because they create a period under which a person cannot take an action, such as implementing an unapproved practice. f) How do guidelines differ from procedures and processes?

Baselines are checklists of what must be done. Procedures and processes specify how things should be done. g) Distinguish between best practices and recommended practices.

Best practices are descriptions of what the best firms in the industry are doing about security. Recommended practices are prescriptive statements about what companies should do and are put together by trade associations and government agencies. h) Distinguish between resource owners and trustees in terms of accountability.

Owners are accountable for a resource or control. Trustees are delegated the responsibility to implement a resource or control, but are ultimately not held accountable. i) What can the owner delegate to the trustee?

The owner can delegate the work of implementation of a resource or control to a trustee. j) What can the owner not delegate to the trustee?

The accountability for the resource cannot be delegated to the trustee.

2–18 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

33.

a) Why is ethics unpredictable?

Ethics is unpredictable because different people of good will can make different ethical decisions in the same situation. b) Why do companies create codes of ethics?

Companies create codes of ethics in order to make ethical decision making more predictable. c) Why is good ethics important in a firm?

It is important to have good ethics in a firm because good corporations with poor security are poor places to work, and because any lapse in ethics can severely damage a firm’s reputation, which can lead to lost sales and profits. d) To whom do codes of ethics apply?

Codes of ethics apply to everyone, including part-time employees and senior managers. e) Do senior officers often get an additional code of ethics?

Yes. Most firms have additional codes of ethics for corporate boards and officers. f) If an employee has an ethical concern, what must he or she do?

If an employee has an ethical concern, he or she must discuss it with his or her superior or the corporate ethics officers. g) What must an employee do if he or she observes unethical behavior?

If an employee observes unethical behavior, he or she must report it to the corporate ethics officer or to the firm’s audit committee. h) What examples of conflicts of interest were given?

The examples given were preferential dealings with relatives, investing in competitors, and competing with the company while still employed by the company. i) Why are bribes and kickbacks bad?

Bribes and kickbacks are bad because the perpetrator is likely to act against his or her firm’s best interest in order to benefit personally. j) Distinguish between bribes and kickbacks.

Bribes are monetary gifts to induce an employee to favor a supplier or other party.

Kickbacks are payments made by a supplier to a corporate buyer when a purchase is made. k) What types of information should an employee not reveal?

An employee should never divulge confidential information, private information, or trade secrets.

Exception Handling 34.

a) Why shouldn’t exceptions be absolutely forbidden?

2–19 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Exceptions are almost always necessary. While they should be minimized, they should not be absolutely forbidden. b) Why is implementation guidance for exception handling necessary?

The implementation of guidance for exception handling is critical because exceptions are inevitable but dangerous, so they must be tightly controlled and documented. c) What are the first three rules for exceptions?

Only some people should be allowed to request exceptions.

Even fewer people should be allowed to authorize exceptions.

The requestor and approver should be different people. d) Why would documentation and periodic auditing be important?

The exception must be carefully documented in terms of specifically what was done and who did each action. Without proper documentation, it would be impossible to accurately identify who made the exception. Exceptions above a particular danger level should be brought to the attention of the IT security department and the authorizer’s direct manager. e) What is an example of a dangerous exception that would need to be reported to a manager?

An example of a dangerous exception would be a person approving his or her own budget or expenditures without oversight.

Oversight 35.

a) What is oversight?

Oversight is a term for a group of tools for policy enforcement. b) How is oversight related to policy?

Policy drives oversight. Those involved in oversight must develop oversight plans based upon specific policies. c) What is promulgation?

Promulgation is telling affected parties about policies underscoring the vision behind specific policies. d) What is stinging employees?

Stinging employees is setting them up with the opportunity to follow or fail a policy and see what they do. e) What are its costs and benefits?

The benefits of stinging employees are that it raises awareness and it can be used as a ploy to increase IT security awareness training money. If specific stings are repeated annually, they can also be used to indicate positive trends.

Stings can create resentment if not handled well. They can also sometimes be seen as punishment instead of teaching. f) Is electronic employee monitoring widely done?

2–20 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

36.

37.

Yes. g) What should you tell employees before you begin monitoring?

Why it is being done. h) What are security metrics?

Security metrics are measurable indicators of security success. i) Why is periodic measurement beneficial?

Periodic measurement is beneficial because it indicates whether a company is doing better or worse in implementing its policies. a) What is the purpose of auditing?

The purpose of auditing is to develop opinions on the health of controls, not to find punishable instances of noncompliance. b) Distinguish between log files and documentation.

Log files are information recorded in database form, and documentation is information recorded on forms or memos. c) Why is the avoidance of compliance a serious red flag?

The avoidance of compliance indicates a deliberate circumvention of security, which is dangerous. d) Distinguish between internal and external auditing.

Internal audits are done by an organization on itself; external audits are done by an outside firm. e) Why is regularly scheduled auditing good?

Periodic auditing is good because it allows a company to compare results over time. f) Why are unscheduled audits done?

Unscheduled audits are done to try to identify those who are avoiding security without tipping them off of an upcoming audit. a) Why should companies install anonymous protected hotlines?

Companies should install anonymous protected hotlines because oftentimes a coworker is the first person to discover a security violation. Anonymous protected hotlines help to minimize the fear of reprisal amongst informers. b) Why are anonymity and protection against reprisals importance when hotlines are used?

This is important because some employees may be reluctant to speak for fear of reprisals. When there is an anonymous hotline for people to call, and by guaranteeing protection against reprisals, companies can maximize participation from employees. c) Why should general employee misbehavior be a concern?

General employee misbehavior should be taken as a red flag because in many cases of serious security violations, the perpetrator had a history of unacceptable overt behavior.

2–21 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

38.

d) What are the three elements in the fraud and abuse triangle?

Opportunity, pressure, and rationalization e) Give an example of pressure not discussed in the text.

An example of pressure not discussed in the text is peer pressure. An employee may be pressured by fellow employees to bypass security in order to accomplish a team goal.

There is also the pressure of revenge. Getting back at a company for employee mistreatment is often a pressure employees can face after committing misbehavior. f) Why are rationalizations important?

Rationalizations are important because people do not like to take actions when they consider the actions as bad, making them bad people. They need to rationalize a way to retain their sense of doing the right thing even when it isn’t. g) Give two examples of rationalization not given in the text.

An employee takes customer PII home to work on it in a nonsecure environment because the work environment is too slow or restrictive to get the job done, and the company would rather have the work done sooner than later.

An employee violates a security policy (such as the use of thumb drives) because the company’s alternative is not convenient. Again, violating the rule will save the company time and money, as long as nothing happens.

An employee can rationalize that a risky action was done before so it can be done again. A related rationalization is that an employee will think that because everyone else is doing it, it’s okay for them to do it. a) What is a vulnerability test?

Vulnerability testing is done to attack the system yourself to see if you can find vulnerabilities before attackers do. b) Why should you never engage in a vulnerability test without a signed contract?

Because vulnerability attacks look exactly like actual attacks, even if vulnerability testing is in a person’s list of written responsibilities, uncontracted vulnerability tests can easily get an IT security professional fired or worse. An attack is still an attack, no matter what the label. c) What should be in the contract?

The contract should specify what will be done in detail and when it will be done. It must also hold the internal vulnerability blameless if such damage occurs. d) What should you look for in an external vulnerability testing company?

You should look for expertise, experience, and insurance against possible damage. e) Why is follow-up needed on recommended fixes?

It is needed to confirm that the fixes were made.

2–22 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

39.

Why is it important to sanction violators?

If violators are not sanctioned, there is no consequence to violating security protocols, and protocols will not be followed by employees.

Federal Surveillance Laws 40.

a) How can federal surveillance affect individuals and organizations?

Laws that govern the monitoring and surveillance of individuals and organizations by the U.S. government can affect new product innovation, new market entrants, competition among existing firms, international trade, and so on. Legislators struggle to find a balance between ensuring a safe society and providing enough freedom to encourage innovation. b) How does Katz v. United States affect data and information systems?

Katz v. United States applied the Fourth Amendment to the U.S. Constitution—unreasonable searches and seizures—to both physical searches and electronic surveillance. This protects data and information as private requiring additional measures to be taken by law enforcement to obtain them. c) What surveillance powers do FISA, CALEA, and USA Freedom Act give the U.S. federal government?

Foreign Intelligence Surveillance Act (FISA) allows law enforcement to engage in surveillance activities for 1 year without a warrant if the person is a foreign agent, foreign power, or American citizen engaged in espionage.

Communications Assistance for Law Enforcement Act (CALEA) required telecommunications companies to install telephone switches that have wiretapping capabilities and are able to be directly accessed by federal law enforcement agencies.

USA Freedom Act (2015) was enacted as a replacement for the Protect America Act (2007) which allowed federal agencies to monitor U.S. citizens’ international communications without a warrant. The new act was supposed to stop the collection of metadata by the NSA, but it still allowed for collection of metadata by phone companies, which was then accessible by the NSA. The act was also supposed to allow tech companies like Google, Apple, and Microsoft to talk about information sharing agreements with government agencies. Prior to the passage of the USA Freedom Act they were unable to do so.

Governance Frameworks 41.

a) What is a governance framework?

2–23 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

A governance framework specifies how to do planning, implementation, and oversight. b) Compare the focus of COSO with that of COBIT. COSO focuses on corporate-level governance.

COBIT focuses on IT governance. c) Compare the focus of COBIT with that of the ISO/IEC 27000 family of standards.

COBIT focuses broadly on the governance of the IT function. The ISO/EIC 27000 family of standards focuses specifically and in detail on IT security.

COSO 42.

a) What are the four objectives of COSO? Strategic, Operations, Reporting, and Compliance b) List COSO’s eight components.

Internal environment, Objective setting, Event identification, Risk assessment, Risk response, Control activities, Information and communication, and Monitoring. c) What is the control activity, and why is it important?

Control activities are the establishment and implementation of the company’s policies and procedures to help ensure risk responses are effectively carried out. If control activities are weak, all other control elements are unlikely to be ineffective.

COBIT 43.

a) Distinguish between the focuses of COSO and COBIT. Where COSO is a general control planning and assessment tool for corporations, COBIT provides a more specific framework for IT governance. b) List the four COBIT domains.

Planning & organization; acquisition & implementation; delivery & support; and monitoring. c) How many high-level control objectives does COBIT have?

34 d) How many detailed control objectives does COBIT have?

More than 300 e) Why is COBIT strongly preferred by U.S. IT auditors?

COBIT is strongly preferred by U.S. IT auditors because it was created by the ISACA, the primary professional association for IT auditors in the United States.

2–24 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

The ISO/IEC 27000 Family 44.

a) In the 27000 standards family, what is the function of ISO/IEC 27001?

ISO/IEC 27001 specifies how to certify organizations as being compliant with the ISO/IEC 27002. This is important because COSO and COBIT are selfcertifying, which can be biased. b) In the 27000 standards family, what is the function of ISO/IEC 27002?

To specify what should be done to provide protection. c) List the 14 broad areas in 27002.

Information security policies Organization of information security Asset management Human resource security Physical and environmental security Operation security Communications and operations management Access control Cryptography Information systems acquisition, development, and maintenance Supplier relationships Information security incident management Information security aspects of business continuity managementCompliance d) Why is ISO/IEC 27000 certification more attractive to firms than COSO or COBIT certification?

ISO/IEC 27000 is more attractive to firms than COSO or COBIT because 27000 certification is conducted by third-party certifiers, which external parties (companies, in general) value highly.

Conclusion Synopsis Thought Questions 1.

List the 12 PCI-DSS control objectives. You will have to look this up on the Internet.

1: Install and maintain a firewall configuration to protect cardholder data 2: Do not use vendor-supplied defaults for system passwords and other security parameters

2–25 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

2.

3.

3: Protect stored cardholder data 4: Encrypt transmission of cardholder data across open, public networks 5: Use and regularly update anti-virus software 6: Develop and maintain secure systems and applications 7: Restrict access to cardholder data by business need-to-know 8: Assign a unique ID to each person with computer access 9: Restrict physical access to cardholder data 10: Track and monitor all access to network resources and cardholder data 11: Regularly test security systems and processes 12: Maintain a policy that addresses information security The chapter discussed three ways to view the IT security function—as a police force, as a military organization, and as a loving mother. Name another view and describe why it is good.

Another view for IT security is that of a family practice doctor. In this view, IT security makes sure that all aspects of a company’s security health are addressed via preventative care policies, inoculations (countermeasures) and, when required, medicine or surgery (response). The doctor advises against corporate network promiscuity and dangerous behavior in general, but can prescribe preventative measures to reduce the risk of infection when the temptation of innovation and collaboration is too overwhelming to “just say no.” When a company’s computer resources do become ill, the IT security doctor takes the necessary steps to address the cause of the problem and assigns rehabilitation methods to get the patient back to full operational strength. By ensuring overall health of the company from the IT security perspective, the doctor enables a stronger and more efficient and effective organization.

Or one could view the IT security function like that of a priest. Instead of hating the enemy or looking at them with a jaundiced eye, look at the enemy like your “brother”. Or view the whole situation as turning evil into good or providing positive for all to follow. Also, it can be seen as educating the user and ultimately giving them the choice to chose. The whole idea should be approached before this whole fact.

A company has a resource XYZ. If there is a breach of security, the company may face a fine of $100,000 and pay another $20,000 to clean up the breach. The company believes that an attack is likely to be successful about once in 5 years. A proposed countermeasure should cut the frequency of occurrence in half. How much should the company be willing to pay for the countermeasure?

Base Case

With Countermeasure

Single Loss Expectancy

$120,000

$120,000

Annualized Rate of Occurrence

20% (1 in 5 years)

10% (1/2 of base frequency)

Annualized Loss Expectancy

$24,000

$12,000

2–26 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

ALE Reduction for Countermeasure

$12,000

The countermeasure’s annualized expected benefit is $12,000. The company should be willing to pay up to $12,000 annually, but no more.

Hands-on Projects NOTE: Screenshots for individual students will vary.

PROJECT 1 SANS is a great source for information about current IT security trends and training. It also has an excellent collection of security-related white papers to help keep you current. In this project, you are going to look at some important security problems, investigate a security career, read a white paper, and look at one of several ready-made templates designed to help you write a good security policy for your business or organization.

1. Open a web browser and go to www.sans.org.

2. Click Resources, and Critical Security Controls.

3. Take a screenshot.

4. Click Resources and Reading Room.

5. Click Top 25 Papers Based on Views.

6. Take a screenshot.

7. Return to the SANS.org main page.

8. Click Resources and Security Policy Project.

9. Click the link labeled General.

10. Click the link labeled Email Policy.

11. Click the link labeled DOC under the heading Download Policy Template (Word doc).

12. Open the e-mail policy document you just downloaded.

13. Click Replace on the Home tab.14. In the Find what text-box, enter “<COMPANY NAME>.”

15. In the Replace with text-box, enter “YourName Company.” (Replace YourName with your first and last name.)

16. Click Replace All. 17. Take a screenshot of your new policy.

2–27 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

PROJECT 2 Untangle® is an application that integrates a variety of open-source monitoring software into a single management console. It can monitor all traffic that passes over a network. It also has the ability to filter out unwanted traffic. The Untangle Lite® Package is free and uses opensource software. In this project, you won’t install Untangle because it requires additional hardware that you may not have (i.e., a server that will pass traffic between your internal network and your gateway). If you have access to a testing server, it’s well worth the effort to install and configure Untangle. In this project, you will watch a couple of videos exploring Untangle’s functionality, its value to businesses, and reporting ability. You will see that Untangle is extraordinarily easy to use. It also combines monitoring and filtering functions.

Most importantly, it’s completely free.

1. Open a web browser.

2. Browse to Untangle’s YouTube channel at www.youtube. com/channel/UC12SN_VMVLzfnL3IB5zfYzg. 3. Click on Playlists, and the playlist labeled Untangle Case Studies.

4. Click on the video labeled Untangle Case Study: CTR Data video (2 minutes).

5. Take a screenshot while it’s playing.

6. Click back in your browser to return to Untangle’s playlist page.

7. Click on the playlist link labeled Untangle 101 Series.

8. Click on the video labeled Untangle 101: Intro to Untangle NG Firewall and watch the first 5 minutes of the video.

9. Take a screenshot while it’s playing.

10. Click on any other video in the Untangle 101 Series playlist.

11. Take a screenshot while it’s playing.

Student screenshots will vary.

Project Thought Questions 1.

2.

3.

Where does SANS get all of the information about attacks that are occurring?

SANS gets information from more than 165,000 IT security professionals at universities, government agencies, corporations, and private consultants.

Who contributes to the SANS Reading Room?

Various security professionals can submit papers to be posted in the SANS Reading Room. You could submit a paper for review if you chose to do so.

What type of training or certification does SANS provide?

2–28 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

4.

5.

6.

7.

8.

SANS provides a wide variety of IT security training including introductory classes, hacker techniques, computer forensics, intrusion detection, wireless security, etc.

What does the SANS Top-20 list tell you?

It tells you about the top 20 most important security concerns for IT security professionals today.

Why do you think Untangle is valuable to companies?

Student answers will vary.

Realistically, how long do you think it would take you to set up an Untangle server to manage your network?

Student answers will vary.

What is dsiaplyed in your screenshot for the last Untangle video you watched?

Student answers will vary.

Which application in Untangle would add the most value where you work? Why? Student answers will vary.

Case Discussion Questions 1. Why was the navigational data on the Japanese Coast Guard vessel not securely deleted?

It may not have been perceived as a potential source of data loss. The responsible party may not have considered the navigational data when selling the ship. They also may not have considered the national security implications.

2. How could the lost navigational data compromise national security?

The lost navigational data may be recovered and sold to another nation-state. Another nation may use the navigational data to see when and where the Japanese Coast Guard is utilizing its fleet. It may give the nation an operational advantage if a conflict were to break out.

3. How could the Japanese Coast Guard write an effective data disposal policy?

The Japanese Coast Guard could write an effective data disposal policy by first enumerating all possible forms of digital data stored on a vessel. This would include navigational data. The policy could then outline how the data are to be securely disposed.

4. Why might some corporations fail to have a security awareness program or an incident response plan in place? A lack of a security awareness program is often due to a failure to update security policies and procedures in accordance with the updating of equipment.

Newer naval boats may have systems that can store a lifetime of detailed information. The same may be true of cell phones, ground vehicles, photocopiers, and so on. Security policies must change with advances in technology. 5. Why wouldn’t a corporation implement an internal vulnerability assessment program? Corporations might not implement an internal vulnerability assessment program due to a lack of awareness of or focus on how the vulnerabilities of the system might be exploited by individuals inside the company. Most often, corporations focus their concern and resources on external vulnerability.6. Why might an IoT security strategy be so important to a corporation? The interconnectedness of newer 2–29 .

Chapter 2: Planning Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

technologies and systems leaves the entire network vulnerable to breach if one aspect is not secured.Why might current employees represent the greatest threat to corporations? Current employees have the most knowledge of the internal workings and awareness of points of vulnerability of a corporation.How might the statistics from this report drive policy changes at corporations? Heightened awareness of a lack of updating security policies and procedures alongside the evolution of technologies and awareness of substantial loss related to this unresponsiveness might be enough of an impetus to drive policy changes.

Perspective Questions 1.

2.

What was the most surprising thing you learned in this chapter?

Student answers will differ.

What was the most difficult material in this chapter for you?

Student answers will differ.

2–30 .

.

Instructor’s Manual

Chapter 3

Cryptography Learning Objectives By the end of this chapter, the student should be able to: ➢ Explain the concept of cryptography. ➢ Describe symmetric key encryption and the importance of key length. ➢ Describe the initial handshaking stages used in cryptographic systems. ➢ Explain the negotiation stage. ➢ Explain initial authentication, including MS-CHAP. ➢ Describe keying, including public key encryption. ➢ Explain how electronic signatures, including digital signatures, digital certificates, and key-hashed message authentication codes (HMACs) work. ➢ Describe quantum security. ➢ Describe public key encryption for authentication. ➢ Explain cryptographic systems including VPNs and SSL. ➢ Describe the tradeoffs between IPsec tunnel mode and transport mode.

Teaching Suggestions Special Issues Module A is a review of networking concepts. It focuses especially on aspects of networking that are involved in security concerns. Like it or not, IT security requires a strong foundation in networking knowledge. Even the best students in networking usually

Copyright © 2015 Pearson Education, Inc.

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

need a refresher, so it is recommended that you cover Module A before starting Chapter 3.

The problem students have learning the material in this chapter is that there are several concepts that are similar to or are used differently in different contexts. This is particularly true for symmetric key encryption, public key encryption, and hashing. The following figure shows which of these techniques are used for confidentiality and authentication. Two are only used for a single purpose. Public key encryption is used for both confidentiality and authentication but is used differently in these two cases.

Confidentiality

Authentication

Symmetric Key Encryption

Applicable. Sender encrypts with key shared with the receiver.

Not applicable.

Public Key Encryption

Applicable. Sender encrypts with receiver’s public key.

Receiver decrypts with the receiver’s own private key.

Applicable. Sender (supplicant) encrypts with own private key.

Receiver (verifier) decrypts with the public key of the true party, usually obtained from the true party’s digital certificate.

Hashing

Not applicable.

Applicable. Used in MS-CHAP for initial authentication and in HMACs for message-bymessage authentication.

A second problem for students is that some topics, such as digital signatures and MSCHAP authentication, are multi-step processes. Many students need to learn how to study such processes, but the effort is worth it because the ability to understand multi-step processes is critical in IT in general.

Role in the Book Chapter 2 began with the discussion of the plan-protect-respond cycle that governs IT security management. Chapter 2 also discussed planning. Chapters 3 through 9 deal with the protection phase, which takes up the most time in IT security planning.

Once, “crypto” was synonymous with security. This is no longer the case, but cryptographic protections are still extremely important. We begin the discussion of protections with cryptography because cryptography is used in many IT security protections.

Teaching the Material Flow of Material ➢ The chapter begins with a definition of cryptography: the use of mathematical operations to protect messages from traveling between parties or stored on a computer.

3–2 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

➢ It then deals with cryptography for confidentiality. To many people, encryption for confidentiality is synonymous with cryptography, but we will see in this chapter that this is not the case at all. We begin with encryption for confidentiality because most students are familiar with the concept of encryption used so that eavesdroppers or thieves cannot understand messages in transit or in storage. ➢ When even very smart and well-trained people try to create new ciphers (methods for encryptions), their communication is soon lunch for cryptanalysts. In practice, specific encryption ciphers are too complex to understand, and IT professionals do not really need to understand them. However, boxed material covers basic differences between transposition and substitution ciphers, and between ciphers and codes. ➢ The chapter then introduces the central concept of cryptographic systems.

Cryptographic protections come packaged in cryptographic systems that provide a broad spectrum of security protections. In this chapter, we look at the elements of cryptographic systems.

Handshaking Stage 1: Initial Negotiation of Security Parameters Handshaking Stage 2: Initial Authentication (Usually mutual)

Client PC

Server

Handshaking Stage 3: Keying (Secure exchange of keys and other secrets)

Time

Ongoing Communication Stage with Message-by-Message Confidentiality, Authentication, and Message Integrity Electronic Signature (Authentication, Integrity)

Plaintext Encrypted for Confidentiality

➢ The chapter then fleshes out each stage, discussing what it does, and then gives an example or two of how this stage works. ➢ The first step is to negotiate security methods and options to be used during the communication session. The example is how SSL/TLS uses cipher suites. ➢ Next comes initial authentication, which typically, but not always, is mutual, with each party taking on the role of supplicant and verifier. The example in this section is one-way authentication using MS-CHAP. This standard uses hashing rather than encryption of any type. ➢ The final initial hand-shaking stage is keying, in which the two parties share secrets in a way that someone intercepting their transmissions cannot learn. This 3–3 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

section introduces public key encryption for confidentiality and how it is used in secure keying. The section then discusses Diffie-Hellman keying. ➢ In ongoing communication, every message is given an electronic signature so that an impostor cannot transmit a message claiming that the message comes from the other party. This section covers two types of electronic signatures—digital signatures using public key encryption for confidentiality, and key-hashed message authentication codes. ➢ Public key encryption has now been seen in two contexts—confidentiality and authentication. It is used very differently in these two purposes.

Encryption Goal

Sender Encrypts with

Receiver Decrypts with

Public Key Encryption for Confidentiality

The receiver’s public key

The receiver’s private key

Public Key Encryption for Authentication

The sender’s private key

The true party’s public key (not the sender’s public key)

➢ Digital signatures and key-hashed message authentication codes (HMACs) are fairly complex multi-step processes, as the figure for digital signatures suggests.

3–4 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Plaintext

To Create the Digital Signature:

Hash

1. Hash the plaintext to create a brief message digest; this is NOT the Digital Signature.

MD Sign (Encrypt) with Sender's Private Key

2. Sign (encrypt) the message digest with the sender's private key to create the digital signature

DS

Goal: to show that the supplicant knows the True Party's private key

DS

DS

Plaintext

Plaintext

3. Transmit the plaintext + digital signature, encrypted with symmetric key encryption.

Sender

Receiver

To Test the Digital Signature 4.

5.

Received Plaintext

DS Decrypt with True Party's Public Key

Hash

MD

MD 6.

Are They Equal?

4. Hash the received plaintext with the same hashing algorithm the sender used. This gives the message digest.

5. Decrypt the digital signature with the True Party's public key.

This also will give the message digest if the sender has the True Party's private key.

6. If the two match, the message is authenticated.

➢ The section on digital signatures introduces the need for digital certificates as ways of getting the public key of the true party—the party the sender claims to be.

This public key is used to test the computation of the sender. ➢ Quantum security, which is based on quantum physics, involves two very different things. Quantum key distribution may allow ultra-secure keying with enormously long keys. In contrast, quantum key cracking may allow cryptanalysts to break most existing keys very quickly. The former aids security; the latter threatens it. ➢ This chapter concludes with a discussion of VPNs, SSL, and IPsec.

Covering the Material As noted earlier, this is a very difficult chapter. There are many similar concepts that are easy to confuse with one another, and there are many multi-step processes.

3–5 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Keep a chart on the wall that shows the stages of cryptographic system protections and keep referring back to the chart at each step to help the student stay oriented. Spend a lot of time on figures that compare the different ways in which public key encryption is used for confidentiality and authentication.

The hands-on projects at the end of this chapter will give students experience using encryption software and cracking a cipher.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master. Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report.

The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report. Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

3–6 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key

What Is Cryptography?

Encryption for Confidentiality Terminology The Simple Cipher Cryptanalysis 1.

2.

a) Define cryptography.

The use of mathematical operations to protect messages traveling between parties or stored on a computer. b) What is confidentiality?

Confidentiality means that people who intercept messages cannot read them. c) Distinguish between plaintext and ciphertext.

The plaintext is the original message to be delivered. When the plaintext is encrypted, it becomes ciphertext and cannot be read by an interceptor.

However, the receiver can decrypt the ciphertext back to plaintext. d) Which is transmitted across the network—the plaintext or the ciphertext?

Ciphertext e) What is a cipher?

A cipher is a mathematical process used in encryption and decryption. f) What is a key?

A random string of 40 to 4,000 bits (ones and zeros) g) What must be kept secret in encryption for confidentiality?

As long as the key is kept secret, both parties will still have confidentiality. h) What is a cryptanalyst?

Someone who cracks encryption Complete the enciphering in Error! Reference source not found.. n o

4 8

r w

3–7 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko w i s t h e t i m e

15 16 23 16 3 9 12 20 6 25

l y p j k n f c s d

Substitution and Transposition Ciphers Substitution Ciphers Transposition Ciphers Real-World Encryption 3.

4.

a) Which leaves letters unchanged—transposition or substitution ciphers?

Transposition leaves letters unchanged. b) Which leaves letters in their original positions—transposition or substitution ciphers?

Substitution ciphers Complete the enciphering in Error! Reference source not found..

11 h 12 n 13 i 21 t 22 w 23 t 31 e 32 o 33 s

Key Part 2 2 3 1

Key Part 1 1 n i h

3 o s e

2 w t t

Cipher text = hnitwteos 3–8 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Ciphers and Codes 5.

6.

a) In codes, what do code symbols represent?

In codes, code symbols represent complete words or phrases. b) What is the advantage of codes?

The advantage of codes is that people can do encoding and decoding manually, without a computer. c) What are the disadvantages?

The disadvantage of codes is that code books must be distributed ahead of time, and if one code book is intercepted, all confidentiality is lost.

Finish encoding the message in Error! Reference source not found..

17434 63717 8397 11131 34058 53764 73104 26733 29798 72135 54678 61552

Symmetric Key Encryption 7.

8.

a) Why is the word symmetric used in symmetric key encryption?

Because two parties only use a single key for encryption and decryption in both directions b) When two parties communicate with each other using symmetric key encryption, how many keys are used in total?

Only 1 key is used in symmetric key encryption. c) What type of encryption cipher is almost always used in encryption for confidentiality?

Nearly all encryption for confidentiality uses symmetric key encryption ciphers. a) What is the best way to thwart exhaustive searches by cryptanalysts?

Simply make the key so long that the time needed for attackers to crack the key is far too long for practicality. b) If a key is 43 bits long, how much longer will it take to crack it by exhaustive search if it is extended to 45 bits?

Because each bit doubles the time it takes to crack a key, extending the key length by 2 bits would increase the time to crack by 2^2 = 4.

If a key is 43 bits long, it’ll take 4.4E+12 tries, and if it is 45 bits long, the crack will take 1.76E+13 tries. c) If it is extended to 50 bits?

Extending the key to 50 bits = 27 increase = 128 times longer to crack. d) If a key is 40 bits long, how many keys must be tried, on average, to crack it?

240 bits can generate 1,099,511,627,776 combinations.

Normally, a cryptanalyst must try half of all possible combinations to succeed.

3–9 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Half of 1,099,511,627,776 is 549,755,813,888.

So on average, a brute-force password cracker will need about 550 billion tries. e) How long must a symmetric encryption key be to be considered strong today?

Symmetric encryption keys must be 100 bits or longer to be considered a strong key.

Human Issues in Cryptography 9.

Why is cryptography not an automatic protection?

Cryptography is not an automatic protection because it is not infallible.

The humans that utilize cryptography can do things that either completely compromise the key or provide sufficient data to allow more efficient cracking of the key. Companies must have and enforce processes that do not compromise the strengths of cryptography.

It is not an automatic protection because if a sender or receiver fails to keep the key secret, an eavesdropper may learn the key and read every message. Poor communication discipline in general can defeat the strongest cipher and longest key. Also, communicating partners can have a false sense of security because they will think that the cracked encryption method is still protecting them. The reality of cryptography is that it is not an automatic protection. It only works if companies have and enforce organizational processes that do not compromise the technical strengths of cryptography.

Symmetric Key Encryption Ciphers RC4 10.

a) What are the two advantages of RC4?

First, RC4 is extremely fast and uses only a small amount of RAM.1 This means that it is ideal for small handheld devices and was viable for even the earliest 802.11 wireless access points. Second, RC4 can use a broad range of key lengths. For most ciphers, longer key length is better.

However, RC4 was widely used primarily because its shortest optional key length is 40 bits. b) Why is an RC4 key length of 40 bits commonly used?

1

One way to see why RC4 is fast is to note that RC4 can be implemented in only about 50 lines of code. In contrast, the gold-standard AES algorithm requires 350 lines of code (http://www.informit.com). More lines of code generally correspond to longer processing time per key.

3–10 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

An RC4 key length of 40 bits is commonly used because national export limits in many countries once limited commercial products up to 40-bit encryption. c) Is this a strong key?

No. It is less than 100 bits long, so it is not strong. It was selected because it was weak.

The Data Encryption Standard (DES) 11.

a) How long is a DES key?

DES keys are 56 bits long (64 bits with 8 redundant bits to allow parties to detect incorrect keys). b) Is this a strong length?

DES is only 56 bits, therefore, it is not strong. (It needs to be 100 or more.) c) Describe block encryption with DES. The DES key is 56 bits long. It comes in a block of 64 bits, of which 56 bits represent the key. The other 8 bits are redundant in the sense that you can compute them if you know the other 56 bits. This redundancy allows parties to detect incorrect keys. DES encrypts messages 64 bits at a time.

The inputs for the encryption are the key and the 64-bit block of plaintext.

The output is a 64-bit block of ciphertext.

Triple DES (3DES) 12.

a) How does 3DES work?

It applies DES 3 times, with two or three different keys. b) What are the two common effective key lengths in 3DES? 112 bit and 168 bit are the two common effective key lengths in 3DES. c) Are these lengths strong enough for communication in corporations?

3DES is strong enough for communication in corporations. d) What is the disadvantage of 3DES? DES is slow and having to apply DES three times is extremely slow, therefore, extremely expensive in terms of processing cost. 3DES is prohibitively slow for use on personal computers.

Advanced Encryption Standard (AES) 13.

a) What is the big advantage of AES over 3DES? It offers 3 alternative key lengths instead of two. AES is efficient enough in terms of processing power and RAM requirements to be used on a wide variety of devices. b) What are the three key lengths offered by AES? 3–11 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

128 bit, 192 bit, and 256 bit. c) Which strong symmetric key encryption cipher can be used with small mobile devices?

AES can be used with small mobile devices. d) Which symmetric key encryption cipher probably will dominate in the near future?

AES

Other Symmetric Key Encryption Ciphers 14.

a) It is claimed that new and proprietary encryption ciphers are good because cryptanalysts will not know them. Comment on this.

The fact that a cryptanalyst does not know a proprietary encryption cipher does not mean that it is a good, strong cipher. In reality, it is very difficult to create a vulnerability-free cipher that is not cracked quickly by an expert cryptanalyst. b) What is security through obscurity, and why is it bad?

It relies on attackers not to obtain learnable information and it is bad because it could result in catastrophic loss of security if known.

Cryptographic System Standards Cryptographic Systems Initial Handshaking Stages Ongoing Communication 15.

a) Distinguish between cryptography and cryptographic systems.

Cryptography is the use of mathematical operations to protect messages traveling between parties or stored on a computer. Cryptographic systems are packaged sets of cryptographic countermeasures for protecting data and its transmission. b) Distinguish between cryptographic systems and cryptographic system standards.

Cryptographic systems follow specific cryptographic system standards. c) Why is the first handshaking stage the negotiation of security methods and options?

3–12 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

16.

Because most cryptographic system standards offer multiple methods, the first handshaking stage must negotiate the specific security parameters (cryptographic methods and options to be used in communication).

The first handshaking stage is the initial negotiation of security parameters. d) What is an impostor?

An impostor is someone who pretends to be someone else. e) What is authentication?

Proving your identity to communicate to a partner f) What is mutual authentication?

When both parties authenticate themselves to the other g) Why is a secure keying phase necessary?

Secure keying is necessary because if the key is not protected, it can be stolen and this will defeat the purpose of encrypting the data. a) What three protections do cryptographic systems provide on a message-bymessage basis?

An electronic signature, message integrity, and message encryption. b) What is an electronic signature?

An electronic signature is a field in a message that authenticates the message. c) What two protections do electronic signatures usually provide?

Electronic signatures provide both message-by-message authentication and message integrity. d) Distinguish between the handshaking stages and ongoing communication.

The handshaking stage only happens about .1% of the time and the ongoing communication stage happens about 99.9% of the time.

The Negotiation Stage Cipher Suite Options Cipher Suite Policies 17.

a) In SSL/TLS, what is a cipher suite?

A cipher suite is a specific set of options for a particular cryptographic system standard. b) Why do companies want to create policies that define security methods and options for a particular application that is used between corporate partners?

3–13 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Due to wide variation in the strengths of cipher suites, companies must develop risk-based policies for the selection of cipher suites, only allowing cipher suites with suitable strength for the risks facing the application.

Initial Authentication Stage Authentication Terminology 18.

a) In authentication, distinguish between the supplicant and the verifier.

In authentication, the party trying to prove its identity to the other is called the supplicant. The other party is the verifier. b) What are credentials?

They are proofs of identity. c) How many supplicants and verifiers are there in mutual authentication between two parties? Explain.

There are two supplicants and two verifiers. In mutual authentication, the two parties take turns being supplicants and verifiers.

Hashing 19.

a) In hashing, what is the hash?

When hashing is applied to a binary message, the result (called the hash) is far shorter than the original message, typically only 128 to 512 bits long. b) Is encryption reversible?

Encryption is reversible. c) Is hashing reversible?

Hashing is irreversible. d) Is hashing repeatable?

Hashing is repeatable. e) When a hashing algorithm is applied, does the hash have a fixed length or a variable length?

It will have a fixed length. f) What is the hash size of MD5?

128 bits g) What is the hash size of SHA-1?

160 bits h) What is the hash size of SHA-256?

The hash size of SHA-256 is 256 bits.

3–14 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

i) Which hashing algorithms should not be used because they have been found to be vulnerable?

Unfortunately, cryptanalysts have recently found weaknesses in both MD5 and SHA-1. Only stronger versions of SHA should be used today, and MD5 should not be used at all. j) Which hashing algorithm is currently recommended for use by NIST? SHA-2

Initial Authentication with MS-CHAP 20.

a) Is MS-CHAP used for initial authentication or message-by-message authentication?

MS-CHAP is used for initial authentication. b) How does the supplicant create the response message?

The MS-CHAP supplicant creates the response message by (1) adding the shared “secret” password to the challenge message, (2) hashing the resulting string. The hash is the response message. c) How does the verifier check the response message?

To test the response message, the server repeats the client’s actions. The server takes the challenge message it sent to the user, appends the user’s password, which it also knows, and applies the same hashing algorithm the supplicant used. (Recall that hashing is repeatable.) If the server’s hash is identical to the response message, then the user must know the account’s password (6). The server logs in the authenticated user. d) What type of encryption does MS-CHAP use? (This is a tricky question but an important one.)

MS-CHAP does not use encryption at all; it uses hashing and the common secret password to authenticate. e) In MS-CHAP, does the server authenticate itself to the client?

In MS-CHAP, the server does not authenticate itself to the client.

The Keying Stage Session Keys Public Key Encryption for Confidentiality 21.

a) When Alice sends a message to Bob, what key will she use to encrypt the message?

3–15 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

22.

23.

Bob’s public key. b) Why is “the public key” not a good answer to Question 21a?

You need to be very specific about which public key will be used. Since Alice is sending a message for Bob to see, she should use Bob’s public key so that Bob can use his private key to decrypt. c) What key will Bob use to decrypt the message?

Bob will use his own private key to decrypt the message. d) Why is “the private key” not a good answer to Question 21b?

Everyone has a public key and a private key. You must always specify whose public or private key you are talking about. For example, Alice used Bob’s public key to encrypt the message, so only Bob’s private key is going to be able to decrypt the message properly. Alice’s private key will not do it. e) In a classroom with 30 students and a teacher, how many public keys will there be?

30 f) How many private keys?

30 a) What is the main drawback to public key encryption?

Because it is extremely complex, public key encryption is slow and expensive to use. b) What is the most popular public key encryption cipher?

RSA c) What is the other commonly used public key encryption cipher?

ECC (elliptic curve cryptography) is increasing in use. d) Which need to be longer—symmetric keys or public keys? Justify your answer.

Because public-private key pairs rarely change, they must be longer than symmetric keys (which are briefly used during sessions) in order to avoid cracking. e) How long are strong RSA keys?

1,024 bits Julia encrypts a message to David using public key encryption for confidentiality.

After encrypting the message, can Julia decrypt it?

No. Only David can decrypt it because only David knows his private key.

Symmetric Key Keying Using Public Key Encryption 24.

Explain how public key encryption can facilitate symmetric session key exchange.

3–16 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

It can be used in keying. One party creates a symmetric session key, then encrypts the key with public key encryption and sends it to the other party.

Symmetric Key Keying Using Diffie-Hellman Key Agreement 25.

a) What is the purpose of Diffie-Hellman key exchange?

Keying b) Can an attacker who captures the exchanged keying information compute the symmetric session key?

No

Message-by-Message Authentication Electronic Signatures Public Key Encryption for Authentication 26.

a) What is a man-in-the-middle attack?

A form of attack in which an attacker intercepts messages being sent between two parties and forwards them on.b) What is a replay attack?

It’s where an adversary intercepts an encrypted message and transmits it again later. c)Can the attacker read the contents of the replayed message? If they can’t be read, why would a hacker try to replay them?

No, they can only retransmit the message. Replay attacks are attempted because in poorly designed cryptographic systems, an attacker can record an encrypted set of commands to log in or do something else, then play them back to create the same response. d) Does the verifier decrypt the ciphertext with the supplicant’s public key? (If not, explain what key it does use.)

No, the verifier uses the true party’s public key to decrypt the message sent by the supplicant. Using the supplicant’s private key would always authenticate the impostor. e) Who is the true party?

The true party is the person the supplicant claims to be. f) What does the sender attempt to prove it knows that only the true party should know?

The sender attempts to prove it knows the true party’s private key.

3–17 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Message-by-Message Authentication with Digital Signatures 27.

28.

a) In public key authentication, what must the sender know that an impostor should not be able to learn?

The true party’s private key b) For what type of authentication is a digital signature used—initial authentication or message-by-message authentication?

Digital signatures are used for message-by-message authentication. c) How does the supplicant create a message digest?

The supplicant creates the message digest by hashing the plaintext message. d) How does the supplicant create a digital signature?

The supplicant creates a digital signature by encrypting the message digest with its own private key. e) In public key encryption, what is “signing?”

Signing is the act of encrypting the message digest with its own private key. f) What combined message does the supplicant send?

It is the digital signature plus the plaintext g) How is the combined message encrypted for confidentiality?

The sender will use symmetric key encryption. h) How does the verifier check the digital signature?

The verifier checks the digital signature by hashing the plaintext message with the same algorithm used by the sender. The verifier then decrypts the digital signature it received with the true party’s public key, resulting in a message digest. The verifier compares the two message digests – if they are the same, then it’s good-to-go. i) Does the verifier use the sender’s public key or the true party’s public key to test the digital signature?

The verifier must use the true party’s public key to test the digital signature. a) Besides authentication, what security benefit does a digital signature provide?

Digital signatures also provide message integrity. b) Explain what this benefit means.

If the message is changed in transit, the receiver has the ability to reject the altered message. c) Do most message-by-message authentication methods provide message integrity as a by-product?

3–18 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

29.

Yes. Message digests will change if the message has been altered. Thus, message-by-message authentication does provide message integrity as a by-product. a) Contrast the key the sender uses for encryption in public key encryption for confidentiality and public key encryption for authentication.

In public key encryption for confidentiality, the sender uses the public key of the recipient in the cipher. In public key encryption for authentication, the sender uses its own private key to create a digital signature that can be read by its true party public key. b) Contrast the key the receiver uses for decryption in public key encryption for confidentiality and public key encryption for authentication. (Careful!)

The receiver decrypts with the receiver’s private key, which only the receiver knows. The receiver (verifier) then decrypts the message with the true party’s public key.

Digital Certificates 30.

31.

a) From what kind of organization can a verifier receive digital certificates?

The certificate authority (CA) b) Are most CAs regulated?

CAs in many countries are not regulated, thus the verifier must only accept digital certificates from CAs it trusts by reputation. c) Does a digital certificate indicate that the person or firm named in the certificate is trustworthy? Explain.

A digital certificate does not indicate that a person is honest, just that he or she has a certain public key. a) What are the two most critical fields in the digital certificate?

The name of the true party and the true party’s public key b) What field in a digital certificate allows the receiver of a certificate to determine if the certificate has been altered?

The verifier can use the CA’s well-known public key to test the digital certificate’s digital signature; if the test works, the digital certificate is authentic and unmodified. c) What three things must the receiver of a digital certificate check to ensure that a digital certificate is valid?

First, the verifier must check that the digital certificate is authentic and has not been modified.

Second, each digital certificate has dates before and after which it is not valid. The receiver must check whether the digital certificate is in its valid period.

Third, even during a digital certificate’s valid period, a certificate authority may revoke a digital certificate.

3–19 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

32.

d) What are the two ways to check a certificate’s revocation status?

Although CRLs work, the CRLs of large certificate authorities are quite long. Downloading and checking a long CRL can significantly delay the start of communication. Fortunately, most CAs offer a more streamlined way to check the CRL. This is the Online Certificate Status Protocol (OCSP). Using OCSP, a program can simply send in the serial number of a digital certificate to the CA. The CA will send back a response saying whether the serial number is good, revoked, or unknown. a) Does a digital signature by itself provide authentication? Explain why or why not.

A digital signature is simply something that the sender has produced. It only provides authentication when tested with the public key of the true party, which is found in the true party’s digital certificate. b) Does a digital certificate by itself provide authentication? Explain why or why not.

A digital certificate by itself does not provide authentication. Certificates provide the public key of the true party, but anyone can have the true party’s public certificate, so something else (the digital signature) is needed. c) How are digital signatures and digital certificates used together in authentication?

Digital signatures and certificates must be used together to provide authentication. The digital certificate provides the public key that the authentication method, the digital signature, uses to authenticate the applicant.

Key-Hashed Message Authentication Codes Creating and Testing the HMAC 33.

a) What two cryptographic protections does an HMAC provide?

Authentication and message integrity b) Do HMACs use symmetric key encryption, public key encryption, or hashing?

HMACs use a combination of hashing and symmetric key encryption. c) What is the benefit of HMACs over digital signatures?

HMACs are much faster and less expensive than using PKE and digital signatures, which is important during the exchange of a large number of messages during a session.

3–20 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Nonrepudiation 34.

a) Why can’t HMACs provide nonrepudiation?

HMACs fail to give nonrepudiation because the sender and receiver both know the secret key. Consequently, the alleged sender could argue in court that the receiver could have forged the HMAC on the message; so the HMAC did not prove that the sender, in fact, sent it. b) Why is it usually not a problem that HMACs fail to provide nonrepudiation?

Nonrepudiation is usually dealt with at the application layer. As long as the application document is nonrepudiable, it does not matter whether the packets that transmit it are repudiable.

Quantum Security 35.

a) What is quantum key distribution?

It’s a way to deliver enormously long keys to communication partners. b) What are the two advantages of quantum key distribution?

The two advantages of quantum key distribution are 1) quantum keys are enormously long and make traditional forms of key cracking useless, and 2) it becomes quickly apparent if someone tries to intercept and inject bad messages into a stream, and thus can be easily discarded. c) Why is quantum key cracking a major threat to many traditional cryptographic methods?

Because quantum computing offers the potential of being able to crack keys that are hundreds or thousands of bits long in a very short time, tradition cryptographic methods would no longer be secure using today’s accepted strong key lengths.

CRYPTOGRAPHIC SYSTEMS Virtual Private Networks (VPNs) Why VPNs? Host-to-Host VPNs

3–21 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Remote Access VPNs Site-toSite VPNs 36.

a) What is the definition of a VPN? It’s a cryptographic system that provides secure communication over an untrusted network. b) Why do companies transmit over the Internet?

Companies transmit over the Internet because the Internet is effectively omnipresent and the cost-per-bit transferred is so low that it makes economic sense compared to the more expensive transmission over WAN technologies such as Frame Relay. c) Why do they transmit over untrusted wireless networks?

VPNs on wireless LANs, in turn, allow a company to enjoy the benefits of mobility despite the questionable security of many WLANs, especially those in wireless hot spots. d) Distinguish between the three types of VPNs. A host-to-host VPN connects a single client over an untrusted network to a single server. A remote access VPN connects a single remote PC over an untrusted network to a site network. Site-to-site VPNs protect all traffic flowing over an untrusted network between a pair of sites. e) What does a VPN gateway do for a remote access VPN? Remote access users connect to a VPN gateway, which authenticates them and gives them access to authorized resources within the site. Note that this gateway gives remote users access to multiple computers within the site, while a host-to-host VPN only gives you access to a single computer. f) What does a VPN gateway do for a site-to-site VPN? With site-to-site VPNs, sending VPN gateways encrypt outgoing messages. Receiving VPN gateways then decrypt incoming messages and pass these messages to the correct destination hosts in the receiving site. g) Which types of VPNs use VPN gateways?

Remote access and site-to-site VPNs use VPN gateways.

The types of VPNs that use VPN gateways are remote access VPNs and site-to-site VPNs.

SSL/TLS

3–22 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

37.

a) Distinguish between SSL and TLS. When you make a purchase over the Internet, your sensitive traffic is almost always protected by a cryptographic system standard that was originally called Secure Sockets Layer (SSL) when the Netscape Corporation created it. Netscape passed the standardization effort to the IETF, which renamed the standard Transport Layer Security (TLS) to emphasize that it works at the transport layer. b) For what type of VPN was SSL/TLS developed?

Host-to-host VPNs c) For what type of VPN is SSL/TLS increasingly being used?

Remote access VPN

Nontransparent Protection Inexpensive Operation

38.

a) At what layer does SSL/TLS operate?

SSL/TLS operates at the transport layer. b) What types of applications can SSL/TLS protect?

SSL/TLS only protects SSL/TLS-aware applications that have been specifically created to work with SSL/TLS. c) What are the two commonly SSL/TLS-aware applications?

Web applications and e-mail d) Why is SSL/TLS popular?

Every computer has a browser, and all browsers are SSL/TLS-aware. This means there is no setup on clients. Also, all webservers and most mailservers know how to work with SSL/TLS.

SSL/TLS Gateways and Remote Access VPNs 39.

a) SSL/TLS was created for host-to-host (browser-webserver) communication.

What device can turn SSL/TLS into a remote access VPN? The SSL/TLS border gateway b) In SSL/TLS remote access VPNs, to what device does the client authenticate itself?

3–23 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

In SSL/TLS remote access VPNs, the client authenticates itself to a SSL/TLS gateway. c) When a remote client transmits in an SSL/TLS VPN, how far does confidential transmission definitely extend?

Confidential transmission in an SSL/TLS VPN extends between the client’s browser and SSL/TLS gateway. d) What three services do SSL/TLS gateways commonly provide?

Access to internal webservers Webification for nonweb applications, such as database applications Access to internal subnets e) What is webification?

It is converting messages into webpages for the browser to present to the user. f) What software does the client need for basic SSL/TLS VPN operation?

Only a Web browser g) For what purposes may the client need additional downloaded software?

To allow clients transparent access to a subnet and to erase browsing history on a PC while traveling h) Why may installing the additional downloaded software on the browser be problematic?

Installing additional downloaded software usually requires administrator access on a PC. Internet cafes and other public computers do not allow administrator access for general users, and thus may not be able to access the servers. i) Why is SSL/TLS attractive as a remote access VPN technology?

It can provide remote access to almost any PC without modification or configuration because only a browser is needed. j) What problems do companies face if they use it as a remote access VPN technology?

SSL/TLS implementation has a tendency to be limited and clumsy, with unstandardized SSL/TLS gateways. Using remote access VPNs requires strong due diligence with respect to needs assessment and product analysis, as well as a significant interaction by the networking staff. k) Which of the three types of VPNs can SSL/TLS support?

SSL/TLS can support the host-to-host and remote access VPNs. SSL/TLS cannot support site-to-site VPNs.

3–24 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

IPSEC Attractions of IPsec 40.

a) At what layer does IPsec operate?

It operates at the internet layer. b) What layers does IPsec protect?

The internet, transport, and application layer c) Compare the amount of cryptographic security in IPsec with that in SSL/TLS. With SSL/TLS, there is only security to applications that are SSL/TLSaware, while IPsec protects everything in the data field within the IP packet. d) Compare centralized management in IPsec and SSL/TLS. SSL/TLS has no central management. IPsec, in contrast, can centrally manage IPsec on all connections between hosts. e) Why is IPsec’s transparent protection attractive compared with SSL/TLS’ nontransparent protection?

SSL/TLS works at the transport layer and does not give transparent protection to application layer messages. IPsec works at the internet layer and gives transparent protection to transport layer and application layer messages. f) Which versions of IP can use IPsec?

Versions 4 and 6

IPsec Transport Mode IPsec Tunnel Mode 41.

a) Distinguish between transport and tunnel modes in IPsec in terms of packet protection.

IPSec transport mode provides end-to-end, host-to-host VPN security.

IPsec tunnel mode only protects traffic between two IPsec gateways at different sites. b) What are the attractions of each?

The attraction of IPsec transport mode is that it provides the most complete, end-to-end protection. The attraction of IPsec tunnel mode is that it is cheaper to implement IPsec between IPsec gateways than all possible clients and servers between different sites. Also, IPsec tunnel mode is firewall-friendly. c) What are the problematic issues of each?

3–25 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

IPsec transport mode requires that each client and server be set up with a private key-digital certificate pair, placing the private key on each computer and then managing the digital certificates over its life cycle.

Thus, the implementation and management overhead of IPsec transport mode is high. Additionally, IPsec transport mode encrypts all IP traffic, not allowing firewalls to filter individual packets. IPsec tunnel mode is cheaper to implement and maintain, but does not provide full end-to-end protection like the transport mode.

IPsec Security Associations (SAs) 42.

a) What does an SA specify? (Do not just spell SA out.)

It is an agreement about what IPsec security methods and options two hosts or two IPsec gateways will use. A security association in IPsec is reminiscent of an SSL/TLS cipher suite. b) When two parties want to communicate in both directions with security, how many IPsec SAs are necessary?

Security Associations (SAs) are required in each direction of communication. Thus, for two parties to communicate in both directions with security, two IPsec SAs are required. c) May there be different SAs in the two directions?

Yes d) What is the advantage of this?

The advantage of using two different SAs in two directions is that a different level of protection may be allowed in each direction. Thus, more sensitive communication transmissions may be assigned stronger IPsec protections. e) Why do companies wish to create policies for SAs? Companies wish to create policies for SAs because some cryptographic security standards are inadequate for a company’s security needs. Creating a policy for SAs ensures that a company creates SAs that meet acceptable security standards on all applicable devices. f) Can they do so in SSL/TLS? No, SSL/TLS does not allow companies to create and enforce policies. g) How does IPsec set and enforce policies?

IPsec sets and enforces policies via the use of IPsec policy servers that push a list of suitable policies to individual IPsec gateway servers or hosts.

3–26 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Conclusion Synopsis Thought Questions 1.

2.

3.

4.

5.

6.

The total processing speed of microprocessors (based on clock rate and number of circuits) is doubling roughly every year. Today, a symmetric session key needs to be 112 bits long to be considered strong. How long will a symmetric session key have to be in 30 years to be considered strong? (Hint: Consider how much longer decryption takes if the key length is increased by a single bit.)

Only 142 bits long. Each additional bit doubles the effective search time, so only one bit must be added each year.

Longer keys are more difficult to crack. Most symmetric keys today are 100 to 300 bits long. Why don’t systems use far longer symmetric keys—say, 1,000 bit keys?

The longer the key, the more processing power and RAM it takes to operate. Thus, it makes sense for systems to use the minimum key length for a given threat, and 100 to 300 is considered very strong at this time.

Brute force is used to crack a 100-bit key. The key is cracked in only 5,000 tries.

How can this be?

On average, it will take many tries to crack a 100-bit key. However, the cracking process is random, so the key may be found much more quickly (or more slowly).

In practice, public key authentication is used heavily for initial authentication but rarely for message-by-message authentication. Given the intense processing power required for public key authentication and the fact that public key authentication gives the strongest authentication, explain these two usage patterns.

The verifier would send a challenge message in the clear.

The supplicant would encrypt the challenge message with the supplicant’s own private key, creating the response message.

The supplicant would send the response message to the verifier.

The verifier would decrypt the response message with the true party’s public key. If this results in the challenge message, the supplicant must be the true party.

Did we see symmetric key encryption used for authentication in this chapter? If so, how was it used?

No. It is only used in encryption for confidentially.

Describe the entries in the second row of Error! Reference source not found..

Comment on the strengths of the choices it uses.

3–27 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

7.

8.

9.

Uses public key authentication (RSA) for initial authentication. Only export-grade authentication, so not strong initial authentication.

The same for digital signatures.

For symmetric key encryption, uses RC4 with 40-bit keys. Weak key length.

Uses MD5 for HMACs. MD5 is a vulnerable algorithm. a) For the second-to-last row of Error! Reference source not found., comment on the strengths of its symmetric encryption cipher and of its hashing algorithm.

For symmetric key encryption, uses 3DES. Strong, but very slow.

Uses SHA-1 for HMACs. This is vulnerable. b) Describe the entries in the last row of Error! Reference source not found..

Comment on the strengths of the choices it uses.

Uses public key authentication (RSA) for initial authentication. Strong initial authentication.

The same for digital signatures.

For symmetric key encryption, uses AES with 256-bit keys. Very strong.

Uses SHA-256 for HMACs. Very strong.

How are digital certificates and drivers’ licenses similar, and how are they different?

Similar Issued by an authority Associate a name with an identifier Time limitation Can be checked for revocation Different Named person has permission to drive and perhaps limitations (e.g., corrective lenses, etc.)

Picture verification Driver’s license cannot be used for remote verification How are digital certificates and passports similar, and how are they different?

Similar Time limitation Different Named person is a citizen of a country Picture verification, sometimes biometrics How are digital certificates and university diplomas similar, and how are they different?

Similar Bearer may not be the named party 3–28 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

10.

11.

12.

Different Named party has a degree Digital certificates can be checked for validity more easily How are digital certificates and movie tickets similar, and how are they different?

Similar Expiration date Different Bearer is entitled to enter theater Tickets: verification of identity is irrelevant Identify potential security threats associated with authentication via digital signatures and digital certificates. Explain each and describe how you would address each threat.

Someone applies for a digital certificate fraudulently and gets it. Strong independent authentication is needed before certificates are given out.

The CA is a fake company. Only accept the certificates of CAs you trust.

Someone in a legitimate CA fraudulently issues a false certificate.

An attacker obtains the true party’s private key. This will allow the attacker to impersonate the individual, and the individual’s digital certificate will “authenticate” the key thief. Revoke the digital certificate immediately and require that all users do certificate revocation checking whenever they do authentication via digital certificates and digital signatures.

An attacker can walk up to the user’s computer or plant a Trojan horse or other malware that takes over the user’s computer. The attacker can then use the private key stored on the user’s computer.

A digital certificate can be modified. If the verifier does not check the certificate’s digital signature, this change will go undetected.

If key lengths are short, cryptanalysis will be possible.

The chapter described how public key authentication is used for message-bymessage authentication in digital signatures. However, public key authentication is widely used for initial authentication. Describe the processes that the supplicant and verifier would use if public key encryption were used in initial challengeresponse authentication. Draw heavily on your understanding of digital signatures, but put this information in challenge–response context.

The verifier would send a challenge message to the supplicant.

The supplicant would encrypt the challenge message with its own private key. It would send this response message to the verifier.

The verifier would decrypt the response message with the true party’s public key. If the verifier learns the true party’s public key through a digital certificate supplied by a certificate authority, it must verify the digital certificate.

3–29 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

13.

If the decrypted response message matches the original challenge message, the supplicant must know the true party’s private key and so must the true party. The supplicant is authenticated.

If a supplicant gives you a digital certificate, should you accept it? Explain.

(Think about this carefully. The answer is not obvious.)

Yes. The digital signature in the digital certificate will let you know if the digital certificate was altered to replace the true party’s public key with an impostor’s public key.

Hands-On Projects NOTE: Screenshots for individual students will vary.

PROJECT 1 AxCrypt is a great third-party encryption tool. You just select the files you want encrypted, enter your password, and you’re done. It is even available as an option in the shortcut menu when you right-click a file. AxCrypt will automatically re-encrypt the file after you are done modifying it. It uses 128-bit AES and is completely free. Let’s look at some of the functionality built into AxCrypt.

1. Download AxCrypt from www.axcrypt.net.

2. Click Download.

3. Click on the appropriate version for your operating system.

4. If the program doesn’t automatically open, browse to your download folder.

5. Right-click AxCrypt-2-Setup.exe.

6. Click Run as administrator.

7. Click Yes if prompted.

8. Click I Agree.

9. Click Custom Installation.

10. Deselect all the bloatware (from Amazon).

11. Click Install.

12. Deselect Register.

13. Click Finish.

14. Save all your work, exit all other programs, and reboot your computer. Once your computer is rebooted you can continue on to the next step.

15. Right-click your desktop.

16. Click New and Text Document.

17. Name the file YourName.txt. Replace YourName with your first and last name.

18. Right-click the file named YourName.txt.

19. Select AxCrypt, and Encrypt.

20. Enter the password “tiger1234” (without quotes).

21. Click OK. 22. Double-click the new YourName-txt.axx file you just created.

23. Enter the password “tiger1234” (without quotes).

3–30 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

24. Click OK. 25. Close the text file that you just opened.

26. Take a screenshot of your desktop showing the newly created files.

27. Right-click the file named YourName-txt.axx.

28. Select AxCrypt and Decrypt.

29. Enter the password “tiger1234” (without quotes).

30. Click OK. 31. Right-click the file named YourName.txt. (This time you’re going to make an executable file that can be opened by anyone. They won’t have to have AxCrypt installed on their computer to be able to open the .exe.)

32. Select AxCrypt, and Encrypt copy to .EXE. 33. Enter the password “tiger1234” (without quotes).

34. Click OK. 35. Take a screenshot of your newly created YourName-txt.exe file.

PROJECT 2 This project uses an Enigma® machine simulator. It functions like the Enigma machines used during World War II. This example has been included to help you better understand how encryption worked in the early days. It’s a great learning tool for when you first start exploring the subject of cryptography. Enigma machines provided fairly good encryption strength for their day. Modern cryptographic systems are much more secure than Enigma machines.

Pay attention to the colored paths as you type. The red path goes through the three rotors, bounces off the reflector, becomes green, and then goes back through the three rotors. The right rotor moves with each keystroke. If it completes one full cycle, it will advance the middle rotor and subsequently the left rotor.

1. Open a web browser and go to http://enigmaco.de/enigma/enigma.html.

2. Use the left and right arrows to move each of the top three rotors so that each has the letter “A” selected in blue.

3. Click in the Input text box in the bottom of your screen.

4. Slowly type your first name and last name without a space. (In this case it was RandyBoyle. If you make a typing error you can start over by pressing the backspace key.)

5. Take a screenshot.

Note: The text in the Input text box is what you typed. The text in the Output text box is what you would send. You are now going to reset the dials to their original position (in this case AAA) and type the encrypted text (cipher text) you produced in the Output text box. You can copy the cipher text from the screenshot you just took. Subsequently, you should see your name reproduced in the bottom box. This is the equivalent of decrypting the message.

6. Click in the Input text box and backspace your name. (The rotors should be set back to their AAA position.)

7. Refer back to the screenshot you just took and copy down the output (ciphertext). (In this case, the ciphertext for “RANDYBOYLE” was “VDOLZYMEAC.”) 8. Type the ciphertext into the Input text box. (Type slowly so you won't make a mistake and have to start over!)

3–31 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

9. Take a screenshot with your name showing in the Output text box.

10. Backspace the text in the Input text box.

11. Slowly press the A key ten times and notice how a different encrypted letter is chosen as output through the rotating dials even though you are hitting the same key each time.

12. Take a screenshot.

Project Thought Questions 1.

2.

3.

4.

5.

6.

Why would you need an encrypted file that self-extracts (.exe)?

The person receiving the file won’t need to have AxCrypt on his or her machine in order to open the encrypted file.

Will AxCrypt work on multiple files or entire directories (folders)?

Yes, it will encrypt multiple files and/or directories at a single time.

Even if you encrypted a file with AxCrypt, wouldn’t someone be able to recover a previous version of the file with a file recovery program? Hint: AxCrypt has a built-in shredder.

No, AxCrypt permanently shreds the file by wiping the disk space where the file was stored. They won’t be able to recover the file once it is encrypted or moved.

Could your network administrator open these files after you encrypted them with AxCrypt? Why not?

It’s unlikely that your network administrator will be able to open these files given the level of encryption used by AxCrypt. It would take them many years to crack this level of encryption because of the key length and lack of enough computational cycles.

Why did Enigma machines use multiple rotors?

The use of multiple rotors increased the overall key strength. The movement of rotors performed simple substitution by identifying a corresponding letter via a changing electrical pathway (polyalphabetic substitution).

How did World War II cryptographers know which rotor settings to use?

Code books were issued that told the sender/receiver which rotors to use, and also indicated the initial position setting.

Case Discussion Questions 1.

How could Bloomberg insiders use terminal data to front-run traders?

Bloomberg insiders could use terminal data to determine trades, trade sentiment, potential deals, etc. before they happened. Insiders could use 3–32 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

2.

3.

4.

this information to “front-run” or make trades in advance of events they knew were going to happen.

How should Bloomberg handle questions about its ability to protect traders’ data?

Bloomberg needs to quickly and confidently show that they protect traders’ data in order to show that they are technically competent to secure their data, and trustworthy to not divulge any confidential data. It needs to show traders that it is doing everything possible to protect their terminal users.

How could Bloomberg use encryption to calm trader’s fears?

Bloomberg could implement fully-encrypted communication protocols for all of their products. They could also secure traders’ data from internal users and allow an external firm to audit internal access to traders’ data.

They could also stop scanning messaging data.

Why is confidentiality important in a business-to-business relationship?

Confidentially is important in most business relationships. In this case, the desire for confidentiality may stem from the need to keep deal-related information private. If insiders were able to glean information about a potential deal, they could make large sums of money at the expense of the parties making the deal.

5.

Why does EFF publish a report about consumer privacy at large Internet companies?

EFF publishes their annual privacy report in an effort to encourage companies to protect users’ privacy from government overreach. On EFF’s website, they indicate, “…but in today’s increasingly digital world, online service providers serve as the guardians of our most intimate data — from email content to location information to our social and family connections. The policies adopted by these corporations will have deep and lasting ramifications on whether individual Internet users can communicate free from the shadow of government surveillance.”

6.

How might privacy concerns affect customer loyalty and new product adoption?

Customers may be hesitant to sign up for new products or services if they feel the company will later sell their information. For example, the loss of a customer’s information (e.g., phone number, etc.) may adversely affect him or her in terms of continual harassing phone calls to buy new products.

Perspective Questions 1.

What was the most difficult section for you in this chapter?

Student answers will vary.

3–33 .

Chapter 3: The Elements of Cryptography Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

2.

What was the most surprising thing you learned in this chapter?

Student answers will vary.

3–34 .

.

Instructor’s Manual

Chapter 4

Secure Networks Learning Objectives After studying this chapter, students should be able to: ➢ Describe the goals of creating secure networks. ➢ Explain how denial-of-service (DoS) attacks work. ➢ Explain how ARP poisoning works. ➢ Know why access controls are important for networks. ➢ Explain how to secure Ethernet networks. ➢ Describe wireless (WLAN) security standards and potential attacks.

Teaching Suggestions Special Issues Like Chapter 3, Chapter 4 involves difficult technical concepts, with some distinctions that are fairly subtle.

The discussion related to DoS attacks and ARP poisoning is technically difficult. It is important to go slow and understand the underlying concepts. For example, students need to understand how ARP works before they can begin to understand how ARP poisoning works.

Role in the Book Chapter 3 began the discussion of protections by introducing the elements of cryptography—the stages of cryptographic system standards and a few security methods and options to use in each

.

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

of the three handshaking stages and in ongoing communication. Chapter 4 looks at securing networks from attacks. It is important to point out to students that this chapter is not focused on securing the information flowing over networks. Rather, it is focused on securing the networks themselves.

Teaching the Material Flow of Material ➢ The chapter starts out with a general discussion about the main goals of secure networks, namely availability, confidentiality, functionality, and access control. Again, it is important to emphasize that these goals are focused on networks, not the information flowing over networks. The discussion about the death of the perimeter typically invites student participation. ➢ The next section discusses several different types of DoS attacks including (1) direct/indirect, (2) intermediary, (3) reflected, and (4) sending malformed packets. It may be a good idea to do a simple packet capture using Wireshark to illustrate the types of packets and the overall volume of packets that a typical computer receives. This will help give context to this section. ➢ The discussion then naturally leads into ARP poisoning. It's important to explain how ARP works before discussing ARP poisoning. Students also sometimes fail to realize why switches can't prevent ARP poisoning. There is also a short discussion about a SLAAC attack. ➢ The chapter then moves on to access control for networks. Wired LANs use Ethernet almost exclusively today. To prevent someone from simply walking into a firm and plugging into any available wall jack, companies can use 802.1X access control. Before someone can use the network, he or she has to authenticate. In this authentication, the workgroup switch acts as an authenticator. It primarily passes messages between the supplicant client and a back-end authentication server that follows the RADIUS protocol.

Under 802.1X, the native RADIUS authentication protocol is replaced by the Extensible Authentication Protocol (EAP). Other native RADIUS AAA protocols, including authorization and auditing protocols, are not replaced. ➢ Most firms are not too concerned with their wired LAN security, but nearly all are concerned by wireless LAN security. To protect communication between the wireless access point and wireless clients, the 802.11 Working Group first produced the WEP standard, but this had very poor security. Later, the 802.11 Working Group produced the 802.11i standard. But before they did so, the Wi-Fi Alliance produced a simplified version of 802.11i, which they called WPA. Both WPA and 802.11i are now used widely in organizations. There are two ways to implement 802.11i and WPA. In 802.1X mode, the wireless access points are the authenticators and a central authentication server is used. The version of 802.1X developed for WLANs uses an enhanced EAP protocol that first sets up an SSL/TLS connection between the wireless access point and the wireless client. Companies with a single access point do not require a central authentication server

4–2 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

because both 802.11i and WPA offer a simpler non-802.1X mode of operation, a preshared key mode.

Covering the Material The individual pieces of this chapter are not complex, but students need a good deal of help in seeing how the pieces fit together.

For wireless security, consider giving wireless access points to groups of students and have them configure 802.11i security in pre-shared key mode.

You can also have students turn off SSID broadcasting to show them that this will frustrate most wireless clients. Do emphasize, however, that readily downloadable hacker software can defeat the turning off of SSID broadcasting.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master.

Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report. The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report. Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

4–3 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key

4.1 Introduction Creating Secure Networks Future of Secure Networks 1.

a) Explain the four general goals for secure networking.

These four goals include availability, confidentiality, functionality, and access control.

Availability means that authorized users have access to information, services, and network resources.

Confidentiality means preventing unauthorized users from gaining information about the network’s structure, data flowing across the network, network protocols used, or packet header values.

Functionality means preventing attackers from altering the capabilities or operation of the network.

Access control is the policy-driven control of access to systems, data, and dialogues. b) How can information be gathered from encrypted network traffic?

Information transmitted during an SSL session cannot be viewed. However, the sender’s IP address, receiver’s IP address, the DNS request to resolve the hostname, the port numbers used, and the quantity of data sent are all visible.

Even if the traffic is encrypted, the attacker can still see which websites are visited, how much data is sent or received, and which port numbers are used. c) Give an example of how new technology has made networks less secure.

Answers will vary. For example, newer cell phones have the ability to allow wireless laptops to tether themselves to the cell phone and share their Internet connectivity. Allowing cell phones into the corporate network completely circumvents access control procedures, firewalls, antivirus protection, data loss prevention systems, and so on. d) How does the castle model relate to secure networking?

The traditional castle model of network defense had the good guys on the inside, and the attackers on the outside. There was a well-guarded single point of entry.

4–4 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

All network administrators had to do was secure this point of entry and attackers would be stopped. e) What is meant by “death of the perimeter?”

The “death of the perimeter” is a phrase used by network administrators to convey the idea that creating a 100-percent secure network is impossible. They argue that it is impractical, if not impossible, to force all information in an organization through a single point in the network. f) How does the city model relate to secure networking?

The city model has no distinct perimeter, and there are multiple ways of entering the network. Like a real city, who you are will determine which buildings you will be able to access. In technical terms, this will mean more internal intrusion detection systems, virtual LANs, central authentication servers, and encrypted internal traffic.

4.2 DoS Attacks Denial of Service. . . But Not an Attack Goal of DoS Attacks 2.

a) What is a denial-of-service attack?

A DoS attack attempts to make a server or network unavailable to legitimate users. In terms of the general goals discussed earlier, DoS attacks are ways of reducing availability. b) Other than a DoS attack, what could cause a company’s webserver crash?

Faulty coding or referrals from large sites. c) What are the main goals of DoS attacks?

The ultimate goal of a DoS attack is to cause harm. For corporations, this can come in the form of losses related to online sales, industry reputation, employee productivity, or customer loyalty. DoS attacks can cause harm by (1) stopping a critical service or (2) slowly degrading services over time. d) Is a slow degradation of service worse than a total stoppage? Why? An attack that slowly degrades services is more difficult to detect because there isn’t an abrupt change in service quality. Network administrators cannot see a clear distinction between genuine growth in network traffic and a progressive DoS attack. They may be forced into unnecessary capital expenditures for additional bandwidth, hardware, and software.

Methods of DoS Attacks 3.

a) What is the difference between a direct and indirect DoS attack?

4–5 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

4.

A direct attack occurs when an attacker tries to flood a victim with a stream of packets directly from the attacker’s computer. An indirect attack tries to flood the victim computer in the same way, but the attacker’s IP address is spoofed (i.e., faked) and the attack appears to come from another computer. b) What is backscatter?

Backscatter occurs when a victim sends responses to the spoofed IP address used by the attacker, and inadvertently floods an unintended victim. c) What types of packets can be sent as part of a DoS attack?

A few of the types of packets that could be sent in a DoS attack include SYN, ICMP, and HTTP. d) Describe a SYN flood.

A SYN flood, or half-open TCP attack, happens when the attacker sends a large number of TCP SYN segments to the victim server. Each SYN begins a TCP session opening process on the server. The server sets aside RAM and other resources for the connection. The server then sends back a SYN/ACK segment.

The attacker never completes the connection opening by sending a final ACK. As the attacker sends more SYN segments, the victim host keeps setting aside resources until it crashes or refuses to provide any more connections, even to legitimate users. e) How does a DDoS attack work?

DDoS attacks are the most common form of DoS attack that uses intermediaries to attack the victim. The attacker’s identity can be hidden behind layers of bots that directly attack the victim. Second, the ability to control thousands of bots can give the attacker the resources needed to overwhelm the victim. f) What does a handler do?

Handlers are an additional layer of compromised hosts that are used to manage large groups of bots. Handlers can direct bots to send a variety of different packets depending on the service being targeted. a) How does a P2P attack work?

A peer-to-peer (P2P) redirect attack uses many hosts to overwhelm a victim using normal P2P traffic (Figure 4-7, Step 1). A P2P redirect attack differs from a traditional DDoS attack in several ways. The attacker does not have to control each of the hosts (i.e., make them bots) used to attack the victim. The attacker just needs to convince the hosts to redirect their legitimate P2P traffic (Step 2) from the P2P server to the victim (Step 3). b) How does a reflected attack work?

A reflected attack uses responses from legitimate services to flood a victim. The attacker sends spoofed requests to existing legitimate servers (Step 1). Servers then send all responses to the victim (Step 2). There is no redirection of traffic. c) What is a DRDoS attack, and how does it work?

Using a botnet in a reflected attack using legitimate services is known as a distributed reflected denial-of-service (DRDoS) attack.

4–6 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

d) What is a Smurf flood?

A Smurf flood is a variation of a reflected attack that takes advantage of an incorrectly configured network device (router) to flood a victim. The attacker sends a spoofed ICMP echo request to a network device (Step 1) that has broadcasting enabled to all internal hosts. The network device forwards the echo request to all internal hosts (Step 2). All internal hosts respond to the spoofed ICMP echo request (Step 3) and the victim is flooded. e) What type of packet is sent in a Smurf flood? Why? ICMP, the attacker benefits from a multiplier effect because a single ICMP request is responded to by multiple hosts (Step 4). f) How could a malformed packet cause a host to crash?

An attacker could send a malformed packet that will cause the victim to crash. For example, ping of death is a well-known older attack that uses an illegally large IP packet to crash the victim’s operating system.

Defending against Denial-of-Service (DoS) Attacks 5.

a) What is black holing?

Black holing is when a firm drops all IP packets from an attacker. b) Is black holing an effective defense against DoS attacks? Why? Black holing an attacker is not a good long-term strategy because attackers can quickly change source IP addresses. c) How can the effects of SYN floods be mitigated?

The effects of SYN floods can be mitigated by validating the TCP handshake, rate limiting, or even black holing. d) What is a false opening?

False opens occur when a SYN segment arrives and the firewall itself sends back a SYN/ACK segment without passing the SYN segment on to the target server. e) Why is rate limiting a good way to reduce the damage of some DoS attacks?

Rate limiting can be used to reduce a certain type of traffic to a reasonable amount. This is good if an attack is aimed at a single server because it keeps transmission lines at least partially open for other communication. f) Why is it limited in effectiveness?

Rate limiting frustrates both attackers and legitimate users. It helps, but it does not solve the problem. g) Why is DoS protection a community problem, not just a problem for individual victim firms to solve?

DoS attacks are community problems that can only be stopped with the help of ISPs and organizations whose computers are taken over as bots and used to attack other firms. DoS attacks may unintentionally originate from an unsuspecting firm.

Working together, firms can stop attacks from leaving their organizations, before they even reach their target.

4–7 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

4.3 ARP Poisoning Normal ARP Operation 6.

a) Why do hosts use ARP? Address Resolution Protocol (ARP) is used to resolve 32-bit IP addresses (e.g., 55.91.56.21) into 48-bit local MAC addresses (e.g., 01-1C-23-0E-1D-41). Hosts on the same network must know each other’s MAC addresses before they can send and receive packets using IP addresses. Hosts build ARP tables by sending ARP requests and replies to each other. b) Can ARP poisoning be used outside the LAN? Why not?

Typically not. Packets with IP addresses not on that LAN are redirected out of the network. ARP requests are only sent on the LAN. c) Why do hosts send ARP requests?

If a host (gateway) receives a packet addressed to an internal host (10.0.0.1) it sends an ARP request to every host on the LAN, asking if they have that IP address (Step 1). Only the host that has the requested IP address responds. All other hosts ignore the request (Step 2). Thus, hosts use ARP requests to resolve IP addresses into MAC addresses. d) What is ARP spoofing?

ARP spoofing uses false ARP replies to map any IP address to any MAC address.

Spoofed ARP replies can be broadcast to other hosts on the LAN. e) How could an attacker use ARP spoofing to manipulate host ARP tables?

ARP requests and replies do not require authentication or verification. All hosts trust all ARP replies. Spoofed ARP replies are broadcast to other hosts on the LAN. This allows an attacker to manipulate ARP tables on all LAN hosts.

ARP Poisoning 7.

a) Explain ARP poisoning?

ARP poisoning can be used to reroute traffic for a MITM attack by sending unsolicited false ARP replies to all other hosts. An attacker can force hosts to erroneously mismatch MAC addresses and IP addresses. Essentially, the attacker can reroute all internal traffic as desired. b) Why does the attacker have to send a continuous stream of unrequested ARP replies?

The attacker must send a continuous stream of unsolicited ARP replies to all hosts on the LAN. Otherwise, all hosts would quickly resolve the true MAC addresses of all other hosts on the network. c) Do switches record IP addresses? Why not?

Switches only look at MAC addresses. They cannot identify the incorrect ARP resolution being pushed out to all other hosts. They merely forward all packets based on the MAC address. They do not look at the IP address on the packet.

4–8 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

d) Does the attacker have to poison the gateway’s ARP tables too? Why? Yes, after the attacker has successfully rerouted the host traffic, it needs to reroute the traffic coming to, and from, the gateway. It uses a similarly spoofed ARP reply to poison the gateway. The attacker sends a continuous stream of spoofed ARP replies to the gateway, telling it that all other internal hosts are at C3-C3-C3C3-C3-C3 (Step 3). e) Why does all network traffic go through the attacker after poisoning the network?

If the attacker has successfully used spoofed ARP replies to record false entries in the ARP tables for all internal hosts and the gateway, all traffic sent from internal hosts to the gateway will go to the attacker (Step 4). All traffic from the gateway will also go through the attacker and is now redirected through the computer as part of a MITM attack (Step 5).

ARP DoS Attack Preventing ARP Poisoning 8.

a) How can ARP poisoning be used as a DoS attack?

Spoofed ARP replies can be used to stop all traffic on the local network as part of an ARP DoS attack. The attacker sends all internal hosts a continuous stream of unsolicited spoofed ARP replies, saying the gateway (10.0.0.4) is at E5-E5-E5E5-E5-E5 (Step 1). Hosts record the gateway’s IP address and nonexistent MAC address (Step 2). b) How can static IP and ARP tables be used to prevent ARP poisoning?

ARP poisoning can be prevented by using static IP tables and static ARP tables.

Static ARP tables are manually set and cannot be dynamically updated using ARP. Each computer has a known static IP address that does not change. All hosts on the LAN know which IP address is assigned to each MAC address (host). c) Can static IP and ARP tables be effectively used in large networks? Why not?

Most organizations are too large, change too quickly, and lack the experience to effectively manage static IP and ARP tables. The workload would be overwhelming. d) Why would limiting local access prevent DoS attacks?

Limiting local access would prevent ARP DoS attacks because foreign hosts would not be able to send packets to internal hosts.

SLAAC Attack 9.

a) What is a SLAAC attack?

A Stateless Address Auto Configuration (SLAAC) attack is an attack on the functionality and confidentiality of a network. This attack occurs when a rogue

4–9 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

IPv6 router is introduced to an IPv4 network. All traffic is automatically rerouted through the IPv6 router, creating the potential for a MITM attack. b) Why do host automatically prefer IPv6 addressing?

Traffic on the existing IPv4 network is rerouted through the rogue IPv6 router because all newer operating systems are configured by default to prefer IPv6 networks. Microsoft Windows 7, Microsoft Server 2008, and Apple OS X all ship with IPv6 fully enabled. c) What has to be introduced to a network for a SLAAC attack to work?

With the physical introduction of a rogue IPv6 router, all internal traffic is automatically rerouted (Step 1). This happens because the rogue router advertises its presence on the network using Router Advertisement (RA) messages over ICMPv6 (Step 2). Hosts receive RAs and automatically derive their IPv6 address using a process called Stateless Address Auto Configuration (SLAAC). d) Would a SLAAC attack work on an existing IPv6 network? Why not?

No, the attack would only work on existing IPv4 networks. If the attack were tried on an existing IPv6 network, the network administrator would immediately see conflicts. The network administrator could also assign a specific (legitimate) internal DHCP server (IPv6) to each host. e) Could a rogue router direct internal traffic to an outside rogue DNS server? How? Yes, the rogue router can assign a false DNS server to internal hosts as part of the SLAAC attack. A false DNS server would allow an attacker to redirect all internal traffic to any number of phishing sites.

4.4 Access Control for Networks LAN Connections 10.

a) What is the main access control threat to Ethernet LANs? Traditionally, Ethernet LANs offered no access security. Any intruder who entered a corporate building could walk up to any wall jack and plug in a notebook computer. The intruder would then have unfettered access to the LAN’s computers, bypassing the site’s border firewall. This was a complete breakdown in access control. b) What is the main access control threat to wireless LANs? An intruder can connect by radio to an unprotected wireless access point. c) Why is the access control threat to wireless LANs more severe?

The intruder does not even have to enter the building, as he or she needs to do in wired LANs. In WLANs, attackers can connect to unprotected (or poorly protected) wireless access points and bypass border router security from outside of the physical premises of the company.

4–10 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

d) Is eavesdropping usually a concern for wired LANs, wireless LANs, or both?

It is a concern in both, but it is a rare concern in wired LANs and a common concern with wireless LANs.

4.5 Ethernet Security Ethernet and 802.1X 11.

a) Why is 802.1X called Port-Based Access Control?

802.1X is called Port-Based Access Control because security is implemented on specific ports of an Ethernet workgroup switch. b) Where is the heavy authentication work done?

The heavy authentication work is done on a central authentication server, rather than on the switch. c) What are the three benefits of using a central authentication server?

Reduced cost: Having a central authentication server reduces the work required to maintain multiple authentication databases updated, as well as reduces the authentication processing on individual switches.

Consistency: Credentials are checked against the same authentication database every time, versus relying on possibly outdated authentication databases residing on switches throughout the network.

Immediacy: Central authentication allows the ability to rapidly change access controls, which is especially important when trying to restrict access to a recently fired employee or rogue PC that may be negatively impacting the network. d) Which device is the verifier? Explain. (Tricky question.)

There is no verifier in 802.1X. Instead, the verifier responsibilities are shared between the workgroup switch, known as the authenticator, and the central authentication server. e) Which device is called the authenticator?

The workgroup switch is called the authenticator.

The Extensible Authentication Protocol (EAP) 12.

a) How does an EAP session start?

When a switch senses a connection, it sends an EAP Start message to the RADIUS server. This begins the EAP session. b) What types of messages carry requests for authentication information and responses to these requests?

EAP request and response messages.

4–11 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

c) Describe how the central authentication server tells the authenticator that the supplicant is acceptable.

It sends an EAP accept message if the supplicant is acceptable, but it sends an EAP failure message if the supplicant is not. d) How does the authenticator pass this information on to the supplicant?

How the authenticator notifies the client of authentication success or failure is outside the scope of EAP. e) In what sense is EAP extensible?

EAP is considered extensible because it is easy to add new authentication methods to EAP (such as smart cards, MS-CHAP, Diffie-Helman, etc.) without modification of the general format of the underlying EAP messages. Only the contents are modified by the authentication method chosen. f) When a new authentication method is added, what device software must be changed to use the new method?

When a new authentication method is added, the central authentication server and supplicant both need to implement the new method. g) Why is there no need to change the operation of the authenticator when a new EAP authentication method is added or an old EAP authentication mode is dropped?

The software on the authenticator (workgroup switch) does not have to be changed. It merely passes request and response messages through. This is good because a network will have many workgroup switches. h) Why is this freedom from the need to make changes in the switch beneficial?

The freedom to make changes in authentication protocols is beneficial because it reduces costs that would normally be associated with upgrading authenticators if they were tied to specific authentication methods.

RADIUS Servers 13.

a) What standard do most central authentication servers follow?

Most central authentication servers are governed by the RADIUS standard. b) How are EAP and RADIUS related in terms of functionality?

RADIUS is an AAA server that uses EAP for authentication. c) What authentication method does RADIUS use?

EAP

4.6 Wireless Security Wireless Attacks

4–12 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Unauthorized Network Access 14.

a) What is the most common attack against wireless networks? Why? The most common attack against wireless networks is unauthorized access, or connecting to a network without permission. b) Which IEEE standard governs WLAN transmission?

IEEE 802.11 c) Which device acts as a relay between wired and wireless networks?

An access point d) What is the typical range of a WLAN? Wireless 802.11 networks typically have a range of 30 to 100 meters extending in all directions from the AP. e) What is the difference between an open network and a private network?

Open networks can be legally accessed by anyone, but private networks do not allow access unless specifically authorized. f) Who would set up a rogue access point? Why? Rogue access points are unauthorized access points set up by individuals or departments with little or no security. They are typically set up by internal employees for convenience, without knowing the ramifications of an unsecured wireless AP. g) Give examples of both internal and external harm caused by unauthorized wireless access.

Internally, attackers have greater access to information, resources, and other network traffic. They can covertly steal confidential information, read and record network traffic, alter network devices, or plant malware on targeted clients or servers. They may also have access to network shares that were assumed to be protected behind the firewall.

An attacker could anonymously download, upload, and store illegal content via the wireless network. Even worse, the network could be used as a launching pad for an external attack. h) Are you liable if someone else uses your wireless network to commit a crime? Why, or why not?

At the time of this writing, it appears that you are likely not liable for crimes committed by criminals using your wireless network if you attempted to secure it.

However, it's unknown if you could be liable for criminal acts performed through an unprotected network. In either case, your ISP can immediately discontinue your service.

Evil Twin Access Points 15.

a) What man-in-the-middle attack is a danger for 802.11 WLANs? The most dangerous man-in-the-middle attack for 802.11 WLANs is the evil twin access point. An evil twin access point is simply a PC that has software that 4–13 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

allows it to masquerade as a legitimate access point. The evil twin will pass traffic to legitimate access points transparently, retaining copies of important data sent from the host and a legitimate access point. Evil twin access points can intercept messages during and after security setup, allowing the evil twin to have the necessary keys to decrypt all traffic during a specific session. b) Physically, what is an evil twin access point?

An evil twin access point is simply a PC that has software to allow it to masquerade as an access point. c) What happens when the legitimate supplicant sends credentials to the legitimate access point?

The evil twin access point will intercept all traffic passing through it, including credentials and keys that will later on give it permission to decrypt and encrypt any messages passing through. d) In what two types of attacks can the evil twin engage?

It can capture credentials transmissions and keys and it can also send packets of its own, impersonating the victim client. e) Are evil twin attacks frequent?

Yes. f) Where are they the most frequently encountered?

In public hot spots g) How can the danger of evil twin attacks be addressed?

The danger of evil twin attacks can be eliminated by requiring remote clients to establish VPN connections with VPN gateways prior to gaining access to network resources. Remote access VPN connection setup requires a pre-shared key on the client and VPN gateway, and this pre-shared key is never transmitted during authentication, thus defeating the evil twin’s ability to copy credentials and keying information.

Wireless Denial of Service 16.

a) How would a wireless DoS attack be carried out?

Wireless DoS attacks can be carried out by 1) flooding the frequency being used, 2) flooding the AP with too many packets, and 3) continually sending "disassociate” packets to all internal wireless clients. b) What type of devices could be used to flood the transmission frequency for a WLAN? Attackers can use common household items such as baby monitors, cordless phones, or Bluetooth devices to interfere with an 802.11 network. Attackers can also use commercial jamming devices. c) What device could be used to identify a DoS flood if the entire frequency is being flooded by EMI?

4–14 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Network administrators can use wireless spectrum analyzers to identify DoS floods. Spectrum analyzers record all signals, including packet transmissions, within a given radio frequency band. d) What type of attack commands could be sent to cause a wireless DoS attack?

An attacker could use packet injection to send spoofed deauthenticate messages to the AP. The spoofed source addresses would correspond to each wireless client on the WLAN. The deauthenticate message says that the sender wants to terminate the authenticated connection. The victim must reauthenticate with the AP before it can communicate. e) What would happen if a wireless network were flooded with CTS frames?

A flood of CTS frames with long transmission durations keeps other clients waiting. A flood of RTS frames produces a flood of CTS frames. Both produce an effective DoS attack on the wireless network. Again, these messages are not authenticated.

Wireless LAN Security with 802.11i 17.

a) Why is it impossible to extend 802.1X operation using EAP directly to WLANs? EAP assumes that the connection between the supplicant and authenticator is secure, which is not the case in wireless transmission. Thus, 802.1X operation using EAP cannot be directly extended to WLANs. b) What standard did the 802.3 Working Group create to extend 802.1X operation to WLANs with security for EAP? 802.11i c) For 802.11i, distinguish between outer and inner authentication.

Outer authentication in 802.11i consists of the client authenticating itself to the access point by establishing an SSL/TSL connection. Inner authentication follows outer authentication and occurs when the wireless client authenticates itself with the central authentication server using EAP, within the protection of SSL/TLS. d) What authentication method or methods does outer authentication use?

Outer authentication uses SSL/TSL. e) What two extended EAP protocols are popular today?

EAP/TLS and PEAP f) Distinguish between their options for inner authentication.

For EAP/TLS, the inner authentication also uses TLS. For PEAP, the client can use any method specified in the EAP standard, ranging from passwords through digital certificates. g) Is 802.11i security strong? Explain.

802.11i security is very strong. 802.11i not only provides authentication, but it supplies all of the protections expected in a strong cryptographic security system.

By using 128bit AES, 802.11i ensures a robust symmetric encryption cipher for

4–15 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

confidentiality. 802.11i also uses the strong AES-CCMP standard for automatic and frequent rekeying.

Core Wireless Security Protocols Wired Equivalent Privacy (WEP) Cracking WEP Perspective 18.

a) What was the first core wireless security standard?

Wired equivalent privacy (WEP) b) What encryption algorithm does it use?

WEP uses RC4. c) Why are permanent shared keys undesirable?

Permanent shared keys are undesirable because in large firms that have many access points sharing the same WEP key, the practical difficulties in changing everyone’s key means that shared keys are almost never changed. In addition, because “everybody knows” the key, people share the key freely even when they are told not to. Worst of all, if a company fires a disgruntled employee, it must change the key on every access point for which the employee may know the key.

In many cases, changing the key will be prohibitively expensive and will inconvenience many workers. d) What per-frame key does a WEP computer or access point use to encrypt when it transmits?

WEP encrypts each frame with a per-frame key that consists of the shared RC4 key plus a 24-bit initialization vector (IV) that is different for each frame. e) What mistake did the 802.11 Working Group make in selecting the length of the IV? The 802.11 Working Group’s mistake was making IVs too short (only 24 bits long). f) How long may WEP take to crack today?

If a company encrypts a large enough volume of traffic with the same secret key, the attacker can often compute the entire secret key in two or three minutes. g) Should corporations today use WEP for security today?

No. Given how easily and quickly WEP can be cracked, it makes no sense for corporations to use WEP today. In fact, it only gives a false sense of security, which may be worse than no security at all.

4–16 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Wi-Fi Protected Access (WPA™) 19.

a) What prompted the Wi-Fi Alliance to create WPA? The inadequacy of WEP (which can be cracked in minutes) caused many companies to freeze WLAN deployment and in some cases turn off existing WLANs. This wide scale lack of trust in WLAN security prompted the Wi-Fi Alliance to create WPA. b) Compare WPA and 802.11i security.

WPA uses the relatively weak RC4 cipher in encryption for confidentiality and uses the only moderately strong Temporal Key Integrity Protocol (TKIP) for keying and rekeying. Although there have been no published cracks for WPA as a whole, at least at the time of this writing, TKIP has been partially cracked, and security professionals are uncomfortable with WPA’s security methods. c) What does the Wi-Fi Alliance call 802.11i?

WPA2 d) Despite its security weaknesses, why do many companies continue to use WPA instead of 802.11i?

Companies still use WPA instead of WPA2 to avoid the cost of reconfiguring all access points and wireless clients to support WPA2.

Pre-Shared Key (PSK) Mode 20.

a) Why is 802.1X mode unsuitable for homes and small offices?

Because the use of a central authentication server is very expensive. b) What mode was created for homes or very small businesses with a single access point?

PSK/personal mode c) How do users in this mode authenticate themselves to the access point?

In the PSK mode, users authenticate themselves to the access point via the use of a single, shared initial key. d) Why is using a shared initial key not dangerous?

This key is used only briefly, when a client first authenticates itself to the access point. The access point sends the client a session key for use during the session.

With only a few messages transmitted using the shared initial key, it is impossible for a cryptanalyst to discover the shared initial key. e) How are PSK/personal keys generated?

The administrator types a passphrase into every client and into the access point. f) How long must passphrases be for adequate security?

Passphrases must be at least 20 characters long for adequate security, but preferably greater than 20 characters.

4–17 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Wireless Intrusion Detection Systems 21.

a) What is the purpose of a wireless IDS? It is to collect data from wireless access points that can be used to detect attacks. b) How do wireless IDSs get their data?

In centralized wireless intrusion detection system, each access point becomes a wireless IDS agent, sending appropriate information to the central wireless IDS console. The console transfers the data to an IDS database. It also sorts through data in the database to find indications of problems. c) What is a rogue access point?

Unauthorized access points set up by individuals or departments d) What are the two alternatives to using a centralized wireless IDS? One is not to worry about intrusion detection, and the other is to walk around the building frequently with a laptop that has wireless IDS software. e) Why are they not attractive?

Ignoring threats raises the probability that they will be successful. Walking around is likely to require a prohibitive amount of labor, and it cannot catch threats that appear after the wireless security administrator has checked a part of the site for threats. Nor are they likely to catch evil twin access points, which only operate occasionally and so may not be operating when the wireless administrator is sweeping the building for concerns.

False 802.11 Security Measures 22.

a) Does the use of spread spectrum transmission in 802.11 create security?

No. Military transmission uses spread spectrum operation in a way that provides security. Civilian spread spectrum transmission does not. b) What are SSIDs? Each access point has a Service Set Identifier (SSID) that acts as the access point’s address. Clients must know the SSID to connect to the access point. c) Does turning off SSID broadcasting offer real security? Explain.

No. Turning off SSID broadcasting would seem to offer security. However, even if SSID broadcasting is turned off, the SSID will still be transmitted in the clear, in the header of each transmitted frame. Hacker software can read the SSID easily. d) What are MAC access control lists?

A MAC access control list is a list of pre-approved stations allowed to use the access point. e) Do they offer real security? Explain.

MAC access control lists rely on MAC addresses that are transmitted in the clear for every 802.11 frame. MAC addresses can be sniffed and spoofed by hackers.

Thus, MAC access control lists offer no significant security.

4–18 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

4.7 Conclusion Thought Questions 1.

2.

3.

4.

5.

Distinguish between EAP and RADIUS in terms of functionality.

RADIUS is an AAA protocol that provides authentication, authorizations, and auditing. For its authentication functionality, RADIUS uses EAP. It does not use EAP for authorizations or auditing.

Why would it be desirable to protect all of a corporation’s IP traffic by IPsec? Give multiple reasons.

This would provide transparent protection to all applications.

If it was universally used, a company would not have to manage multiple security transmission protocols, reducing security administration burdens and confusion.

If all traffic were protected by IPsec, there would be no danger if traffic requiring protection was not identified as being important and was not given protection.

Attackers could not just focus on encrypted traffic as targets for cracking.

Depending on how IPsec was used, it might be very difficult for attackers to map the network.

Evil twin access points would be defeated automatically.

There could be central management of all transmission security.

What wireless LAN security threats do 802.11i and WPA not address?

Rogue access points: 802.11i and WPA applied properly to a wireless access point cannot protect against eager company personnel who establish rogue access points that, if implemented poorly, will completely circumvent proper 802.11i and WPA protections.

Evil twin access points: 802.11i and WPA do not protect against man-in-themiddle attacks, and the evil twin access point is the most serious threat to WLAN security.

Given the weakness of commercial WAN security, why do you think companies continue to use WAN technology without added cryptographic protections?

While dangers are real, attacks on traffic flowing over commercial WANs has not been a frequent target of attacks. Consequently, companies typically do not implement security and so avoid its cost at relatively little risk.

Of course, if attackers suddenly began to attack commercial WANs, the calculus of risk analysis would change immediately, and it would take some time to implement security. During that time, companies sending traffic over commercial WANs would be vulnerable.

What could a company do if it was using a commercial WAN and a vulnerability appeared that allowed attackers to easily find routing information and therefore be able to eavesdrop on corporate transmissions?

4–19 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

6.

It could establish VPNs between corporate sites, making intercepted transmissions unreadable. However, this would take time to set up.

The 802.1X standard today is being applied primarily to wireless LANs rather than to wired LANs. Why do you think that is?

802.1X port-based security is probably being applied primarily to wireless LANs rather than wired LANs, because companies see the threat of someone walking into their site and plugging into an open Ethernet port as minimal when compared to the constant threat of wireless transmission access to corporate network resources.

Hands-on Projects NOTE: Screenshots and IP addresses for individual students will vary.

PROJECT 1 PROJECT 2 It is a common misconception that HTTPS provides anonymous Web browsing. This is not the case. A secured HTTPS connection can ensure confidentiality (what you're sending can't be read by others) and authentication (the website you're visiting is really who they say they are).

However, it does not provide anonymity. Eavesdroppers cannot see what you are sending, but they can see that you are sending something to that website.

Onion routing can provide anonymity via an encrypted network of "relay" servers. Computers around the world pass your fully encrypted traffic. The intermediary relay servers do not know the entire path of the onion network. Requests that come from you appear to originate from around the world. You have complete anonymity. It's still a good idea to use a secured end-toend HTTPS connection, because the connection between the last relay server and the site you are visiting is not encrypted.

1. Open a web browser.

2. Go to www.google.com/.

3. Search for “my IP address.”

4. Press Enter.

5. Click on the first result.

6. Take a screenshot showing your IP address.

7. Go to www.TorProject.org.

8. Click Download Tor Browser.

9. Click on the link for Windows 10 under Tor Browser Bundle.

10. Save the file in your download folder.

11. Browse to your download folder.

12. Right-click the Tor executable and select "run as administrator."

13. Complete the installation process and start the Tor Browser. (If the Tor browser doesn’t automatically start, you can search for “Tor Browser” in the Windows Search menu.)

14. Within the web browser, go to www.Google.com.

4–20 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

15. Search for "my IP address."

16. Click on the first result. (If you get a warning about an "Untrusted" connection, just click on I Understand the Risks, Add Exception, and Confirm Security Exception.)

17. Take a screenshot showing the new IP address. (This is someone else's IP address.)

18. Start Microsoft Edge. (Arrange the windows so that the Tor browser and Microsoft Edge are both visible on your desktop.)

26. Search for "my IP address."

27. Click on the first result.

28. Take a screenshot of your desktop (Ctrl-PrintScreen) showing the IP address results in both web browsers. (Use the results from the same website. Each browser should show a different IP address.)

Project Thought Questions 1.

2.

3.

4.

5.

6.

7.

8.

What are channels? Would one be better than another?

Channels are the ranges of radio frequencies that wireless APs use. It would be better to use a frequency that is less used. There aren’t any other noticeable differences between channels at this range.

Why is WEP considered cryptographically weak?

It uses a weak algorithm that can be easily broken.

What is the difference between WPA and WPA2?

WPA2 has a new AES algorithm that makes wireless very secure and complies with the 802.11i standard.

Why do some networks run at 11 Mbps and others at 54 Mbps?

They are different 802.11 standards that can operate at different frequencies.

Why would someone want to use a Tor network?

Some users may want to use a Tor network to conceal illicit or criminal behaviors. Others may live in countries that do not value civil liberties (such as freedom of speech), causing them to use a Tor network to protect themselves from their own government. Others may just value their privacy.

What do relay servers do in a Tor network?

Relay servers pass Tor traffic along to its final destination. Due to encryption, each relay only knows the next hop in the path, not the whole path or original source.

How do Tor networks provide anonymity?

Tor networks provide anonymity by concealing the identity of the original sender, relay nodes, and likely the final destination. It does this by using layer encryption to pass messages through the network.

Why is it still important to use an HTTPS connection if you are using a Tor network?

It’s important to still use an HTTPS connection when using a Tor network because the final link between the last relay node and the final destination is not 4–21 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

encrypted. Traffic between the last relay node and the final destination host can be intercepted. Establishing an HTTPS connection will ensure that the last leg of the path is secured.

Case Discussion Questions 1.

2.

3.

4.

5.

6.

7.

How does Spamhaus mitigate spam?

Spamhaus mitigates spam by creating block lists of known spammers. These lists are then distributed to companies and used to block spam before it enters the corporation.

Why would Spamhaus be the target of such a large DDoS attack?

Spammers would want to target Spamhaus because spammers’ products (spam) cannot get into corporations. They would like to disrupt Spamhaus’ operation out of spite, or possibly, to get their spam through for a short period of time.

How could Spamhaus avoid similar attacks in the future?

Spamhaus could avoid similar attacks by working with their ISP to block future attacks before they enter their network. They could also distribute their site and block list distribution across multiple sites, IP addresses, and hosting providers.

Why would state-sponsored APTs be worrisome?

State-sponsored APT would be worrisome because of the magnitude of the resources that could be put behind the APT to support its operations. The level of funding for the APT’s attack operations would easily be eclipsed by the amount spent by a typical corporation on its IT security function.

Why would a nation engage in cyber espionage?

A nation would engage in cyber espionage because it could greatly reduce R&D expenditures for its military and private sector interests. Cyber espionage could not only save governments costly R&D expenditures, but it could also reduce the time it takes to develop the new technology. They could quickly and cheaply improve their military effectiveness, and boost the overall competitiveness of their private sector companies relative to their international competitors.

What are the costs and benefits of a nation engaging in cyber espionage?

The costs include resources to fund and train their cyber espionage group. There may be minor reputational losses if the cyber espionage is discovered. However, the benefits of reduced R&D costs and increased time to market for new products are substantial. It is also worthwhile to consider that cyber espionage may not be severe enough to lead to a traditional (kinetic) war, thus the overall “risk” of getting caught might be fairly low.

Should governments provide support to businesses to prevent cyber espionage? How? Yes, governments should realize that their private sector businesses are a critical part of their ability to effectively secure their nation-state. Protecting businesses from economic espionage helps economic growth and political stability.

Governments can stop cyber espionage by mitigating attacks before they enter the

4–22 .

Chapter 4: Secure Networks Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

country. Governments can work with regional ISPs to filter malware, stop DoS attacks, and reduce spam.

Perspective Questions 1.

2.

What was the most surprising thing you learned in this chapter?

Student answers will differ.

What part was the most difficult for you?

Student answers will differ.

4–23 .

.

Instructor’s Manual

Chapter 5

Access Control Learning Objectives After studying this chapter, students should be able to: ➢ Define basic access control terminology. ➢ Describe physical building and computer security. ➢ Explain reusable passwords. ➢ Explain how access cards and tokens work. ➢ Describe biometric authentication, including verification and identification. ➢ Explain how PKI provides cryptographic authentication. ➢ Explain authorizations. ➢ Explain auditing. ➢ Describe how central authentication servers work. ➢ Describe how directory servers work. ➢ Define full identity management.

Teaching Suggestions Special Issues The last part of the chapter builds on the concept of central authentication servers. First, it discusses how central authentication servers often get their data from directory servers. Second, it shows how companies use metadirectory servers to coordinate different types of directory Copyright © 2015 Pearson Education, Inc.

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

server. Third, it shows how federated identity management takes identity management into the interorganizational world. It is important to help students understand the structure.

Some students have a difficult time distinguishing between authentication and authorization. Authentication is determining who the user is. However, determining the user does not give authorization to access every resource. Authorizations define what a specific authenticated user can do to and with various resources.

In biometrics, the discussion of false acceptance rates and their implications is difficult for most students. So is the distinction between identification, verification, and positive and negative watch lists. There are several similar concepts that are nevertheless different and situation-dependent, so you should take a go-slow approach to this section.

Role in the Book Chapter 3 gave students a strong understanding of cryptography. This chapter looks at access control—things that can be done to limit user access to various resources within the firm. If attackers cannot get access to a resource, they cannot harm it. Cryptography is prerequisite knowledge for this chapter because some access control tools use cryptography. While not all do, those tools that do often use it only as part of its core operation, such as protecting communication between a user and an access control device.

Teaching the Material Flow of Material ➢ The chapter begins with the important distinction between authentication, authorizations, and auditing. ➢ Next comes physical security. If you don’t secure your buildings, attackers can simply walk in. This section uses ISO/IEC 27002 recommendations for physical security. ➢ There is a lengthy discussion of reusable passwords. Passwords are the dominant form of authentication today, but they are deeply flawed. This section explores those flaws and suggests minimum standards for passwords today. ➢ There is a short section on access cards and physical access tokens. ➢ There is a lengthy section on biometrics. ➢ The section on cryptographic authentication is brief because students usually already have a working knowledge of crypto. The section focuses on a management issue— creating a public key infrastructure (PKI) ➢ The next two sections deal with authorizations and auditing. Authorizations, by the way, will also be covered in considerable depth in the chapter on host and data security. ➢ The chapter wraps up with sections on identity management, beginning with central authentication servers and how they often get their information from directory servers.

The cryptographic chapters introduced RADIUS central authentication servers, but this chapter adds Kerberos to the list of authentication servers. The section on directory servers focuses on Microsoft’s Active Directory. The chapter notes that a firm may have 5–2 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

several different types of directory servers and may use a metadirectory server to coordinate its directory servers. ➢ The chapter concludes with a discussion of federated identity management for interorganizational coordination, and a discussion of identity management in general.

Covering the Material This chapter lends itself to an initial discussion of the importance of access control and a broad discussion of access control methods. Have students generate a list of different ways to control access and write them on the board. Then have students discuss individual access control approaches. For instance, in building access controls, ask them what they can do.

In biometrics, ask them to list different types of biometrics. (For iris scanning, which is far more common than retinal scanning, emphasize that these systems are cameras and do not shine light into your eye as depicted in so many movies and television shows.)

Afterwards, cover topics that students went over fairly quickly in the lecture. In some cases, you might want to ask them to read sections and list things they didn’t come up with in their initial discussion of the topic.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master.

Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report. The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report. Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

5–3 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key

Introduction Access Control Authentication, Authorizations, and Auditing Authentication Beyond Passwords Two-Factor Authentication Individual and Role-Based Access Control Organizational and Human Controls 1.

a) List the AAA access controls.

Authentication, Authorizations, and Auditing. b) Explain each in a sentence.

Authentication is the process of assessing the identity of each individual claiming to have permission to use a resource.

Authorizations are specific permissions that a particular authenticated user should have given his or her authenticated identity.

Auditing consists of collecting information about the activities of each individual in log files for immediate and later analysis. c) What are the four bases for authentication credentials?

What you know (a password or a private key) What you have (a physical key or a smart card) Who you are (your fingerprint) What you do (how you specifically pronounce a passphrase) d) What is two-factor authentication’s promise?

Two-factor authentication promises defense in depth. If one authentication method is broken, the impostor will still not be able to authenticate him or herself. e) How can a Trojan horse defeat this promise?

5–4 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

If a client PC is infected with a Trojan horse, the Trojan horse can send transactions when a user has already authenticated him or herself to an ecommerce site. If a user’s computer is compromised, two-factor authentication means nothing. f) How can a man-in-the-middle attack defeat this promise?

Two-factor authentication can often be defeated with a man-in-the-middle attack.

If a user logs into a fake banking website, the fake site can act as a silent gobetween to the real banking website. After the user successfully authenticates, the fake website can execute transactions of its own on the real website. g) What is RBAC? (Do not just spell it out).

Role-based access control. Authorizations are assigned to roles instead of to individuals. h) Why is RBAC less expensive than access control based on individual accounts?

Role-Based Access Control is less expensive than access control based on individuals because fewer assignments need be made (as there are far fewer roles to designate than there are people assigned to roles). i) Why is it less error-prone? (The answer is not specifically in the text.)

Appropriate authorizations are easier to understand for roles than for individuals. j) Why do technologically strong access controls not provide strong access control in real organizations?

No access control, no matter how strong, will provide strong access control in real organizations unless the organization has well-thought-out security policies and rigorously implements those policies. Humans are ingenious in finding ways to harm themselves, especially when they are not monitored.

Military and National Security Organization Access Controls Multilevel Security 2.

a) Distinguish between mandatory access controls and discretionary access controls.

In mandatory access control, departments have no ability to alter access control rules set by higher authorities. In principle, this offers very strong security. In practice, this is difficult to sustain because some flexibility is always needed.

In discretionary access control, the department has discretion over giving access to individuals, within the policy standards set by higher authorities. b) What is multilevel security?

Information is classified by level of security (e.g., confidential, secret, top secret, etc.). It is assigned security appropriate for its level of classification. c) What are SBU documents?

SBU documents are sensitive but unclassified. d) Do they need to be considered in access controls?

5–5 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Yes e) Why are access control models needed?

To cope with complex access control issues involving multilevel security, organizations that use multilevel security must follow complex access control models to determine how to deal with various access situations.

Physical Access and Security Risk Analysis ISO/IEC 11.1: Secure Areas 3.

a) Why is having a single point of building entry important?

By limiting access points, it is easier to apply protections to people coming into and going out of the building. b) Why are emergency exits important?

In case of fire or other problems, people must be able to escape. c) What should be done about them?

Emergency exists should be alarmed, monitored (preferably with cameras), and tested frequently. In all cases, security provisions must be compatible with fire codes. Most importantly, it is illegal to lock fire exits to bar egress. d) List the four elements of entry authorization in CobiT. In CobiT, building entry must be justified, authorized, logged, and monitored. e) Why is loading dock security important?

This is a busy area with many strangers. It is a likely penetration point. In addition, it holds expensive goods that are easy to steal. f) What access control rules should be applied to loading docks?

Internal employees should have limited access to loading docks, which prevents easy passing of material from inside to outside.

External employees should have no access to the building beyond the loading dock. (They don’t need it).

Incoming shipments should be inspected and logged.

Outgoing shipments should be separated from incoming shipments to reduce risk of theft. g) What steps should be taken to reduce the danger of environmental damage?

Hazardous and combustible material should be located away from sensitive areas, and there should be adequate equipment for fire fighting. Disaster response facilities and backup media should be located safely away from the building. h) List rules for working in secure areas.

5–6 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Unsupervised work in secure areas should be avoided.

When no one is working in a secure area, it should be locked and checked periodically.

Electronic devices that can record or copy mass amounts of information should be forbidden in secure areas (e.g., cameras, cell phones, USB flash drives, external hard drives, non-authorized PCs and laptops, and other computing devices).

Inspections of personnel entering/leaving secure areas should ensure that this rule is followed. Inspections must follow strict notification and compliance laws.

ISO/IEC 11.2 Equipment Security 4.

a) What is siting?

Siting is a synonym for locating or placing. It is done from the root site. b) Distinguish between UPSs and electrical generators.

Uninterruptable power supplies (UPSs) have batteries that can supply power to equipment for a brief period of time after an outage. UPSs allow orderly shutdown during power failures.

Electrical generators can be used as backup for longer-duration outages. These run on gasoline. c) If wiring cannot be run through walls, what should be done to protect the wiring?

If wiring cannot be run through walls, the wiring should be protected by running it through conduits (preferably armored conduits) and should not be run through public areas. d) What should be done to protect laptops taken off-premises?

Laptops should never be left unattended. If for home use, the laptop should be stored in lockable filing cabinets, and all paperwork should be locked away when not in active use, along with the equipment. Having insurance for the laptop is also desirable. For all equipment taken off premises, precautions include: Being limited to authorized personnel only.

Being logged out and back in.

Having all sensitive information removed. e) What controls should be applied to off-site equipment maintenance?

Offsite equipment maintenance must: Be limited to authorized personnel only.

Be logged out and back in.

Have all sensitive information removed. f) What controls should be applied to equipment disposal or reuse?

When equipment is ready to be disposed or reused, sensitive data must be removed. If the equipment will not be reused, the hard drive should be destroyed or, at the very least, written over by special software that prevents data from being recovered.

5–7 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

g) What controls should be placed over employees taking equipment off-site?

Controls over employees taking equipment offsite include: Ensuring proper authorization to remove equipment Limiting the personnel who are able to authorize removal Enforcing time limits for off-site use Logging equipment in/out Periodic spot checks of the above rules should be conducted h) What controls should be applied to sensitive information sitting on desks or shown on screens when users are away from their desks?

User’s desks should be kept clear of any physical papers or storage media that may contain sensitive or classified information.

Other Physical Security Issues 5.

a) What special controls are required by terrorism threats?

Due to increasing threats from terrorism, terrorist attacks must be considered in all matters of physical security. For instance, new buildings should be set back from streets and protected with rolling hill landscaping. In appropriate situations, guards may be armed. Bullet-proof doors may also be needed to guard sensitive areas. b) Why is it necessary to prevent piggybacking?

Unless piggybacking is eliminated, physical access security is nearly impossible. c) What advice would you give a company about CCTV? Tell the company that CCTV tapes will wear out, high resolution cameras are expensive and consume a great deal of disk space, low resolution cameras may be insufficient for recognition needs, and to reduce storage they should use motion sensing. d) What is dumpster diving?

Dumpster diving is an attack in which an attacker goes through a firm’s trash bins looking for documents, backup tapes, floppy disks, and other informationcarrying media. e) How should dumpsters be protected?

Building trash bins should be located in a secure and lighted area, preferably under CCTV surveillance. This area must be on the company premises, because once building trash bins are moved beyond the company premises, their contents usually are considered to be abandoned and have no legal protection. f) What can be done to reduce the dangers of desktop PC theft and unauthorized use?

To reduce the danger of theft, individual desktop PCs in ordinary office areas can be locked onto their desks with a cable, provided that there is something on the desk to wrap the cable around. In addition, each PC should have a login screen 5–8 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

that requires a complex password and a screen saver so that an intruder cannot simply walk up to it and use it.

Passwords Password-Cracking Programs 6.

a) What are reusable passwords?

Reusable passwords are passwords that are used for weeks or months at a time. b) Why is password cracking over a network difficult to do?

Password cracking over a network is difficult to do because the attacker will almost always be locked out after a few attempts. c) In what two ways can password-cracking programs be used?

Password-cracking programs can be loaded on a server (assuming the hacker can gain access to the server) to try thousands of possible account name/password combinations per second until one works. Also, if the attacker can gain access to the password file from a computer, he or she can copy the file and attempt to crack it on another machine in a less obtrusive manner. d) Which is safer for the cracker? Why? Stealing the password file and cracking it elsewhere is safer. There is no need to wait around by a compromised server while the password-cracking program does its work.

Password Policies Password Use and Misuse 7.

a) Why is it a problem to use the same password at multiple sites?

Using the same password at multiple sites is bad because when a password is compromised at one site, it is compromised at all sites, expanding the risk of the compromise. b) Why is it difficult to enforce a policy of using a different password at each site?

It is difficult to enforce a policy of using a different password at each site because it is difficult for users to remember different passwords for different sites. Using different passwords is even difficult if the passwords are written in a password book. c) Why are password duration policies important?

If passwords are not changed frequently, or if an attacker cracks the password, he or she will be able to use it for a long period of time.

5–9 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

d) What are password resets?

A password reset is the action taken by a help desk employee to create a new password for an account when the current password is lost or forgotten. e) Why are password resets dangerous?

Password resets are dangerous because they are susceptible to social engineering by an imposter who can convince help desk personnel to reset a password, thus giving account access to the imposter and locking out the appropriate account holder. f) How can password resets be automated?

Password resets can be automated by using a system that asks the person requesting a reset to answer one or more secret questions, giving answers the authentic user gave at registration time. g) Why are password reset questions difficult to create?

Password reset questions are difficult to create because: Some questions themselves are security violations (such as asking for SSN or mother’s maiden name).

Some questions are easily answered by an attacker with little knowledge of the user (e.g., city of birth, pet’s name, etc.).

Some questions are too hard to remember or difficult to answer (e.g., favorite song, favorite teacher in high school, etc.).

Some questions require exact spelling, which can cause the password reset answer to fail too often. (This is especially difficult with names.) h) How may password resets be handled in high-risk environments?

In high-risk environments, password resets might best be handled by eliminating remote password resets altogether and requiring the users to go to the help desk in person and show ID. For the DoD’s Common Access Card (CAC), each user creates a six or eight digit PIN. A user only gets three tries to access an IT service using the CAC. After three incorrect tries, the CAC locks itself, and unlocking requires the user to physically go to a CAC issuance facility (which in some places only takes appointments several days in advance).

8.

a) What is the book’s recommended password policy for length and complexity?

The book’s recommended password policy for length and complexity is: Be at least 12 characters long Have at least one change of case, not at the start of the password Have at least one digit, not at the end of the password Have at least one non-alphanumeric character, not at the end of a password 5–10 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

b) How can password-cracking programs be used to enforce password strength policy?

Password-cracking programs can be used to enforce password strength policy by having systems administrators run a password-cracking program against their own servers to check for policy violations in password length and complexity. c) Before you run a password-cracking program on your company’s computers to check for weak passwords, what should you do?

Before running a password-cracking program on your company’s computers to check for weak passwords, get permission! Have a memo providing permission to do a very specific set of actions and then do not deviate from them without further written permission.

The End of Passwords?

9.

What is the likely future of passwords?

Passwords are likely to be phased out in the fairly near future primarily because they are such a significant weakness. Password cracking has gotten easier and faster, and users are limited in their ability to handle truly strong passwords.

Access Cards and Tokens Access Cards Tokens Proximity Access Tokens Addressing Loss and Theft 10.

a) Distinguish between magnetic stripe cards and smart cards.

A magnetic stripe card is a simple access card that can store authentication data.

A smart card looks like a magnetic stripe card but has a built-in microprocessor and memory. This allows smart cards to do processing for more sophisticated authentication. Smart cards can also give out information differentially to different applications. While magnetic stripe cards are passive, only containing data, smart cards are active. b) What are one-time-password tokens?

One-time-password tokens are small devices with displays that have a number that changes frequently. Users must type the current number into key locks or into their computer. c) What are USB tokens?

5–11 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

11.

A USB token is a small device that plugs into a computer’s USB port to identify the owner. d) What is the advantage of USB tokens compared to cards?

USB tokens can be used to authenticate a user without the cost of having a smart card reader attached to the PC. (All modern PCs have USB ports.) e) What is the attraction of proximity tokens?

Proximity tokens are attractive because they do not require physical contact with a reader or USB port, which is faster than directly interacting with a device. a) Why is it important to disable lost or stolen access devices?

If you do not disable them immediately and they are stolen, they can still be used by the thief indefinitely. b) Give an example of two-factor authentication not mentioned in the text.

Student answers will vary. c) What is a PIN? A PIN is a personal identification number. It is a short number you type in manually to authenticate yourself, often in conjunction with another authentication factor. d) Why can PINs be short—only four to six digits—while passwords must be much longer?

Passwords need to be long because attackers can try millions of comparisons per second. However, people must enter PINs manually, so attackers can only enter a PIN every second or two. In addition, someone standing over an access door, trying many PIN codes, would be highly conspicuous and therefore vulnerable to detection.

Biometric Authentication Biometrics 12.

a) What is biometric authentication?

Biometric authentication is authentication based on biological metrics. b) On what two things about you is biometric authentication based?

Biometric authentication is based upon something you are (i.e., a physical feature) and something you do (i.e., an action). c) What is the major promise of biometrics?

The major promise of biometrics is to make reusable passwords obsolete.

Biometric Systems 13.

a) Describe the three scanner actions in the enrollment process.

5–12 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

First, the reader scans each person’s biometric data.

The reader then processes the enrollment scan to extract a few key features from the mass of scanned data.

Finally, the reader sends the key feature data to the database, which stores the key feature data as the user’s template. b) What are key features?

Key features are specific metrics extracted from the scanning data. Two scans will never give the same scanning data, but they should give generally the same key features, such as the relative locations of arches and whorls in a fingerprint. c) Why are they necessary?

Key features are necessary because raw biometric scans will be different each time due to nuanced actions (e.g., pressure, angle of scanning, interfering substance, etc.), but key features will be the same (or almost the same) no matter how a finger is scanned. d) What does the server do with the key features created by the enrollment scan?

It uses these key features as the template for that user. e) What is a template?

A template is the file entry containing key features from the enrollment process for a single individual. f) What is user access data?

This is data collected during an access attempt scan, as opposed to the scanning data during enrollment. g) What are match indices, and how are they related to decision criteria?

A match index compares access key features with the template. Because scanning never works exactly the same way twice, if the match index is close enough to satisfy the system’s configurable decision criteria, the supplicant is accepted.

Biometric Errors 14.

a) In biometrics, what is a match?

In biometrics, a match occurs when a match index (a comparison of access key features and the template) meets the decision criteria. b) Distinguish between false acceptances and false rejections.

A false acceptance occurs when a person is improperly matched to a template.

False rejection occurs when a person is improperly not matched to a template. c) What are false acceptance rates (FARs) and false rejection rates (FRRs)?

These are the percentages of time there is a false acceptance or a false rejection from a scan. d) For computer access, why is a false acceptance bad?

For computer access, false acceptance is bad because someone other than the authorized user, possibly an imposter, will gain access to the resource.

5–13 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

15.

16.

e) Why is a false rejection bad?

False rejection is bad because a legitimate user is denied access to a resource. f) Which is worse from a security viewpoint?

For computer access, a false acceptance is worse because it allows an unauthorized person through the door, giving the person access to sensitive building space. g) Which is worse from a user acceptance viewpoint?

A false rejection, because it lets an attacker in a) For watch lists of criminals, what is a false acceptance?

For watch lists of criminals, a false acceptance means that an innocent person is identified as a criminal. b) For watch lists of criminals, which is worse from a security viewpoint, a false acceptance or a false rejection? Explain.

For a watch list of criminals, false rejection is worse from a security viewpoint because it means a criminal was not identified. c) For watch lists of people who should be allowed to enter a room, which is worse from a security viewpoint, a false acceptance or a false rejection? Explain.

From a security viewpoint, a false acceptance is a worse error because it means a non-authorized person has improperly gained access to a resource. A false rejection would merely keep an authorized user out of the space, which is an inconvenience, but harmless in most cases.

What is failure to enroll?

Failure to enroll is an error that occurs if a system will not enroll a user, for example if a person does not have well-defined fingerprints.

Verification, Identification, and Watch Lists 17.

a) Distinguish between verification and identification.

Verification is an action wherein the verifier determines whether the supplicant is the particular person he or she has claimed to be.

In identification, the verifier determines the identity of the supplicant; the supplicant does not claim to be a particular person. b) Which requires more matches against templates?

Identification requires more matches against templates than verification because in verification, a supplicant is claiming a specific identity. In identification, no identity is being claimed, so the verifier has to review the templates for all users. c) Which is more likely to generate a false acceptance? Why? There is a small chance of a false acceptance every time a match is attempted.

Because identification requires checking the supplicant against every template in a system, there is a greater chance that identification will generate a false

5–14 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

18.

acceptance than verification (which compares the supplicant with only one template). d) Compare identification with watch list matching.

Watch list matching is a form of identification that identifies a person as being a member of a group. For instance, the matches may be made against the templates of people on a terrorist watch list. A match has to be attempted against each template in the list. e) Which is more likely to generate a false match? Why? There is a small chance of a false acceptance with each match attempt.

Identification must attempt matches against all templates in the database. Watch lists only require match attempts against the templates of members of the group.

Therefore, identification is likely to generate more false matches. a) Suppose that the probability of a false acceptance is one in a million, that there are 10,000 identities in the database, and that there is a watch list with 100 people. What will be the FAR for verification?

Verification only attempts a single match.

The probability of a false acceptance for a single match is one in a million.

Therefore, the probability of a false acceptance of verification is one in a million. b) For identification?

Identification will attempt 10,000 matches.

The probability of a false acceptance for a single match is one in a million.

Therefore, the probability of a false acceptance of verification is 1/1,000,000 times 10,000 (i.e., 0.01).

Therefore, the probability of a false acceptance is 1%. c) For the watch list?

A watch list will attempt 100 matches.

The probability of a false acceptance for a single match is one in a million.

Therefore, the probability of a false acceptance of verification is 1/1,000,000 times 100 (i.e., 0.0001).

Therefore, the probability of a false acceptance is 0.01%.

Biometric Deception 19.

a) Distinguish between error rates and deception in biometrics.

Error rates measure accuracy when a supplicant is not trying to deceive the system.

In contrast, deception occurs when an attacker deliberately attempts to fool the system. b) Why may fingerprint scanning, which is often deceived, be acceptable for entry into a supply cabinet?

5–15 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Basically because a supply cabinet does not hold sensitive information and it is not likely to get attacked by a sophisticated attacker. c) When may it not be sufficient?

Fingerprint scanning may not be sufficient when it is used to control access to very sensitive or important resources and where the impact of deception is potentially very great.

Biometric Methods 20.

21.

a) What is the advantage of fingerprint recognition?

The main advantage of fingerprint recognition is that the technology of fingerprint scanners is inexpensive. b) What are the disadvantages?

The main disadvantage of fingerprint recognition is that it is easily deceived in all but the most advanced and expensive fingerprint scanner technologies. c) For what type of use is fingerprint recognition sufficient?

Fingerprint recognition should only be used in cases in which there is little danger of serious deception. An example would be logging into a personal computer that does not hold sensitive information. d) What is the advantage of iris recognition?

It is the most precise form of biometric authentication, with very low FARs. e) What are the disadvantages?

The main disadvantage of iris recognition is that the technology is very expensive. f) Does iris scanning shoot light into your eye?

No. a) What is the advantage of face recognition?

The main advantage of face recognition is that it can be used surreptitiously (i.e., without the subject’s knowledge). b) What does surreptitious mean?

Surreptitious means “without the subject’s knowledge.” c) Where is hand geometry recognition used?

Hand geometry recognition is used mostly in door access control. d) What are the disadvantages of voiceprint recognition?

One disadvantage of voiceprint recognition is that it is easily deceived by recordings. Another is that high false rejection rates make voice recognition frustrating to users. e) What are the most widely used forms of biometric authentication?

Fingerprint, iris, face, and hand geometry are the most widely used types of biometric authentication today. f) What is the most widely used form of biometrics?

5–16 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

The most widely used form of biometrics is fingerprint recognition, primarily because it is cheap.

Cryptographic Authentication Key Points from Chapter 3 Public Key Infrastructures 22.

a) What is the strongest form of authentication?

Cryptographic authentication is the strongest form of authentication. b) List the functions of a PKI. Creating public key–private key pairs.

Distributing digital certificates.

Accepting digital certificates.

Learning a certificate’s revocation status.

Provisioning new users and changing data on existing users.

Having strong initial authentication. c) Can a firm be its own certificate authority?

Yes. d) What is the advantage of doing so?

The advantage of being their own CA means that firms have control of trust in their entire PKI. e) Who creates a computer’s private key/public key pair?

Private/public key pairs are normally created on the client, versus the PKI server. f) How do CAs distribute public keys?

In digital certificates g) What is provisioning?

In the context of PKI, provisioning is the accepting of public keys and providing new digital certificates to the users (a very expensive component of the PKI). h) What is the prime authentication problem?

The prime authentication problem is that unless individuals are carefully vetted before being allowed in a system, imposters can simply enroll through social engineering. i) What can be done to reduce this risk?

The only thing that can be done to reduce the risk of the prime authentication problem is to have strong procedures for who may submit an account request, who may approve it (always a different party than the applicant), what 5–17 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

identification is required, and how to handle exceptions. The procedure must be carefully enforced and audited.

Authorization The Principle of Least Permissions 23.

a) Why are authorizations needed after a person is authenticated?

Simply knowing the identity of the communicating partner is not enough. The specific authorizations of the communicating party also need to be defined. Not everyone who is authenticated may be allowed to do anything he or she wishes in every directory. b) What is another name for authorizations?

Permissions c) What is the principle of least permissions?

The principle of least permissions is that each person should only get the permissions that he or she absolutely needs to do his or her job. In practice, this is very difficult to enforce, primarily because there are not enough security personnel to keep track of transient permission requirements. d) Why is it a good way to assign initial permissions?

Assigning as few permissions as necessary is a good way to assign permissions initially because it reduces potential points of vulnerability, possible unauthorized behaviors, and mitigates the damage an intruder may do. e) What is bad about assigning all permissions and then taking away the permissions a user does not need?

The bad thing about assigning all permissions and then taking away those that are not needed is that it is easy for security to mistakenly NOT remove a permission that is not required, thus allowing access beyond that which is authorized. f) What does failing safely mean in a security system?

Failing safely in a security system means that a failure is not likely to lead to security violations. The principal of least permissions ensures that users are not given too many permissions if an error is made.

5–18 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Auditing Logging Log Reading 24.

a) What is auditing?

Auditing records and analyzes what the person or program actually did, rather than what was theoretically authorized. b) Why is it necessary?

Unless authentication and authorization activities are audited frequently, improper behavior can go on for a very long time. c) Why is log reading important?

Logging records the actions that an account owner takes on a resource. Unless logs are studied/read, they are useless. d) What are the three types of actions that should be taken on log files?

They should be read regularly by someone who knows what he or she is looking at.

External auditing should be conducted periodically.

Automatic alerts should be established to provide security administrators with real-time feedback. e) Why are automatic alerts desirable?

Reading log files only tells you about the past. Ideally, logging systems should have active log-reading functions that send the security administrator real-time alerts for certain types of events.

Central Authentication Servers The Need for Centralized Authentication 25.

a) What are the three devices in central authentication using RADIUS servers?

The three devices in central authentication are the supplicant, authenticator, and RADIUS central authentication server. b) What is the role of the authenticator?

To send the supplicant’s credentials to the authentication server, and then to send a message of authentication back to the supplicant from the authentication server. c) What is the role of the central authentication server?

To test the validity of credentials provided by the user.

5–19 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Kerberos 26.

a) In Kerberos, distinguish between the ticket granting ticket and the service ticket.

The ticket granting ticket is the supplicant’s proof that it has already authenticated itself with the Kerberos server. The service ticket is an encrypted session key that only the verifier can decrypt (due to sharing a key with the Kerberos server in a separate communication). b) What information does the service ticket give the verifier?

The service ticket gives the verifier the symmetric session key to use with the supplicant. The session ticket may also contain permissions that the supplicant should have on the verifier. c) How does the supplicant get the symmetric session key?

The supplicant gets the symmetric session key from the Kerberos server when the service ticket is sent to the verifier; the session key from the Kerberos server is encrypted to be read only by the server and supplicant. d) Is the verifier notified explicitly that the supplicant has been authenticated? Explain.

The verifier is not notified explicitly that the supplicant has been authenticated.

Authentication is implicit in that if the supplicant has the symmetric session key to communicate with the verifier, it must have been authenticated with the Kerberos server (which generated the session key and would only give it out to an authenticated computer).

Directory Servers What Are Directory Servers?

Hierarchical Data Organization 27.

a) How is information in directory servers organized?

The information in directory servers is organized as a directory server database schema in a hierarchical collection of objects. b) What are the top two levels of the organization?

Top level is the Organization. This is the name of the organization.

Below the top level are organization units (OU). There can be many OU’s. c) Do directory servers only hold information about people?

They hold information about many other types of company resources, such as computers.

Lightweight Data Access Protocol 28.

What is LDAP’s purpose?

5–20 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

LDAP’s main purpose is to retrieve data from the directory server. However, it can also be used to update information in the directory server.

Use by Authentication Servers 29.

a) How do central authentication servers often get their authentication information?

Central authentication servers often get their authentication information from directory servers. b) What is the advantage of this?

It permits the directory server to be the company’s main repository for information.

Active Directory 30.

a) What is Microsoft’s directory server product?

Microsoft’s directory server product is active directory (AD). b) What is the smallest organizational unit in active directory?

The organizational unit c) What two things does a domain controller contain?

The domain controller contains an active directory database and a Kerberos authentication server program. d) Can a domain have multiple domain controllers?

Yes. e) What is the advantage of having multiple domain controllers?

The advantage is that having multiple domain controllers gives reliability in case one crashes or is successfully attacked. f) Into what larger structures are domains organized?

Trees g) Into what larger structure can trees be organized?

Forests h) Describe replication among domain controllers within a single AD domain.

Within a single AD domain, there is total replication between domain controllers. i) Describe replication between a domain controller in one domain and the domain controller in the parent domain.

There is partial replication of data to the next-higher-level database.

Trust 31.

a) Distinguish between mutual and one-way trust among AD domains.

In mutual trust, each directory server trusts the other.

5–21 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

In one-way trust, one directly server trusts the other, but there is no trust in the opposite direction. b) Distinguish between transitive and intransitive trust.

An example of transitive trust would be if A trusts B and B trusts C, then A trusts C automatically. An example of intransitive trust would be if A trusts B and B trusts C, but A does not trust C automatically. c) What principle should companies follow in making trust assignments?

Give only as much trust as necessary.

Full Identity Management Other Directory Servers and Metadirectories 32.

a) Why are metadirectory servers needed?

To coordinate information across different types of directory servers b) What do metadirectory servers do?

The metadirectory server allows the directory servers to exchange information and to synchronize services in a variety of ways.

Federated Identity Management Identity Management 33.

a) In federated identity management, do firms query one another’s identity management databases?

In federated identify management, firms do not query one another’s identity management databases. Instead, they send assertion statements that may include authenticity, authorization, and attribute information. b) What do they do instead?

They send assertions to each other. c) What risk does this method avoid for the firm sending the security assertion?

This method avoids the risk of potential attacks from the other company because the other company never gets direct access to corporate resources. d) How are risks to Firm B reduced?

The firms first carefully negotiate a contract. The contract specifies penalties if Firm A sends false assertions. e) What is a security assertion?

5–22 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

34.

An assertion is a statement from Firm A to Firm B that Firm B should accept as true if Firm B trusts Firm A. f) What three things may it contain?

Authenticity information, such as an employee is actually the employee by that name and has been authenticated by Firm A. Authorization information, stating that the employee is allowed to access Firm B’s services.

Attributes that describe features of the employee (such as spending limit, etc.). g) What is the main standard for one firm to send security assertion to another firm?

The main standard for sending security assertions today is the Security Assertion Markup Language (SAML). h) What is the major benefit of using XML? The major benefit of using XML in SAML is that it is platform-independent. This means that it does not matter what programming language either firm uses as long as they implement XML successfully. a) What is identity management?

Identify management is the centralized policy-based management of all information required for access to corporate systems by people, machines, programs, or other resources. b) What are the benefits of identity management?

Reduced costs by reducing the work needed to manage user access, including provisioning, password resets, and so forth.

Enforcing consistency by permitting a single change on an identity management server to affect employee access permission on all servers in an organization.

Centralized auditing of all of an employee’s access permissions across a firm.

Possible use of single sign-on, or at least reduced sign on. c) What is SSO? Single sign-on allows a user to authenticate him or herself to the identity management server once. From that point on, whenever the user asks for access to a specific server, no additional logins are required. d) Why is full SSO generally impossible?

It is technically impossible. e) What is reduced sign-on?

It is single sign-on to some resources but not all resources, as in full SSO. f) What is an identity?

An identity is the set of attributes about a person or resource that must be revealed in a particular context. g) Why is providing minimum identity data an important principle?

You will not accidentally reveal information about yourself that you do not have to reveal and that may be used against you.

5–23 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

35.

a) In identity management, what are provisioning, reprovisioning, and deprovisioning?

Provisioning entails granting authorizations and authentications carefully and then changing them whenever roles or other conditions change. Reprovisioning occurs when there are changes. Deprovisioning occurs when the authorizations and authentications are no longer appropriate (e.g., when an employee leaves the company, etc.). b) Why is decentralized management desirable?

Decentralized management is desirable because identities should be managed by people closest to the situation. c) Why are self-service functions desirable?

To reduce costs of the identity management staff d) What changes should be made through self-service functions?

Only non-sensitive information changes should be made through self-service functions.

Trust and Risk 36.

a) In what sense is identity management really just another form of risk management?

Identity management allows risk reduction by reducing risk from individuals accessing computer resources to acceptable levels. Risk reduction is the primary risk management technique. b) How can identity management reduce risk?

Identity management can reduce risk by limiting the amount of potential damage an employee can do based on computer resource privileges, as well as allows detection of malicious activities in real-time (via auditing). c) How much should companies spend on identity management?

A company must balance these risk reductions with the amount of money that identity management will cost to implement over their entire life cycle.

Conclusion Synopsis Thought Questions 1.

2.

Reusable passwords offer poor security. What do you think is holding back their replacement with other approaches?

Reusable passwords are still being used primarily because they are free.

Create two good password reset questions. For each, explain why you think it is a good question.

5–24 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

3.

4.

“Who is your favorite author?” This is a good question because it would be difficult for an imposter to know this and the number of possible choices among authors is significant. Of course, this implies that you have a favorite author. One caution is that the person must spell the author’s name the same way he or she did when first given the clue, including spacing and capitalization.

“What is your favorite movie?” This is a good question for the same reasons as above. It also has the same caution.

“What is your favorite beverage?” This seems like a good question because it’s easy to remember, there are many variations, and it can be as detailed or general as an individual wants it to be.

Overall, the questions should be legal, easy to remember, but difficult enough so that an impostor can’t make a good guess.

Someone says that they wish to protect their desktop PC from a walk-up attacker with a password or passwords. Give them advice and reasons for your advice. This is not very short answer.

There are several actions you can take to protect a PC from a walk-up attack.

First, your computer should be sited such that it limits the ability of a walk-up attacker to gain access to your PC or view information on the screen. Second, the use of passwords is much better than having no protection, but if not implemented properly, can offer little to no protection. Specific recommendations regarding the use of passwords include: Make sure you use a strong password that is very difficult to crack. This means at least 12 characters long and including upper and lower case letters, numbers, and special characters. Ideally, this password should be randomly generated. Do not use passwords that are dictionary words, even with the character requirements stated above, because Hybrid Dictionary attacks will quickly crack such a password.

Do not share your password with anyone. If you are afraid of locking yourself out, write your password, seal it in an envelope, and store it in a safe place, such as a locked filing cabinet.

Do not write your password down and keep it somewhere near the computer for convenience. This is a very common error that attackers know about and exploit frequently.

Make sure you use screensavers with password protection enabled.

Change your passwords at least every 90 days, and do not use the same password on multiple systems or sites. The longer or more often you use a password, the greater the chance it will be compromised.

If you can afford it, look into getting a biometric fingerprint scanner to use instead of using passwords. You can’t forget your fingerprint. Fingerprint scanners are not perfect, but they generally provide better protection than passwords, at a low cost, and have the added benefit of not having to remember another password. a) Give two situations in which the risk of deception is high.

5–25 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

5.

6.

7.

One situation would be when someone is trying to hide his or her face from cameras used for face identification. Another example would be to impersonate someone by using a gelatin finger on a fingerprint scanner. b) Give two situations in which the risk of deception is low.

Use of fingerprint scanners on a personal PDA Access to a corporate storeroom with little property of use to a hacker.

Your friend wants to secure his or her desktop PC with fingerprint scanning or password access protection. Give your friend the information that he or she should know to make the decision. Consider alternatives. This is not very short answer.

Fingerprint scanning is recommended because it generally reliable and better than passwords in most cases. Passwords are the most common mechanism to secure a PC, but it is hard to implement strong security using passwords.

What do FRRs mean when fingerprint scanning is used to secure a PC against walk-up attacks? What might produce high FRRs? Can you think of a way that this problem could be reduced in fingerprint scanning?

FRRs when fingerprint scanning is used to secure a PC against a walk-up attack means that the legitimate user won’t be able to access his or her PC. High FRRs in this case can be caused by a faulty or dirty scanner input device, dirty hands, a cut or other blemish that obscures the fingerprint, and improper use (e.g., poor finger placement on the reader).

High FRRs can be reduced by following some standard guidelines of use that include consistent finger placement on the scanner, ensuring that both the finger and reader are clean, and registering more than one finger in the system in case one gets mangled.

Some airports are installing face recognition systems to identify terrorists and criminals.

About one in a million people passing through the airport is a terrorist. Suppose the FAR is about 1 percent. The FRR is about 30 percent. Is this system likely to be workable?

Explain using a spreadsheet analysis with reasonable assumptions. Cut and paste the spreadsheet analysis into your homework file instead of handing it in separately. Give a short paragraph supporting your conclusion.

Terminal visitors

10,000,000

Terrorists

10

FRR

30%

Terrorists identified

7

Legitimate passengers

9,999,990

FAR

1%

Passengers incorrectly identified

5–26 .

99,999.9

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko Fraction of identified people who are terrorists

8.

9.

10.

1/14,286

For every terrorist correctly identified, over 14,000 passengers would be incorrectly identified for screening. It is doubtful that screeners could maintain vigilance with this ratio of false positives to true positives.

Centralizing authentication and authorization reduces cost, improves consistency, and permits rapid provisioning and changes. List the technologies on the way toward greater centralization, beginning with stand-alone authenticators through corporate metadirectory servers.

Stand-alone authenticators: The least centralized, and requires individual changes on each and every authenticator to ensure consistency.

Central authentication servers Directory Servers: Central repositories for information about people, software, equipment, and databases. Used to update multiple RADIUS, Kerberos, and other authentication servers in large networks.

Metadirectory server: Synchronizes authentication across disparate directory servers (e.g., Active Directory, Sun ONE, etc).

Suppose that the probability of a false acceptance is 0.0001 per match attempt. Suppose that there are 1,000 templates in the database. What is the probability of a false acceptance in the case of verification? What is the probability of a false acceptance in the case of identification? What is the probability of a false acceptance if there is a watch list of 50 people who should be given access to a system?

The probability of a false acceptance of verification is .0001 = .01%, because only 1 match index is compared in verification.

The probability of a false acceptance of identification is 1000 x .0001 = .1 = 10%, because all the templates are compared with the match index in identification.

The probability of false acceptance of the watch list = 50 x .0001 = .005 = .5%.

List at least six identities for yourself that require different authentication and authorizations.

Student answers will vary. Here are some examples from graduate students: “Access to the Graduate Lab computers at Shidler. Had to authenticate myself not only as a student taking classes at UH, but also enrolled in a business/ITM class.

For permissions, I was given access to the graduate lab (but not the faculty lounge).”

“UH Wireless user. Authentication is via the use of my UH id and password.

Authorizations are set by the ITS department and include access to some of my student records and the Internet.”

“CIS PhD student. Authentication is via personal verification by the Dept Chair.

Authorizations include access to the CIS Student and CIS Program LISTSERV accounts and the Students section of the CIS home page.”

5–27 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

11.

“Online Bank. Authentication is via a combination of a unique access number, part of my SSN, and a unique password. Authorization includes complete user access to my account for viewing, transfers, etc.”

“Home network administrator. Authentication after initial setup is knowing the IP address of the router (publicly available depending on model) and the Administrator password, which I changed upon initial install. Authorizations are full configuration control of the router/access point.”

“Access to military bases. Authentication is based upon having a valid military ID and, in some bases on Oahu, a valid military decal on my car. Authorizations are access to only public areas of the base unless I have separate authorization for controlled areas (such as the shipyard, which I don’t).”

Your company installs a face recognition system for door access. a) Its FRR is much worse than the vendor’s claims. What might be causing this?

An FRR worse than vendor claims is not that unusual. Vendor claims are likely exaggerated, as they base their claims upon ideal recognition conditions (e.g., perfect lighting, an unobscured view of the face, a small number of templates to compare with, etc.). In reality, the company’s implementation of a face recognition system is under conditions far from ideal, thus the lower than expected FRR. b) The system’s FRR increases over time. What might be causing this?

Over time, the number of templates in the system for comparison will surely increase. Given a static false rejection probability, the FRR will increase with the number of templates. In addition, people’s faces will change over time.

Hands-on Projects NOTE: Screenshots for individual students will vary.

PROJECT 1 In this project, you are going to run JtR in a command prompt (DOS). You are going to perform both a dictionary attack and a brute-force attack on a sample password file that you will download from www.pearsonhighered.com/boyle/.

1. Make a folder labeled “security” on your C: drive (C:\security\).

2. Download JtR from http://www.openwall.com/john/.

3. Scroll down and click on the link labeled John the Ripper 1.9.0 (64-bit Windows binaries).

Download the latest version available.

4. Click Save.

5. Select your C:\security folder. (If you haven't already created this folder, you will need to do so now.)

6. If the program doesn’t automatically open, browse to C:\security.

7. Right-click john-1.9.0-jumbo-1-win64.zip. (If a later version is available, this file may have a slightly different name.)

5–28 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

8. Select Extract All and Extract.

9.

Download the sample password database labeled "hackme.txt" from www.pearsonhighered.com/boyle/. (The files may be listed underCompanion Website, Chapter 5, and Student Project Files. This is the file containing a list of sample password hashes.)

10. Extract all of the student project files (including hackme.txt) into your C:\security folder.

11. Copy the "hackme.txt" file from the student project folder to C:\security\john-1.9.0-jumbo-1win64\run. (It is important that the hackme.txt file be in the "run" directory with the JtR executable.)

12. Click Start.

13. In the search box, type cmd 14. Press Enter. (This will open a command prompt.)

15. Type “cd ..” (without quotes) in the command prompt.

16. Press Enter. (This will move up one directory.)

17. Type “cd ..” (without quotes) in the command prompt.

18. Press Enter. (This will move up one directory. You should now be at the C:\) 19. Type cd security.

20. Press Enter. (This will move you into the C:\security directory.)

21. Type cd john-1.9.0-jumbo-1-win64.

22. Press Enter. (This will move you into the C:\security\john-1.9.0-jumbo-1-win64.)

23. Type cd run 24. Press Enter. (This will move you into the C:\security\john-1.9.0-jumbo-1-win64\run directory.)

25. Type dir 26. Press Enter. (This will give you a listing of the files in the “run” directory. You can confirm that both john.exe and hackme.txt are in this directory 27. Type john.exe -wordlist=password.lst hackme.txt 28. Press Enter. (This will start a dictionary attack using a built-in dictionary (password.lst) that came with JtR. The extension on password.lst file is ".lst" where the “l” is an L as in lemon.)

29. Type time.

30. Press Enter twice. (This will provide a timestamp.)

31. Take a screenshot.

32. Type john.exe hackme.txt.

33. Press Enter. (This will start a brute-force attack. JtR will start trying all possible combinations until it cracks all of the passwords. The passwords you see were cracked in addition to the ones found during the dictionary attack.)

34. Stop the brute-force attack by pressing Ctrl-C. (You can let it run for a couple minutes.)

35. Take a screenshot.36. Type notepad john.pot 37. Press Enter twice. (This will open the john.pot file where the cracked passwords are stored.)

38. Take a screenshot showing hashes and passwords you have cracked.

5–29 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Project 2 Let’s see if you’ve been involved in a data breach. In this project you’ll look up one or more of your e-mail address and see if they’ve been part of a past data breach. Troy Hunt’s website Have I Been Pwned allows users to search through a database of past data breaches to see if their data was lost. It’s a great way to show people how vulnerable they really are. Most people forget about data breaches a few days after they happen.

As you search for your e-mail addresses in this list think about how many other sites may be at risk because you may have used the same password across multiple sites. Also, read through the data breach, listing details about when the breach occurs, and when the company notified users. There’s often a large gap between the two. This gap puts you at risk. You don’t know your credentials have been lost, so you keep using the same compromised passwords to protect your data. This is why it’s important to change your passwords often.

1. Go to https://haveibeenpwned.com.

2. Enter one of the e-mail addresses you use on a regular basis.

3. Click pwned.

4. Take a screenshot.

5. Take note of the number of times your data has been compromised.

6. Look up another one of your e-mail addresses.

7. Take a screenshot of the results.

8. Look up an e-mail address of someone you know.

9. Take a screenshot of the results.

10. Go back to https://haveibeenpwned.com.

11. Scroll down and click on one of the links to a large data breach.

12. Take a screenshot.

13. Go back to https://haveibeenpwned.com.

14. Scroll down and click on one of the links to a recent data breach.

15. Take a screenshot.

Project Thought Questions How does the cracking program actually “crack” the password?

It compares results from word lists (or brute force attempts) with the encrypted password, using the same encryption method. If they match, then the password is known.

2.

If you used a larger wordlist, would it crack the passwords faster?

Yes, if you use larger wordlists, the probability of cracking a given percentage of passwords will increase (in general).

3.

Can you use foreign language wordlists?

Yes, using foreign wordlists is very easy. People mistakenly believe that using foreign wordlists protects them from password crackers. This is errant thinking.

At a fundamental level, computers only see 1s and 0s. Foreign words can just as easily be broken down to 1s and 0s.

4.

Why do special characters (e.g., @#$%^&*) make passwords difficult to crack?

They are rarely used so they make passwords more difficult to crack using brute force cracking.

1.

5–30 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

The larger character set used, the more possible combinations the password cracker has to calculate. Adding these special characters greatly increases the strength of the password.5. Why does a change of case help make a stronger password?

Adding a change of case greatly increases the strength of the password because it doubles the number of possible characters you can use in your password. A lowercase “a” and an uppercase “A” are two different characters. Each new character doubles the number of total possible password combinations.6. Were you in any data breaches? Which ones?Student answers will vary.

7.

Were any of your other e-mail addresses or e-mail addresses of friends listed in data breaches?

Student answers will vary.

8.

How could the delay in data breach notification hurt users?

There is often a large gap between when a data breach occurs and when the company notifies users. This gap puts the user at risk. They don’t know their credentials have been lost, so they keep using the same compromised passwords to protect their data. This leaves access to accounts open to further abuse. 9. Why would you want to avoid using your name in your e-mail address? (i.e., Could you be identified in a data breach of an embarrassing site?)Using your own name in your email address strips a potential layer of anonymity for maintaining privacy. People who know your name may find your email address easily and vice versa.10.

Do you use the same password for multiple accounts? Why would this be a security risk?

Most people use the same password for multiple accounts. They just don’t want to have to remember a dozen or more strong passwords. It’s a good idea to have several different passwords to prevent all of your accounts from being compromised from the loss of a single password.

Case Discussion Questions 1.

2.

3.

How can cross-pollination of user credentials be harmful to users and businesses?

Cross-pollination of user credentials across multiple sites can be harmful to users and businesses because it allows an attacker to access multiple systems after stealing the credentials from a single system. In essence, a company with the weakest security causes failures at companies with stronger security. The linking of credentials can weaken the overall effectiveness of a company’s security because those credentials may be stolen from a company with weaker security.

How can businesses mitigate the negative effects of cross-pollination between organizations?

Businesses can mitigate the negative effects of cross-pollination between organizations by encouraging users not to reuse their credentials from other sites.

They can enforce a stronger password policy than used at other sites. They can make sure all user passwords are encrypted.

How do weak security policies and practices affect businesses?

5–31 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

4.

5.

6.

7.

8.

9.

10.

This is a very broad question that can be answered in many different ways. In this case, weak security policies and practices affect businesses by allowing attackers to steal customer credentials. This, in turn, leads to direct reputational and monetary losses.

How might the weak security practices in one organization harm other organizations?

Weak security practices in one organization can hurt another organization if both organizations share a common connection (e.g., user base, integrated systems, etc.). For example, suppose user credentials are stolen from a company that did not encrypt users’ passwords. These unencrypted passwords could then be used to gain access to user accounts at a completely different company.

How would two-factor authentication improve the security of user accounts?

Two-factor authentication can improve security by removing a single-point of failure (i.e., a password). In this case, Apple sends users a passcode via SMS to be used in conjunction with their password. Even if attackers were able to steal a user’s password, they couldn’t manipulate the account without the passcode.

What are some new risks facing “hyperextended” organizations?

Hyperextended organizations face unique risks because it is harder to secure them from attacks. Hyperextended organizations do not have a “perimeter” to defend.

They also have a multitude of devices and applications. It becomes even more difficult to protect sensitive corporate data in hyperextended organizations.

How could an organization become more secure by reining in their protection environment?

Organizations can become more secure if they curtail the use of security resources to protect extraneous information assets, stored data, and devices.

What are the benefits of competitive centrally provided security services?

By delivering at least some components of information security as a set of centralized services, a company can achieve not only increased efficiencies, but also better risk management.

How could a business proactively embrace new technology in a secure manner?

Develop a roadmap and set realistic expectations for the business. Understand the risks and devise a plan to mitigate the risks. Also, keep an eye on emerging technologies that are being implemented for other reasons, but may actually help decrease security risks.

Why should businesses shift their focus from protecting their containers to protecting their data?

More and more, enterprise data is processed and stored in containers not controlled by the enterprise. For instance, the data may be processed by service provider facilities, held in a PDA used by an individual employee, or in a laptop used by a contractor with multiple enterprise clients. Therefore, security needs to shift the focus from protecting the container to protecting the data.

5–32 .

Chapter 5: Access Control Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Perspective Questions 1.

2.

What information in this chapter was the most surprising for you?

Student answers will differ.

What material in this chapter was the most difficult for you?

Student answers will differ.

5–33 .

.

Instructor’s Manual

Chapter 6:

Firewalls Learning Objectives After studying this chapter, students should be able to: ➢ Define firewalls in general (basic operation, architecture, the problem of overload). ➢ Describe how static packet filtering works. ➢ Explain stateful packet inspection (SPI) for main border firewalls. ➢ Describe how network address translation (NAT) works. ➢ Explain application proxy firewalls and content filtering in SPI firewalls. ➢ Distinguish between intrusion detection systems (IDSs) and intrusion prevention systems (IPSs). ➢ Describe antivirus filtering. ➢ Define firewall architectures. ➢ Describe firewall management (defining policies, implementing policies, reading log files). ➢ Describe some difficult problems associated with firewalls.

.

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Teaching Suggestions Special Issues The chapter discusses a number of firewall filtering mechanisms. Students need to understand the details of each. This requires them to study the material structurally instead of just memorizing facts.

Stateful inspection is particularly difficult. Students need to keep in mind that different states have different rules. A question to keep asking the class as you go through the material is, “Which state are we in—connection-opening or ongoing communication.” What the firewall does is very different in the two states, and understanding what state is being described is absolutely critical.

Role in the Book Chapter 5 dealt broadly with access control. This chapter deals with a particular network-based access control tool—the firewall.

Although firewalls are not complete protections against network attack, and although border firewalls are increasingly being bypassed, firewalls are extremely important and deserve a full chapter. Too many security books give students only a quick overview of firewalls, turning the course into a “security appreciation” course instead of a security course.

Chapter 7 discusses the hardening of host operating systems. Chapter 8 discusses the hardening of the applications running on hosts.

Teaching the Material Flow of Material ➢ The chapter begins with basic firewall principles including basic operation for ingress and egress filtering. A key principle is that firewalls only drop provable attack packets— not suspicious packets. The Introduction also notes that more sophisticated firewall filtering requires more processing power. In addition, if there is insufficient processing power, the firewall will drop the packets it cannot process whether or not they are attack packets. ➢ The first filtering method is static packet filtering, which filters one packet at a time in isolation and only looks at certain Internet and transport layer fields. Once popular, static packet filtering only is a secondary filtering mechanism today. ➢ The chapter then describes stateful packet inspection (SPI). This is the main firewall filtering mechanism for border firewalls today, as well as for internal firewalls and host firewalls. The discussion of SPI filtering is extensive. ➢ Next comes network address translation (NAT), which does not do filtering per se but offers strong protections and is often used in conjunction with firewall filtering. ➢ The next topic is application proxy firewalls, which do application-layer filtering.

Created around the same time as static packet inspection, application proxy firewalls are 6–2 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

no longer dominant but are still widely used to protect individual servers and in other special cases. Their problem is not poor filtering but rather processing intensiveness that makes them unsuitable for main border firewalls. This section also discusses how SPI firewalls do application content inspection and how SPI application content inspection compares with application proxy firewall filtering. ➢ Traditionally, firewalls have dropped provable attack packets. In response, intrusion detection systems (IDSs) have long produced warnings for suspicious attack packets.

Intrusion prevention systems (IPSs) are IDSs that drop highly suspicious packets. ➢ The chapter then discusses how antivirus filtering is handled when firewalls are used. ➢ Now the chapter turns to management, beginning with a discussion of firewall architectures—how a company’s various firewalls are organized into a coherent system of filtering. ➢ The chapter then discusses policy-based firewall management, including defining policies, implementing policies, and reading lot files. ➢ The chapter ends with a few difficult problems for firewalls.

Covering the Material When teaching this material, give lots of examples and constantly relate the bits and pieces of each topic together. Rely on the figures to do this as much as possible. You may want to toss in brief quizzes on material as it is covered, then go over the answers with the students.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master.

Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report. The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report. Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

6–3 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key

Introduction Basic Firewall Operation 1.

a) What is a pass/deny decision?

When the firewall receives a packet, it must decide whether to pass the packet or drop it. b) What type of packet does a firewall drop and log?

Firewalls will drop and log a provable attack packet. c) What does the firewall do about packets that it suspects (but cannot prove) are attack packets?

It will pass the packet because it’s not a provable attack packet. d) Why does the firewall log information about dropped packets?

To keep a record of it for later analysis e) Distinguish between border firewalls and internal firewalls.

Border firewalls sit at the boundary between the corporate website and the external Internet. Internal firewalls filter traffic passing between different parts of the website’s internal network. f) Distinguish between ingress and egress filtering.

In ingress filtering, the firewall examines packets entering the network from the outside, typically from the Internet. The purpose of ingress filtering is to stop attack packets from entering the firm’s internal network.

In egress filtering, by contrast, the firewall filters packets when they are leaving the network. This prevents replies to probe packets from leaving the network.

The Danger of Traffic Overload 2.

a) What does a firewall do if it cannot keep up with the traffic volume?

It will drop all the packets it cannot process. b) Why is this action good?

This action is good because the firewall will drop all packets not examined, not allowing unexamined attack packets into the network. c) Why is this action bad?

This action is bad because valid, non-attack packets will be dropped and effectively create a self-generated DoS attack.

6–4 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

d) Why can a firewall keep up with traffic in general but fail to do so during a major attack?

Firewalls are only able to filter traffic at wire speed, which is the maximum speed of the lines that connect to it. e) As processing power increases in the future, what will this mean for firewall filtering?

It means that firewalls will be able to do ever more sophisticated processing. f) What is unified threat management (UTM)?

Unified threat management (UTM) consists of a firewall handling all traditional firewall functions (e.g., SPI, ACLs, etc.) as well as additional security functions such as antivirus filtering, spam filtering, application proxy filtering, etc. g) What does it mean that a firewall should operate at wire speed?

Firewalls that operate at wire speed are able to filter traffic at the maximum speed of the network lines connected to it.

Firewall Filtering Mechanisms 3.

a) Is there only one firewall filtering mechanism?

No. b) What filtering mechanisms do almost all main border firewalls use?

Stateful packet inspection c) Do SPI firewalls only do stateful packet inspection?

SPI firewalls can do more than just stateful packet inspection.

Static Packet Filtering Looking at Packets One at a Time Looking Only at Some Fields in the Internet and Transport Headers Usefulness of Static Packet Filtering Perspective 4.

a) What are the two limitations of static packet filtering? Explain why each limitation is bad.

(1) By looking at only one packet at a time, static packet inspection does not stop attacks that can only be determined by knowing the packet’s place in a stream of traffic; in other words, no context is applied to the packet. For example, static 6–5 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

packet inspection cannot protect against a TCP half-open DoS attack because it only examines individual packets, versus determining the state of a connection and a related (or unrelated) packet.

(2) By only inspecting certain fields of the Internet and Transport headers, static packet inspection cannot stop attacks that utilize other portions of the packet. For example, attacks utilizing the data field of application messages will not be examined. b) For what two reasons do companies not use static packet filtering as the main filtering mechanism in border firewalls today?

For the two reasons mentioned in the previous question part c) In what two secondary ways do corporations sometimes use static packet filtering?

One way is that static packet filtering may be used as a secondary filtering mechanism on main border firewalls.

The other way is they may also be implemented in border routers, which lie between the Internet and the firewall.

Stateful Packet Inspection (SPI) Basic Operation 5.

a) What is a state?

A state is a distinct phase in a connection between two applications. b) Are most packets part of the connection-opening state or the ongoing communication state?

Most packets are part of the ongoing communication state. c) Why is the answer to Question 5b important for stateful packet inspection’s efficiency?

SPI efficiency is based upon the two categories of states – because most packets belong to ongoing communication, a different (and less expensive) set of filters can be used compared to connection opening states, which require more scrutiny, and thus are more expensive. d) What is a connection?

A connection is a persistent conversation between different programs on different computers. e) How is a connection between two programs on different computers represented?

A connection between two programs on different computers is represented by its socket (i.e., IP address: port).

6–6 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Packets that Do Not Attempt to Open Connections 6.

a) Give the simple stateful packet inspection firewall rule for packets that do not attempt to open connections.

When a packet arrives that does not attempt to open a connection, SPI firewall checks to see if it is part of a previously opened connection. If it is, then the packet is passed, usually without filtering. If it is not, the packet is dropped and logged. b) Is SPI filtering for packets that are part of ongoing communications usually simple and inexpensive? Explain.

Yes, simply because if the packet is part of an existing connection in the connection table, the packet is passed, usually without further filtering. If it is not part of an existing connection in the connection table, it is dropped and logged. c) UDP is connectionless. How is it possible for an SPI firewall to handle UDP connections?

SPI firewalls can treat UDP communications as if they were stateful by treating some certain UDP messages as connection opening attempts. If subsequent messages match the connection table for the UDP packet, the incoming UDP packet will be passed.

Packets That Do Attempt to Open a Connection 7.

Give the two simple default SPI firewall rules for packets that attempt to open connections.

Permit all attempts to open a connection from an internal host to an external host.

Deny all attempts from external hosts to open a connection with an internal host.

Access Control Lists (ACLs) for Connection-Opening Attempts 8.

a) For stateful packet inspection firewalls, what do ingress ACLs permit in general?

Ingress ACLs typically permit a specific type of externally originated connection to network resources. b) What do egress ACLs disallow in general in SPI firewalls?

SPI firewall egress ACLs disallow communication between internal and external hosts in specific ways. For example, an egress ACL can prevent ICMP Echo Reply messages from internal hosts from exiting the network. c) What do well-known port numbers designate?

Well-known port numbers designate specific applications running on a server. d) Is Error! Reference source not found. an ACL for ingress filtering or egress filtering?

Ingress filtering e) Why is Rule 2 in Error! Reference source not found. safer than Rule 1?

6–7 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

9.

10.

11.

Rule 2 is safer than Rule 1 because Rule 2 allows a connection to only a specific SMTP mail server, while Rule 1 allows connections to all internal webservers.

More limited access is safer than broader access. f) Which rule in the ACL in Error! Reference source not found. represents the default behavior of SPI firewalls for ingress connection-opening attempts?

Rule 3, denying all connections, represents the default SPI rule for ingress connection opening attempts.

Given the ACL in Error! Reference source not found., what would the firewall do with an incoming ICMP echo message? (This will require some thought. Think about how ICMP messages are encapsulated and what field in the IP header indicates that the packet’s data field contains an ICMP message.)

An incoming ICMP Echo message is a layer 3, connectionless message. The firewall using the ACL in Figure 6-10 would disallow the ICMP message because it does not meet Rule 1 or 2, so it would apply Rule 3 (deny).

Redo the ACL in Error! Reference source not found. to add rules for the following conditions. After Rule 1, create a rule that permits all connections to internal DNS servers. After the original Rule 2, create rules that permit connections to all Trivial File Transfer Protocol (TFTP) servers and that permit access to FTP Server 60.33.17.1. (Hint: Only allow an FTP supervisory connection; the SPI firewall will later open data connections automatically as needed.)

If TCP destination port = 80 or 443, then allow If TCP destination port = 53, then allow If TCP destination port = 25 AND destination IP = 60.47.3.35, then allow If TCP destination port = 21 AND destination IP = 60.33.17.1, then allow Disallow all connections a) In ingress and egress filtering, does an SPI firewall always consider its ACL rules when a new packet arrives that attempts to open a connection?

SPI firewalls always execute the ACL. b) In ingress and egress filtering, does an SPI firewall always consider its ACL rules when a new packet arrives that does not attempt to open a connection? (The answer was not specifically in this section.)

No.

Perspective on SPI Firewalls 12.

a) Why are stateful packet inspection firewalls inexpensive?

Stateful packet inspection firewalls are inexpensive because most packets are not connection opening requests. Determining whether to drop or pass a packet requires a simple connection table lookup, which is fast and cheap. b) In practice, are they fairly safe?

Yes, in practice, they are fairly safe.

6–8 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

c) Are SPI firewalls limited to SPI filtering?

No, they can implement other protections as well. d) What firewall inspection mechanism do nearly all main border firewalls today use?

Nearly all main border firewalls today use stateful packet inspection.

Network Address Translation (NAT) Sniffers Perspective on NAT 13.

a) When NAT is used, why can sniffers not learn anything about the internal IP addresses of internal hosts?

When using NAT firewalls, the IP addresses and port addresses of hosts are translated. Attackers can only see the translated IP addresses and port numbers. b) Why does NAT stop scanning probes?

Scanning probes are based on IP addresses and port numbers. Sniffers can only read translated IP addresses and port numbers, and these become invalid when connections end. If an attacker acts quickly, it can use translated information, but it is very difficult to act quickly. c) Why is NAT traversal necessary?

So applications that require true internal IP addresses and port numbers can still work when companies use NAT. d) Is a NAT traversal method easy to select?

No, selecting them can be complex because there are many NAT traversal methods and all have limitations.

Application Proxy Firewalls and Content Filtering Application Proxy Firewall Operation 14.

a) What distinguishes an application proxy firewall from static packet filtering firewalls and SPI firewalls?

Application proxy firewalls examine application messages while static packet filtering does not, nor do SPI firewalls. b) Distinguish between proxy programs and application proxy firewalls.

An application firewall has an application proxy program for each application it will filter.

6–9 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

c) If you will proxy four different applications, how many proxy programs will you need?

You will need four separate proxy programs. d) How many application proxy firewalls will you need at a minimum?

One application proxy firewall can support multiple proxy application programs, so you will need at least one application proxy firewall to support the four proxy programs. e) Can nearly all applications be proxied?

Only a few applications can be proxied. Most application proxies are HTTP or SMTP. f) Why is application proxy firewall operation processing-intensive?

Application proxy firewall operation is processing-intensive because it must maintain two connections for each client/server pair. g) Why do firms not use application proxy firewalls as main border firewalls?

They are not used as border firewalls because of the high processing load required to maintain the number of connections required by an application proxy firewall.

They simply would not be able to handle the traffic load. h) What are the two main roles of application proxy server firewalls today?

Protect internal clients from malicious external servers by forcing all client connections through the proxy, which examines the application content of all packets.

Sit between an internal server and external clients to protect the server by examining the application layer content of all incoming client requests for dangerous behavior.

Application Content Filtering in Stateful Packet Inspection Firewalls 15.

a) Do stateful packet inspection firewalls automatically do application content filtering?

Explain.

No, application content filtering is seen as an extra feature because stateful packet inspection firewalls don’t have to implement relay operation like application firewalls do. b) Do they have the slow speed of relay operation?

No, they do not do relay operation, so they do not suffer the slow speed of relay operation. c) What three advantages do application proxy firewalls have in protection that SPI firewalls with content inspection not have?

Application proxy firewalls always examine application layer content, are more capable of application layer content filtering, and use relay operation with two connections per client/server pair. d) Why are SPI content filtering firewalls faster than application proxy firewalls?

They do not use relay operation.

6–10 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Application Content Filtering for HTTP Client Protections Server Protections Other Protections 16.

a) What filtering actions were listed to protect clients from malicious webservers?

First, the proxy can inspect the URL and compare it with a table of blacklisted URLs that are known phishing sites, pornography sites, or recreational sites.

Second, the proxy can inspect scripts in downloaded webpages, dropping these webpages if the scripts appear to be malicious or if policies prohibit either certain types of scripts or all scripts.

Finally, the proxy can inspect the MIME type in an HTTP response message.

Files with certain MIME types might be allowed or dropped by policy. b) What filtering action was mentioned to prevent internal client misbehavior in HTTP? The filtering action that prevents internal client misbehavior in HTTP is for the HTTP proxy to examine outgoing packets from the internal client to the external webserver in order to detect client misbehavior. For example, the proxy can inspect the method in the URL header. While the HTTP GET method is generally safe, the POST method can send files out of the firm. Many firms drop any HTTP request message that uses the POST method in order to provide extrusion prevention. c) What two filtering actions were mentioned for protecting webservers from malicious clients?

First, the proxy can inspect the method in the URL header. The POST method will allow clients to upload files to the webserver. This might be disallowed by policy to prevent clients from uploading malware, pornography, or any other type of unapproved content.

Second, the HTTP proxy can filter out HTTP request messages that appear to contain SQL injection attacks. d) What three automatic protections do application proxy firewalls provide simply because of the way in which they operate?

The three automatic protections of application proxy firewalls are internal IP address hiding, header destruction, and protocol fidelity.

6–11 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Intrusion Detection Systems and Intrusion Prevention Systems Intrusion Detection Systems 17.

a) Distinguish between firewalls and IDSs. Firewalls only stop and log provable attack packets. IDSs identify suspicious packets that may or may not be part of an attack and alert network administrators of potential threats, but do not drop suspicious packets. b) Why are IDS alarms often a problem?

IDS alarms are often a problem because they tend to generate far too many false alarms or false positives. IDSs tend to be ignored after exhausted security staff members receive too many false alarms. c) What is a false positive?

A false positive is when an IDS issues an alarm for legitimate traffic. Another term is false alarm. d) What two types of filtering do IDSs use?

The two types of filtering IDSs use are Deep Packet Inspection and Packet Stream Analysis. e) Why is deep packet inspection important?

This is important because it looks at all fields in the packet, including the IP header, the TCP or UDP header, and the application message. Many attacks cannot be stopped if a firewall only looks at application content or only at internet and transport layer headers. f) Why is deep packet inspection processing-intensive?

Deep packet inspection is processing-intensive because it looks at every field in the packet, which takes more time and processing power. g) Why is packet stream analysis important?

Packet stream analysis is important because single packets are not enough to determine certain types of attacks. For example, it takes multiple packets to determine if a network is being systematically scanned, or if a TCP half-open DOS attack is occurring. h) Why does packet stream analysis place a heavy load on IDSs? Packet stream analysis requires the IDS to reassemble or maintain and compare many packets in order to determine if an attack is taking place; the increased packet total and reassembly places a heavy processing load on IDS.

Intrusion Prevention Systems 18.

a) Distinguish between IDSs and IPSs.

6–12 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Intrusion prevention systems (IPSs) actually stop attacks rather than detecting them and sending out alarms like IDSs do. b) Why is the attack identification confidence spectrum important in deciding whether to allow IPSs to stop specific attacks?

Because IDSs offer many false positives and alarms, the attack identification confidence spectrum allows the network security administrator to establish packet dropping policies that are based on a high degree of confidence that an attack is taking place.

IPS Actions 19.

a) What two actions can IPSs take when they identify an attack?

The two actions taken by IPSs when identifying an attack are to simply drop the packet like a traditional firewall, and to limit suspicious traffic to a certain percentage of the total bandwidth. b) Which can be the most effective?

Dropping packets c) Which can do the most damage?

Dropping packets is the most damaging because it can lead to lost packets that are important to a firm’s operations (such as orders, payment processing, etc).

Antivirus Filtering and Unified Threat Management 20.

a) How do firewalls and antivirus servers work together?

The packet will arrive at the firewall, and the firewall will decide what to do with it. To decide, the firewall will check its policy rules base. If the policy rules base says to pass a certain object to an antivirus server, the firewall will do so. Then the antivirus server will examine the object. b) Are antivirus servers limited to looking for viruses? Explain.

Antivirus servers can do more than just look for viruses. They can scan for worms, rootkits, phishing, Trojan horses, spam, malicious scripts, and other types of malware. c) What might the antivirus server do after it performs filtering?

After an antivirus server filters, it can drop the object, send it to the firewall to pass to the destination, or pass the object to the destination directly. d) What type of firewall does both traditional firewall filtering and antivirus filtering?

Unified Threat Management (UTM) firewalls provide both traditional and antivirus filtering. However, UTMs rarely offer best of breed services and should be considered for small offices only.

6–13 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Firewall Architectures Main Border Firewalls Screening Border Routers Internal Firewalls Host Firewalls 21.

a) Why are screening routers used in a firewall architecture?

The screening border router stops simple high-volume attacks and ensures that responses to external scanning probes cannot reach an external attacker. It economically reduces the load on the main border firewall. b) Why are internal firewalls desirable?

These are desirable because they control traffic flowing between different parts of the firm’s internal network. In contrast to border firewalls, they can stop internally generated attacks. c) Why is it easier to create appropriate ACL rules for server host firewalls than for border firewalls?

Most servers only have a single application or a few applications. It is easier to develop specific rules for a few applications than to develop rules for all internal hosts. d) How does the use of border, internal, and host firewalls provide defense in depth?

Their use provides defense in depth because if the main border firewall or an internal firewall has an ACL configuration error, individual hosts will still be protected.

The Demilitarized Zone (DMZ) 22.

a) What is a multihomed router?

It is a router that connects to three or more subnets. A tri-homed firewall has one connection to the internal network, one to the DMZ, and one to the border router (leading to the Internet). b) What is a DMZ? The DMZ (Demilitarized Zone) is a subnet that contains all of the servers and application proxy firewalls that must be accessible to the outside world. c) Why do companies use DMZs?

6–14 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

All externally initiated attempts must go to hosts in the DMZ. This permits companies to focus special attention on these hosts, which are under frequent external attack. It also keeps attackers from attacking internal hosts. d) What three types of hosts are placed in the DMZ? Public servers, application proxy firewalls, and external DNS servers e) Why do companies put public servers in the DMZ? Placing all hosts that must be available to the outside world in a single place, where protection can be concentrated, ensures that no externally initiated connections go to internal hosts. f) Why do companies put application proxy firewalls in the DMZ? Because they enforce a policy that all communication with the outside world must pass through the DMZ. g) What host names does the external DNS server know?

The external DNS server will only know the host name information for computers in the DMZ. h) Why do all hosts in the DMZ have to be hardened stringently?

DMZ hosts must be hardened stringently because they will be accessible to the outside world and will be frequently attacked.

Firewall Management Defining Firewall Polices Implementation 23.

a) Distinguish between firewall policies and ACL rules.

Firewall policies are high-level statements that reflect corporate security policies and guide firewall implementers. ACL rules are the implementations of the firewall policies at the firewall, and are very specific. b) Why is creating firewall policies desirable compared to just creating a list of ACL rules?

Creating firewall policies is more desirable than just creating a list of ACL rules because policies should be clearly understood in plain English, while allowing for the firewall administrator to implement ACL rules that fit the policies with maximum efficiency and lowest cost. It is always smart to state the requirement first, followed by the technical implementation; this prevents locking a network into antiquated equipment or techniques. c) Create three firewall policies not listed in the text.

6–15 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

24.

Allow the database server at Company A (that supplies critical parts to the company) to connect to the corporate database for inventories.

Only allow secure FTP connections.

Log all large (1MB>) file transfers.

Stop all inbound and outbound ICMP messages.

Drop inbound connections to TCP port 445 from hosts 192.168.4.0 through 192.168.20.255. a) Compare firewall hardening needs for firewall appliances, vendor-provided systems, and firewalls built on general-purpose computers.

For firewall appliances, a firm simply installs the appliance between its Internet access router and its internal network. Operation is largely automatic. Firewall appliances are hardened at the factory.

Firewall vendors often sell firewall computers that have pre-hardened versions of UNIX or Windows. These limit the ability of an organization to make mistakes in hardening the operating system.

Strong actions must be taken to harden the firewalls on general-purpose computers if the firm purchases the computers and installs the firewall software itself. b) List what centralized firewall management systems do.

Centralized firewall management systems use a firewall policy management server to centrally control many firewalls to ensure consistency and save time and money in firewall administration. It converts policies to ACLs and sends these ACLs to individual servers. c) What columns does the firewall policy database described in the text contain? Be able to describe each and what options it offers.

Policy number (self explanatory): Each policy has a unique number.

Source and destination: Can be host names, groups of IP addresses, subnets, etc.

The firewall administrator must manually define groups.

Service: Describes the service to be filtered (TCP http, UDP dns, ICMP, etc.).

Action: Describes what to do (usually pass, drop, or authenticate).

Track: Describes what the firewall should do after the action (log, nothing, alert, etc.).

Firewalls: Designated which firewall routers should be sent ACLs based upon the policy d) Why is vulnerability testing necessary?

ACLs are complex, based upon complex firewall policies that are not easy to translate to ACLs. Vulnerability testing is required to ensure errors in ACL creation are detected and fixed. e) Why should firewall policies govern both configuration and testing?

6–16 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

If firewall policies govern both, then testers can create tests based on policies. If tests fail, then either the configuration or the test violated the policy. The firm must decide which is wrong. f) What are the steps in firewall change management?

First, only certain people are allowed to request changes. Even fewer people should be allowed to approve changes. The requestor must be different from the approver.

Second, firewall changes should be implemented in the most restrictive manner that will pass the smallest number of additional packets.

Third, the change should be documented carefully and completely.

Fourth, the firewall should be vulnerability tested after each change, to make sure the change works and that all of the previous behavior is intact.

Fifth, the company should audit the change process frequently, to ensure compliance with procedures. g) Why is reading firewall logs important?

To develop an understanding of the changing threat environment. It will also help to determine what traffic is unusual. h) What is the most time-consuming part of firewall management?

The most time-consuming part of firewall management is reading firewall logs.

6–17 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Understanding How to Read Firewall Logs Log Files Sorting the Log File by Rule Echo Probes External Access to All Internal FTP Servers Attempted Access to Internal Webservers Incoming Packet with a Private IP Source Address Lack of Capacity Perspective Size of Log Files Logging All Packets 25.

a) What packets are usually logged in log files?

Dropped packets from firewalls are usually logged in log files. b) Name the fields in the log file shown in Error! Reference source not found.?

ID number for the packet dropping event.

Time: The time the packet arrived at the firewall.

Rule: The rule that caused the packet to be dropped.

Source and destination IP addresses found in the dropped packet.

Service: The service requested in the dropped packet. c) In the examples given, by what field was the log file sorted?

In Figure 6-25, the log file is sorted by ID number.

The log file is sorted by the time field at which the packet arrived at the firewall. d) From the log file, what could we infer about the echo probe attack?

The log file shows that a majority of the Echo probes are coming from the same IP (14.17.3.139), targeting successive client IP addresses. It appears the attacker is

6–18 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

trying to map the internal network based on receiving Echo Request reply messages. e) Did this attack seem to be serious? Explain.

The attack does not seem to be serious. This appears to be an attacker trying to map a network for IP addresses and host OS. The more serious attacks could be coming after the mapping. f) From the log file, what could we infer about the FTP attack?

It appears that the primary target of the FTP attack is the .56 server. The source IP addresses are never the same, but it does include the 14.17.3.139 host that is trying to map the network. It is possible that the attacker is trying to access the FTP server using several zombie machines. g) Did this attack seem to be serious? Explain.

This attack is more serious than the Echo mapping attack because it is targeting a specific host with multiple different computers. The attacker knows there is a server at that IP address and is trying to gain access via multiple captured hosts. h) Why was the dropping of a single packet because of lack of firewall capacity a cause for concern?

Dropping any packets in such a short capture because of lack of capacity indicates that there is insufficient firewall capacity that must be addressed immediately. i) What cannot be determined if log files cover too short a period of time?

If the log files cover too short a period of time, you lose the ability to examine attacks that take place over a considerable period of time. j) Why is it difficult for a log file to cover a long period of time?

It is difficult for a log file to cover a long period of time because long log files require a great deal of disk capacity. k) What is the advantage of logging all packets passing through a firewall?

A firm can see packets from an attacker that were not dropped by the firewall because it could not identify them as provable attack packets. l) Why is logging all packets problematic?

Logging all packets makes for very large log files, which means the period of logging is shorter for the same amount of log storage capacity than if only provable attack packets are logged.

Firewall Filtering Problems The Death of the Perimeter 26.

a) How can attackers avoid the border firewall?

6–19 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Attackers can avoid the border firewall by becoming an internal attacker, attacking internal hosts not protected by the border firewall, or entering or attacking though a wireless access point. b) How has the perimeter extended outside the site?

It has extended outside the site by remote employees giving access.

Consultants, outsources, customers, suppliers, and other subsidiaries must be given access.

Essentially, all of these tend to use VPNs to make external parties “internal” to your site. c) How can firms react to this decline in the effectiveness of border firewall filtering?

Firms will have to increasingly rely upon hardening internal hosts against attacks as the effectiveness of the border firewall declines.

Attack Signatures versus Anomaly Detection 27.

a) Distinguish between signature detection and anomaly detection.

Signature detection relies upon a unique pattern in the network traffic to identify the threat (like an attack fingerprint). Anomaly detection looks at traffic patterns for deviations from set norms in order to identify possible attacks. b) What is a zero-day attack?

A zero-day attack is one that is made before attack signatures for the threat are defined for firewalls and antivirus programs to use. c) Why are zero-day attacks impossible to stop with attack signatures?

Zero-day attacks do not yet have attack signatures, therefore firewalls and antivirus programs will not be able to detect the attack. d) What is the promise of anomaly detection?

The promise of anomaly detection is that they could stop attacks without known attack signatures, such as zero-day attacks. e) Why is anomaly detection becoming critical for firewalls?

Given the speed with which vulnerability exploits, worms, and viruses are beginning to spread, depending solely on attack signatures is not reliable, so anomaly detection is essential in firewalls today.

6–20 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Conclusion Synopsis Thought Questions 1.

2.

3.

4.

5.

Modify the ACL in Error! Reference source not found. to permit externally initiated connections to an SNMP network management server, 60.47.3.103, and to allow both regular and SSL/TLS connections to the internal webserver 60.47.3.137 but not to other webservers.

1.

If TCP destination port = 80 or TCP destination port = 443, then Allow Connection 2.

If TCP destination port = 80 or 443 AND destination IP = 60.47.3.137, then Allow Connection This actually is not needed because Rule 1 allows all connections.

3.

If UDP destination port = 161 AND destination IP = 60.47.3.103, then Allow Connection 4.

TCP destination port = 25 AND destination IP = 60.47.3.35, then Allow Connection 5.

Disallow ALL connections The ACL in Error! Reference source not found. is in effect. A packet containing a TCP SYN segment reaches a stateful packet inspection firewall from the outside. What actions will the SPI firewall take?

This is a connection-opening attempt, so the firewall goes through the ACL. It will then go through each rule in order.

If the firewall gets to the last rule, it will disallow the connection.

The ACL in Error! Reference source not found. is in effect. A packet containing a TCP ACK segment reaches a stateful packet inspection firewall from the outside. What actions will the SPI firewall take? Explain.

A TCP ACK is not a connection-opening request, so the SPI firewall will check the connection table to see if the TCP ACK matches an already open connection.

If the connection is valid, the segment is passed. If the connection is not in the connection table, the segment is dropped and logged.

Create an egress ACL for an SPI firewall if policy only forbids connections to external FTP servers.

1.

If TCP destination port = 21 or 22, then disallow 2.

Allow all connections Contrast what sniffers can learn if a company being attacked uses NAT or an application proxy server.

When a company uses NAT, a sniffer will only be able to see the translated IP address and port number of an internal host.

6–21 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

6.

7.

8.

With an application proxy server, the IP address of every packet going out is that of the application proxy server, so attackers can only learn the IP address of the application proxy server.

Most IP addresses are public, in the sense that they can appear on the public Internet.

However, a few IP addresses have been designated as private IP addresses. One private IP address range is 172.16.0.0 to 172.31.255.255. Private IP addresses can only appear within a firm. In Error! Reference source not found., internal hosts have private IP addresses except for those in the DMZ, which use public IP addresses. Explain this discrepancy if you can.

Private IP addresses in general are hidden from the Internet. This makes the use of private IP addresses ideal for internal hosts.

However, hosts within the DMZ must be accessible from the Internet. Therefore, they must use IP addresses in the firm’s public IP address range. a) Describe Policy 5 in the firewall policy database shown in Error! Reference source not found.4.

Drop all ICMP messages coming from internal hosts and going outside of the network. This keeps ICMP Echo Request messages from leaving the network and helps protect against network mapping by attackers. This policy applies to the border firewall. b) Repeat for Policy 6.

Authenticate all internal SMTP requests to the Mail Server. Log all failed attempts. This policy is implemented at the Central firewall. c) Repeat for Policy 7.

Authenticate all TCP HTTP requests from Marketing hosts to the Plans server.

Alert the firewall management system if the authentication fails. This policy is implemented on the Marketing firewall. d) Repeat for Policy 8.

Drop and log all TCP HTTP requests from any source. This policy applies to the Marketing firewall.

Note that Policy 7 already allows in hosts in the Marketing group. So Policy 8 applies to all other hosts. e) Repeat for Policy 9.

Drop and log any service request not covered in any of the preceding firewall policies.

Sort the log file in Error! Reference source not found. by source IP address. What do you conclude from the analysis? This is not a trivial question.

The following can be concluded from the log file by sorting by IP address: IP address 14.17.3.139 was involved in six Echo Probe and two FTP attacks. This is most likely an attacker or a zombie being controlled by an attacker.

6–22 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

9.

IP address 128.171.17.3 was involved in three Forbidden Webserver requests.

This is either an automated attack or possibly a misconfigured host trying to connect with an incorrect destination.

IP addresses 14.8.23.96, 128.171.17.34, and 1.32.6.18 all conducted FTP attacks on the same server that the bad guy (14.x.x.139) attacked. The initial attacker may not be attacking through bots.

Two different IP addresses attacked the 60.32.29.102 host. This could be a bad sign and you need to look at what connections are or have been made to the 60.32.29.102 host to determine if an attack was successful or is ongoing. This seems to be a sophisticated attack using bots.

IP address 1.124.82.6 attempted to ping the 60.x.x.68 host. Not enough information to tell if this is good or bad.

A firm has the following firewall policy: Employee access to Internet servers should be unrestricted and external clients should only be able to access the firm’s public webserver, http://www.pukanui.com. The firm also has a finance server that should only be accessible to people in the finance department. The server and the finance departments are all on the internal subnet 10.5.4.3. The firm has a single large site. How would you implement this policy? Create both a firewall architecture and ACLs for the border firewall for both internal and external connection-opening attempts.

•

Description of architecture to meet policy requirements: o The public webserver (pukanui.com) would be placed in the DMZ to allow external access while protecting other internal assets. o The Finance Clients and Server will be placed on the 10.5.4.3 subnet. The internal firewall will only allow connections to the Finance server from hosts on its own subnet. All other connections

6–23 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

10.

will be disallowed including other company clients, and definitely all external connections. o All clients (including Finance) will be NATed behind the main border firewall to hide internal LAN structure from external exploitation via sniffers.

• Border Router Ingress ACL o If TCP destination port = 80 or 443, and IP = (IP for pukanui.com), then allow connection o Disallow all connections • Border Router Egress ACL o If IP = (IP for finance server), then disallow o Allow all connections A stateful packet inspection border firewall contains a rule that permits external connections to an internal public webserver, http://www.pukanui.com. However, the firewall does not permit access to this server. Come up with at least two hypotheses for the cause of the problem. Describe how you would test each hypothesis.

ACLs implement IP addresses via host names. It is possible that the incorrect IP address is included in the ACL rule for http://www.pukanui.com. To test, do a DNS lookup on http://www.pukanui.com and compare with the related ACL entry.

It is possible that the ACL has an error and has the wrong port numbers (80 for standard http, and 443 for SSL/TLS) in the rule for webservers. Examine the ACL entry to determine the ports identified in the rule.

It is possible that a prior rule in the ACL disallows the connection.

Hands-on Projects NOTE: Screenshots for individual students will vary.

PROJECT 1 One of the most well-known packet sniffers is called Wireshark® (formerly Ethereal®). It is a powerful tool that can capture, filter, and analyze network traffic. It can promiscuously capture traffic on both wired and wireless networks. It is used by security and networking professionals to troubleshoot networking problems.

In this project, you will install Wireshark, capture packets, and look at the contents of a packet. When the device is placed correctly, a network administrator can use Wireshark to see all the traffic coming into and out of a network. Network administrators can, among other things, see which hostnames are being requested and who is requesting them. Surfing the web is not anonymous.

6–24 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

1. Download Wireshark from http://www.wireshark.org/download.html.

2. Click Download Windows Installer. (Download the latest stable release.)

3. Click Save.

4. Save the file in your download folder.

5. If the program doesn’t automatically open, browse to your download folder.

6. Double-click Wireshark-setup-3.0.3.exe. (The software version numbers will be slightly different as newer versions are released.)

7. Finish the installation process 8. Double-click the Wireshark icon on your desktop. (You can also access it through your Start menu.)

9. Click Interface List. (This will display a list of all available network interfaces on your computer. You will want to want to note the description and IP address of the interface with the most traffic. You will need to select this interface in the following steps.)

10. Note the interface with the most traffic. (You will select this interface in the following steps.

If there are duplicate names for the Network Interface Card (NIC), you can use the last three or four values of the MAC address to identify the appropriate NIC.) 11. Close the Capture Interfaces window.

12. Click Capture, and Options.

13. Select your Network Interface Card if it is not already selected.

14. Take a screenshot.

15. Close all other programs you currently have open except your word processing program (Microsoft Word, LibreOffice Writer®, etc.).

16. Click Start.

17. Let it run for 10 seconds.

18. While you are waiting open a web browser and go to www.google.com.

19. Return to your Wireshark window.

20. In the file menu click Capture and Stop (or use the keyboard shortcut—Ctrl+E).

21. Scroll up until you see a green and blue area. (These are the packets you captured when you requested Google’s main page.)

22. Take a screenshot.

23. Scroll down until you see a line that has GET / HTTP/1.1. (You may have to try more than one until you get to the packet that shows “www.google.com” in the bottom pane.)

24. Select that row.

25. In the bottom pane, you will see a bunch of numbers to the left. (It’s the packets contents in hexadecimal.) Just to the right you will see the content of the packet in a column.

26. Select the text: www.google.com.

27. Take a screenshot.

PROJECT 2

6–25 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

In this project, you will create two simple firewall rules in Windows Advanced Firewall. This may be the first time you have made a modification to the firewall on your computer. The first rule will block all ICMP traffic. This will effectively prevent you from using the ping command to send ICMP packets to other computers. You will use a command prompt to verify the rule was effective.

The second rule will block all outgoing Port 80 traffic. Port 80 is traditionally associated with web traffic (HTTP). Once you create and enable the rule, all outgoing Port 80 traffic will be blocked. You will use a web browser to verify the rule was effective. However, secure web traffic (HTTPS) running over Port 443 will still be accessible.

Both of the rules in this project will apply to outgoing traffic only. It is important to remember to disable the rules at the end of the project so your ICMP and Port 80 traffic will not be blocked.

1. Click Start.

2. In the search box, type cmd.

3. Press Enter.

4. Type ping www.google.com 5. Press Enter. (This will ping www.Google.com.)

6. Take a screenshot.

7. Click Start and type Windows Defender Firewall.

8. Click on Windows Defender Firewall.

9. Click Advanced settings.

10. Click Outbound Rules.

11. Click New Rule (right-hand pane).

12. Click Custom, Next, and Next.

13. Change the dropdown box to ICMPv4.

14. Click Next, Next, Next, and Next.

15. Name the rule YourName_Block_ICMP. (Replace YourName with your first and last names.

In this case, it was RandyBoyle_Block_ICMP.) 16. Click Finish.

17. Return to your command prompt.

18. Type ping www.google.com 19. Press Enter. (This will ping www.google.com. You should get a “General failure” error.)

20. Take a screenshot.

21. Open a web browser.

22. Browse to www.Google.com. (This will verify that you do have Internet access.)

23. Return to the Windows Defender Firewall window.

24. Click Outbound Rules.

25. Click New Rule (right-hand pane).

26. Click Port and Next.

27. Type “80” into the text box for Specific remote ports. (This will effectively block all outgoing web traffic from your computer. You will disable [or delete] this rule later.)

28. Click Next, Next, and Next.

29. Name the rule YourName_Block_Port_80. (Replace Your Name with your first and last names. In this case, the rule was named RandyBoyle_Block_Port_80.)

6–26 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

30. Click Finish.

31. Return to your web browser.

32. Browse to any nonsecure (not HTTPS) website of your choosing. (You can browse to any website as long as it does not make an HTTPS connection (Port 443). The rule you made only blocks Port 80 web traffic.)

33. Take a screenshot of the blocked website. (In this case, it was www.microsoft.com.)

34. Return to the Windows Defender Firewall window.

35. Select both of the rules you created.

36. Right-click the selected rules.

37. Click Disable Rule. (If you don’t disable the rules, your ICMP and web traffic will still be blocked.)

38. Take a screenshot of your disabled rules.

Project Thought Questions 1.

2.

3.

4.

5.

6.

7.

Why does your computer send so many packets? Why not send just one big packet?

It sends many smaller packets for a variety of reasons. Some of the packets are sent/received as part of the TCP/IP connection. Other packets are HTML content, pictures, or fragments of larger files. Some networks fragment packets that would produce even more packets.

What do SYN, ACK, FIN, and GET mean?

These are all packets used in the TCP/IP connection.

SYN: synchronize ACK: acknowledgement FIN: finish, or end GET: get, or page request Why do some packets have sequence numbers?

Packets need sequence numbers because each packet can be routed separately.

Sequence numbers allow your computer to reassemble packets in the correct order.

Why does your computer send packets to the webserver that you requested data from?

Many of these packets are ACK packets that acknowledge the receipt of data from the web server.

What do the different colors in the Wireshark packet capture listing mean?

Different color codes help the end user quickly identify specific types of packets.

Color coding helps reduce the time it takes to sift through packets.

Why would your computer get packets that are addressed to another computer?

Your NIC can pick up all packets sent to it if it is in promiscuous mode.

How many packets does your computer send/receive in a single mouse click when you visit a website?

6–27 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

8.

9.

10.

11.

12.

You can get 1000 or more packets with a single mouse click, depending on the website. There is a lot of variability in the number of packets sent/received.

Could you organize or filter the traffic to make it easier to understand?

Yes, filters make understanding the types and quantities of traffic going over your network much easier.

How could blocking all ICMP traffic protect you?

Blocking ICMP traffic could protect you because it could keep attackers from probing and mapping your internal network using ping scans.

Could you still access some websites with your Port 80 rule enabled? Why? Yes, you may have still been able to reach a website with Port 80 blocked because it may have connected on another port (e.g., Port 443).

Why would you want to allow incoming (not outgoing) Port 443, but block incoming Port 80?

Allowing incoming Port 443 would allow secure connections, but block unsecure connections (Port 80). This would ensure that all web traffic was secured.

Could malware rename itself in order to get through a firewall? Why would this work? **This is a great question to spur student involvement** Yes, malware can rename itself. However, this does not mean it will necessarily make it though the firewall. It depends on the type of firewall, and the specific functionality of that firewall.

For example, if a firewall is set up to block Port 20 (FTP), a user (or malware) could always tunnel the FTP session through a different port.

Also, suppose an application-layer firewall is configured to block all Microsoft databases. A malware writer, or the malware itself, could change the database file extension to get through the firewall.

Finally, the firewall could have antivirus filtering capabilities (UTM), or work with another AV appliance. In this case, it's unlikely that the malware could make it through since the AV appliance would be looking for a specific signature.

Case Discussion Questions 1.

2.

Why is cyber-espionage so attractive?

Cyber-espionage is attractive because it can be a low cost alternative. Cyberespionage can reduce expensive research and development investments. It can also bring competing products to market much quicker than having to develop them from scratch. The penalties for getting caught might even be less if the cyber-espionage is performed from another country. Some countries are not willing to extradite their citizens, especially if they benefit the nation state.

Why is cyber-espionage difficult to prevent?

Cyber-espionage is difficult to prevent because many countries and corporations have not invested in the technical infrastructure necessary to centrally prevent cyber-attacks before they enter their countries. Nations are devoting resources to attacking other nations’ corporations, but doing little to proactively protect their own.

6–28 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

3.

4.

5.

6.

7.

8.

9.

There are other technical reasons that cyber-espionage is difficult to prevent.

These include, but are not limited to, using distributed bot nets, masking their source IP addresses, collaborating with corporate insiders, new forms of targetspecific malware, etc.

Why would nation states sponsor cyber-espionage?

From a strategic point of view, cyber espionage can be viewed as an effective means of gaining a technological, economic, or military advantage over another nation state. Cyber-espionage can be an effective low cost means of increasing a nation’s military capabilities (e.g., via shortcutting new weapons development projects) or technological/economic development (e.g., via shortcutting new product development).

Why is state-sponsored espionage more concerning than traditional corporate-espionage?

State-sponsored espionage is more concerning than traditional corporateespionage because of the amount of resources states can devote to these criminal enterprises. State-sponsored espionage is more likely to be condoned and encouraged by a nation’s legal system. It’s unlikely a person engaging in statesponsored espionage would be prosecuted for his or her crimes.

How could a nation protect its own corporations from cyber-espionage by foreign governments?

Nations can protect their own corporations from cyber-espionage from foreign governments by more actively monitoring, identifying, and stopping attacks from entering their countries. Nations need to invest more resources in the defense of the information assets held by their corporations (i.e., intellectual property, consumer data, new product development efforts, etc.).

Why are the industries mentioned in the NCSC report targets of foreign espionage?

The industries mentioned in the NCSC report are specifically targeted by foreign entities because of their military and economic impact. Information technology, military technologies, aerospace, marine, UAVs, energy, and pharmaceuticals are all top targets.

How could outsourcing IT security functions reduce costs?

Corporations may be able to delegate part of their IT security function to external security firms in the same way they would outsource their payroll function.

Operating and maintaining a secure, compliant, and available IT infrastructure are not necessarily core competencies, and can represent significant opportunity costs for organizations of any size.

How might outsourcing IT Security functions improve security?

Outsourcing IT security functions may likely improve security because the managed service provider will likely have a more skilled and knowledgeable staff than a typical corporation. For example, few people make their own clothes, cars, computers, or food. Instead, they outsource these functions to people and companies that specialize in those areas. The same is true for companies that outsource their IT security function.

If you were in an industry listed as a primary target for cyber-espionage, what additional steps would you take to improve the security of your company?

6–29 .

Chapter 6: Firewalls Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Industries listed as primary targets of cyber espionage by foreign entities would do well to make sure all mission-critical data are cryptographically secured. They would also be well served by having much stronger security policies and procedures than other corporations. They should also consider having a MSSP provide them with a robust intrusion detection system, email filtering, border management, active malware scanning, data loss prevention systems, and annual security audits.

Perspective Questions 1.

2.

What material was most surprising for you in this chapter?

Student answers will vary.

What material was most difficult for you in this chapter?

Student answers will vary.

6–30 .

.

Instructor’s Manual

Chapter 7

Host Hardening Learning Objectives After studying this chapter, students should be able to: ➢ Define the elements of host hardening, security baselines and images, and systems administration. ➢ Know important server operating systems. ➢ Describe vulnerabilities and patches. ➢ Explain how to manage users and groups. ➢ Explain how to manage permissions. ➢ Explain how to create strong passwords. ➢ Describe how to test for vulnerabilities.

Teaching Suggestions Special Issues The main problem in covering this chapter is that it covers many different topics. For example, hardening hosts really is some of this, some of that, and some of something else.

The material in this chapter is not difficult, although the section on different types of UNIX, and the section contrasting permissions in UNIX and Windows, can be difficult for students because it requires them to understand the structure of what they are reading and integrate the specific elements into an overview.

Copyright © 2015 Pearson Education, Inc.

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Role in the Book Chapter 3 discussed cryptography, which is heavily used in network security. Chapter 4 focused on network security. We are now concerned with end systems—client hosts, server hosts, and other types of hosts. This chapter discusses host security, while the next chapter discusses security for applications running on these hosts.

Teaching the Material Flow of Material ➢ This chapter begins with a discussion of what hosts are and lists the many elements of host hardening, the most crucial of which is the issue of backup. This first section focuses on the importance of using baselines, which are like aircraft checklists that ensure hardening policies are being followed in specific cases. ➢ The next section discusses virtualization and cloud-based computing environments. ➢ Next is a section that compares the two dominant families of operating systems— Microsoft Windows and UNIX/Linux. ➢ Next comes a fairly lengthy section on vulnerabilities and fixes, including patches and other types of fixes. If the operating system has a vulnerability, it is susceptible to attacks that would otherwise cause it no harm. ➢ The chapter then discusses managing users and groups at the operating system level.

Chapter 5, which dealt with access control, focused very briefly on authorizations, but this chapter shows how permissions (specifically authorizations) are assigned in Windows and, to a lesser extent, UNIX. It also compares the flexibility of permission assignment in Windows and UNIX, and discusses the use of inheritance and groups to reduce the work of assigning user permissions. ➢ There is a brief section on vulnerability testing. This focuses on the dangers of vulnerability testing and the need to have a written agreement ahead of time for every vulnerability test. ➢ The section on general host security concludes with a discussion of Microsoft Windows PC client security. This includes managing laptops and central PC management through Group Policy Objects. ➢ The chapter then discusses best practices for creating strong passwords. ➢ The chapter concludes with a discussion of testing for vulnerabilities.

Covering the Material Covering this chapter in an interesting way is really difficult because it consists of many individual topics. That is just the nature of host hardening.

To liven things up, have students begin the chapter by discussing what a host is, why they need to harden hosts, and what they can do to harden hosts. Then go over this list of hosthardening approaches and discuss what the students missed. More specifically, write numbers on 7–2 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

the board and when students answer, write their topic in its appropriate number according to the list in the chapter. You can even divide your class in half and play family feud, giving each side alternating turns to nominate hardening approaches.

For Windows Server and UNIX, things really come alive if you can demonstrate their user interfaces.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master.

Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report. The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report. Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

7–3 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key

Introduction What Is a Host?

The Elements of Host Hardening Security Baseline and Images Virtualization Systems Administrators 1.

a) What is our definition of a host?

Any device with an IP address is a host. b) Why is host hardening necessary?

This is necessary to protect the host against attacks. c) What major categories of hosts did this section mention?

Servers, clients, routers, firewalls, and even many mobile phones d) List the elements of host hardening.

Back up the host regularly. Without this, nothing else matters.

Restrict physical access to the host.

Install the operating system with secure configuration options. In particular, be sure that all default passwords are replaced by strong passwords. Adversaries know every default password. If you fail to change even one, they can use it to get into your system immediately.

Minimize the applications and operating system services that run on the host to reduce the ability of hackers to take over the host by compromising an application or service. Minimizing the number of running programs reduces the “attack surface” of hosts.

Harden all remaining applications on the host.

Download and install patches for known operating system vulnerabilities.

7–4 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

2.

Manage users, including account profiles, passwords, and other matters.

Manage access permissions for users and groups securely.

Encrypt data if appropriate.

Add a host firewall.

Read operating system logs regularly to look for suspicious activities. e) Why is it important to replace default passwords during configuration?

Anyone who knows anything about the subject will know the default password.

The default password is usually the first thing an attacker will check. f) What is a security baseline, and why is it important?

Security baselines are sets of specific actions to be taken to harden all hosts of a particular type and of particular versions within each type. This is important because it is another rule to follow to harden hosts and prevent attacks. g) Why is the downloading of disk images of the operating system desirable compared to configuring each host individually?

This method will save labor time and cost on each subsequent installation. It also ensures that each server is properly configured according to the firm’s security baselines and general policies. a) What is virtualization?

Virtualization is the process whereby multiple operating systems, with their associated applications and data, run independently on a single physical machine. b) What are some of the advantages of using virtual machines?

The benefits of virtualization include a single baseline for each host, rapid deployment, reduced system misconfiguration, reduced labor costs, reduced utility expenses, and greater fault tolerance and availability. c) What does a systems administrator manage?

Systems administrators manage individual hosts or groups of hosts. d) Does a systems administrator generally manage the network?

System administrators generally do not administer the network.

Important Server Operating Systems Windows Server Operating Systems 3.

a) What is the name of Microsoft’s server operating system?

Windows Server b) What security protections do recent versions of this operating system offer?

7–5 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

They intelligently minimize the number of running applications and utilities by asking the installer questions about how the server will be used. They also make the installation of vulnerability patches very simple and usually automatic. They include server software firewalls, the ability to encrypt data, and many other security enhancements. c) Why is Microsoft Windows Server easy to learn?

Windows Server is easy to learn because the interface looks like the interfaces in client versions of Windows. d) Why would a server administrator like to use Windows Server Manager?

New roles, features, and services can be added through the Server manager. It also gives administrators notices about potential performance issues and unexpected events.

Administrators can see all potential issues on a single window and fix them directly without having to open each application individually.e) What are MMCs? (Do not just spell out the acronym.)

Microsoft Management Consoles (MMCs) are Microsoft Server’s administrative tools that use a consistent GUI. f) On what object does an icon bar icon operate?

When a user selects an object in one of the two lower panes, the icons specify actions that the administrator can take on the selected object. One of the most important choices is Action, which is specific to the selected object. g) What is in the tree pane?

It is a tree of administrative applications. The tree pane is located in the lower-left pane of GUI. h) To what things do items in the sub-object pane refer?

These things refer to objects on which actions can be taken. i) What is a snap-in?

A snap-in is an individual application on the tree pane of an MMC that can be added or dropped from the tree list easily. j) Why are they called “snap-ins”?

They are called this because they can be added or dropped from the tree list easily. k) Why is the standardized layout of MMCs beneficial?

Standardized layouts that provide a consistent user interface make learning how to use MMCs and snap-ins relatively easy. l) How does the systems administrator get to most administrative tool MMCs? By following the sequence of “start,” then “programs,” and finally “administration tools” m) What does selecting Action do?

7–6 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

It shows the actions that the administrator can take on the selected object.

UNIX (Including Linux) Servers 4.

a) Why is UNIX systems security difficult to describe generally?

UNIX consists of a family of OSs that are similar in that they are compatible at the kernel level, but differ in other aspects of implementing the OS, such as implementing system security. Thus, there is no standard UNIX system security setting; each OS has its own baseline. b) Distinguish between UNIX and Linux.

UNIX is a family of OSs that share interoperability at the kernel level. Linux is a specific operating system kernel used in many PCs because of its price (free). c) What is the LINUX kernel?

The Linux kernel is the core part of the operating system, upon which LINUX vendors provide additional software for sale or as free downloads. d) What is a LINUX distribution?

Linux distribution consists of the Linux kernel packaged by vendors with additional programs for added functionality. Often these additional packages are created by the GNU project for free, but are packed and sold for a profit by enterprising capitalists. e) Comment on the cost of Linux.

The purchase price of a Linux distribution is free or almost free. However, Total Cost of Ownership (TCO) for Linux can be considerable, especially if there are multiple varieties of Linux in use on a network that requires product-specific knowledge to operate and secure. f) Does a particular version of UNIX have a single desktop environment?

No. Even within a specific version of UNIX, the operating system software may come with several alternative desktop environments. Some of these interfaces will be graphical user interfaces similar to the interface of Microsoft Windows. On Linux, there are several popular desktop environments including KDE, MATE, GNOME, Cinnamon, and Unity. Choosing a desktop environment really comes down to personal preferences. g) What are UNIX CLIs called?

UNIX’s command line interfaces are called shells. h) How are CLIs beneficial?

CLI shells use fewer resources than GUIs, so they place lower processing burdens on the computer than GUIs. i) Why are CLIs difficult to use?

They are difficult to use because the CLIs in UNIX are picky with syntax and spacing.

7–7 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Vulnerabilities and Patches Vulnerabilities and Exploits 5.

a) What is a vulnerability?

Vulnerabilities are security weaknesses that open a program to attack. b) What is an exploit?

An exploit is a program that takes advantage of a vulnerability to allow the attacker to take over the computer or at least an individual account. c) What is a zero-day attack?

Attacks that come before fixes are released are called zero-day attacks. d) Why is the quick application of critical fixes important?

Because attackers usually exploit the vulnerability soon after a fix is released by a vendor

Fixes 6.

a) List the four types of fixes for vulnerabilities.

The four types of fixes for vulnerabilities are work-arounds, patches, service packs, and version upgrades. b) Distinguish between work-arounds and patches.

Work-arounds are labor-intensive processes of manual steps that system administrators must take to address a vulnerability. Patches are small programs that fix a particular vulnerability. Patches fix the problem by adjusting system configuration (as with work-arounds). c) What is a service pack in Microsoft Windows?

These are vulnerability fixes and sometimes functionality improvements together in a single, large update. d) Why is upgrading to a new version of an operating system usually good for security?

Security problems are corrected in newer versions and, in general, each newer version of an operating system has improved security. In addition, if a version is too old, the vendor will stop creating fixes for it.

The Mechanics of Patch Installation 7.

a) In Windows Server 2019, how automatic can patching be?

In Microsoft Windows Server, installing patches is simple. Since Windows Server 2003, servers can be programmed to check for updates automatically. Updates can then be approved and pushed out to hosts. b) What patch downloading method is commonly used in Linux?

7–8 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Many Linux vendors follow the rpm method created by Red Hat for downloading patches.

Problems with Patching 8.

a) Why do firms have a difficult time applying patches?

Firms have a difficult time because firms use many application programs and vendors release many patches per product. In contrast, they only use a few operating system versions. b) Why do many firms prioritize patches?

Firms prioritize patches by criticality. Some patches may not apply if risk analysis does not justify it. c) How do patch management servers help?

Patch management servers help by learning what software a firm is using on its network, actively assessing which programs on specific hosts need to be patched, and then pushing the patches to the hosts. Patch management servers can greatly reduce patching costs. d) What two risks does patching raise?

The two risks of patching are: (1) the loss of functionality due to implementing a patch, and (2) the negative impact of some patches on host system performance.

Managing Users and Groups The Importance of Groups in Security Management 9.

Give two reasons why assigning security measures to groups is better than assigning security measures to individuals within groups.

Applying security measures to groups takes less time than assigning them individually (and thus is cheaper).

Applying security measures in groups reduces errors in assigning security settings because group permissions are fairly obvious compared to individual permissions.

Creating and Managing Users and Groups in Windows 10.

a) What Windows snap-in is used to manage users and groups?

It is the Local Users and Group snap-in. b) On which MMC is this snap-in available?

This snap-in is available in the computer management snap-in. c) In this snap-in, if the administrator clicks on an account, what may he or she do?

7–9 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

11.

The administrator will be able to rename the account, delete it, change its security properties, or take other actions. d) How does the administrator create a new account?

Administrators create new accounts by using the Action command, and entering a name, password, and other information about the account. e) How does an administrator add an account to a group?

The administrator can select the group section instead of the user section and, from there, the administrator will be able to add an account to the group. f) How does the administrator create a new group?

In the group sections a) What privileges does the super user account have?

The super user has full access to anything on the computer. The owner of the super user account can see or do anything on the computer. b) What is the super user account in Windows?

The super user account in Windows is called “Administrator.” c) What is the super user account in UNIX? It is called “root.” d) What is hacking root, and why is it desirable to hackers?

Hacking root is taking over that super user account. This is desirable because the attacker can do whatever he or she wants with this type of account. e) When should a Windows systems administrator use the Administrator account?

Administrator accounts should be used sparingly, and only for circumstances that merit full privileges to accomplish a task. f) How does the administrator get to the super user account in Windows? In UNIX? In Windows, run the RunAs command to switch to and from the super user account. In UNIX, the administrator accesses the super user account via a CLI, using the su command.

Managing Permissions Permissions Assigning Permissions in Windows 12.

a) How are permissions applied to a directory in Windows?

Permission are applied to a directory in Windows by right clicking on File or Directory in My Computer or Windows Explorer. Then select Properties, then the 7–10 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Security tab. Then select User or Group and click on or off the 6 standard permissions (permit or deny). b) List each standard Windows privilege and explain it briefly.

They are full control, modify, read & execute, list folder contents, read, and write. c) To how many accounts and groups can different permissions be applied in Windows?

There is no limit to the number of accounts and groups that can have different permissions applied. d) How can inheritance reduce labor costs in assigning permissions?

Inheritance reduces labor costs in assigning permissions by receiving permissions from the parent directory. This eliminates a process of permissions being assigned by inheritance individually. e) How can inheritance be modified?

Inheritance can be modified from the Allow permissions and the Deny permissions selections in the Security tab. f) How are a user’s effective permissions calculated for a directory?

User’s effective permissions are all those inherited from its parent directory plus any specifically allowed permission, minus those removed. g) How would you set up a top-level directory for a firm’s public policy documents, which should be readable by all logged-in users?

At the top-level directory (i.e., public programs), assign the group called “all logged in users” read permissions.

Assigning Groups and Permissions in UNIX 13.

a) What are the three UNIX permissions?

The three UNIX permissions are read, write, and execute. b) Briefly characterize each.

Read gives the permission to read only.

Write gives permission to make changes.

Execute permits the execution of programs. c) Compare the number of UNIX directory and file permissions with that of Windows.

UNIX allows only three directory permissions, while Windows allows six primary directory permissions and 13 specialized permissions. d) To which three individual accounts or groups can permissions be assigned for a particular directory in UNIX? They are the account owner, a single group, and all other accounts. e) How does the number of accounts or groups to which permissions can be assigned in UNIX compare with that of Windows?

7–11 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

UNIX allows permissions to be assigned to three groups/accounts. Windows can give permissions to an unlimited number of individual accounts and groups.

Creating Strong Passwords Creating and Storing Passwords Password-Cracking Techniques

14.

a) What is brute-force password guessing?

Brute-force password guessing is an approach that tries all possible passwords on all (or selected) accounts. This approach tries all possible single-character passwords, then all possible two-character passwords, and so forth. b) Why is it important to not simply use all lowercase letters in passwords?

It is important to not simply use all lowercase letters in passwords because that limits the possible characters in a password to only 26 (the alphabet). Thus, the possible combinations are 26^N (N = password length), much less than if all characters on a keyboard are used (75^N combinations). c) What are complex passwords?

Complex passwords are passwords that use several types of keyboard characters—upper and lowercase letters, digits, and special characters. d) Why is password length important?

Longer passwords take much more time to crack than shorter passwords. e) What is a dictionary attack?

A dictionary attack is an attack that compares passwords to lists of common words. f) Why are dictionary attacks faster than brute-force guessing?

They only have to try a few thousand passwords, instead of millions or billions. g) What are hybrid dictionary attacks?

Hybrid dictionary attacks try simple modifications of common words (such as Password!). h) How are mangling rules applied to list of dictionary words?

Mangling rules are applied to each word in sequence. Each mangling rule modifies the dictionary word in order to make a possible password match.

Mangling rules are created, and based on, common password patterns.

7–12 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

15.

16.

17.

a) What are rainbow tables?

A rainbow table is a list of pre-computed password hashes that are indexed in an attempt to reduce the amount of time it takes to crack a password. b) How would rainbow tables reduce the time needed to crack a password?

Indexed lists of password hashes are created from large dictionary files, or all possible combinations of characters. This results in a time–memory trade-off where more memory is used to store the pre-computed password hashes, but the time it takes to crack a password is greatly reduced. c) Would it be possible to create rainbow tables for all possible passwords with 1–20 characters? Would it be practical?

It would be technically possible to create the table. However, the number of possible combinations of known characters for a password consisting of 20 characters would be so large that the table would be practically impossible to create. a) Can you create a truly random password? Will it be used?

Yes, you can create very long, truly random passwords. The downside of completely random passwords is that users find them hard to remember. Users tend not to use passwords that are hard to remember. b) Should passwords be tested by systems administrators? Why? Internal corporate passwords should be tested by systems administrators to ensure that each user is using a sufficiently strong password. Users with weak passwords should be directed to change their password to a stronger password. a) What do Trojan horse password capture programs do?

They capture passwords when the user types them. b) Can antivirus software detect keystroke capture software?

Yes, some antivirus software can detect certain keyloggers, but not all keyloggers.

The keystroke software must be included in the list of virus signatures for it to be identified by the antivirus software. c) How would you detect a physical keylogger?

In order to detect a physical keylogger, you would have to physically inspect your computer. d) What is shoulder surfing?

Watching someone while they type passwords in order to learn the password. e) Does the shoulder surfer have to read the entire password to be successful? Explain.

Shoulder surfers do not have to read the entire password to be successful. Just finding out some of the characteristics of the password, such as first/last letters, total number of characters, and whether special characters are used, makes cracking the password significantly easier as it narrows the possible range of password characteristics to be checked in a brute-force attack.

7–13 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Testing for Vulnerabilities 18.

a) Why is vulnerability testing desirable?

Vulnerability testing is desirable because it allows network administrators to identify problems before attackers can exploit them. b) What two things does vulnerability testing software do?

Vulnerability software runs a battery of attacks and generates reports detailing the vulnerabilities found. c) Why is it important to get approval in writing before conducting a vulnerability test?

It is important to get approval in writing before conducting a vulnerability test because testing does occasionally cause system crashes and other damage, and the tester should be covered against repercussions. d) What two things should this written approval specifically mention?

The written approval should specifically mention a detailed description of what will be done, along with a mention that the tester will not be held liable for system degradation from the testing. e) Why is it important never to diverge from the test plan when running the tests?

One should never diverge from the test plan while running tests because once you diverge, all protections provided by the test plan are negated and you can be held liable for the consequences.

Windows Client PC SecurityClient PC Security Baselines 19.

What different baselines does a company need for its client PCs? A company needs security baselines for Windows Vista, Windows 7, and Windows 10. A firm also needs security baselines for its Macintosh, Linux, and UNIX desktop computers. In addition, for each client operating system, a firm may have multiple baselines, such as for desktop versus laptop computers, for insite versus external computers, and for regular clients versus computers with especially high security needs.

The Windows Security Application 20.

a) How can you quickly assess the security posture of your Windows PC? The Windows Security application allows a user to quickly assess the security posture of a Windows PC. b) What provides a quick summary of security components needed to harden a client PC? The Windows Security application provides a quick summary of all the security components needed to harden a client PC. c) Why are multiple types of protection necessary?

7–14 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Multiple types of protection work together to provide defense in depth and protection from a variety of threats.

Windows Defender Firewall 21.

a) What SPI firewall has come with client version of Windows since Windows XP SP2?

It is called Windows Firewall. This SPI firewall has been included in all subsequent client versions of Windows. b) What functionality comes with Windows Defender Firewall?

Windows 10 comes with a firewall with functionality such as custom ingress/egress rules, separate network profiles, more detailed rules, and the ability to be managed via group policy.

Automatic Updates 22.

Why should updating be done completely automatically on client PCs? Due to the shortening time between patch release and widespread use of exploits for unpatched vulnerabilities, client PCs should be configured for automatic updates.

Antivirus and Spyware Protection 23.

What can go wrong with antivirus protection?

Common problems with antivirus protections include users turning off the AV program, automatic updates of virus signatures that can be inadvertently turned off, and the virus program contract that may expire with no new updates coming.

Implementing Security Policy 24.

a) Why is it important to implement security policy?

It is important to implement security policies because they protect computing resources. They also help minimize corporate liability and legal compliance. b) What are the advantages of implementing password policies?

Implementing these password policies increases the effectiveness of passwords as an access control mechanism. c) What are the advantages of implementing account policies?

Properly implemented account policies can stop certain attacks. For example, an account policy could prevent attackers from endlessly trying to guess a user’s password if the account were locked after a given number of attempts. d) What are the advantages of implementing audit policies?

7–15 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Audit policies provide systems administrators with detailed information about who caused events to occur, what they may have changed, and when the event occurred.

Protecting Notebook Computers 25.

a) What are the three dangers created by mobile device loss or theft?

The three dangers of mobile device loss are (1) loss of capital investment, (2) loss of all data that was not backed up, and (3) loss of sensitive data. b) When should backup be done for mobile devices?

Mobile devices should be backed up before being taken offsite and then regularly while offsite. c) What four policies are necessary to protect sensitive information?

Limit what sensitive data can be stored on mobile PCs. Encryption is required on all mobile PCs regardless of data content.

All mobile PCs should be protected with strong passwords, biometrics, or both.

Audit the first three policies. d) To what should these policies be applied?

The above policies should be applied to all data on mobile devices including smartphones, tablets, USB drives, disk drives, media players that store data, and even IoT devices that can store data. e) What training should be provided?

The type of training that should be provided is to teach users loss and theft protection techniques. f) What does anti-theft tracking software do?

When the device next connects to the Internet, the anti-theft tracking software reports its IP address to the user and a recovery company. The user and recovery company can work with local police to recover the stolen device.

Centralized PC Security Management 26.

a) Why is central PC security management desirable?

Central PC security management is desirable because ordinary users lack the knowledge to manage security on their PCs, they sometimes knowingly violate security policies, and it can often reduce cost through automation. b) Why are standard configurations attractive?

Standard configurations are attractive because they reduce PC troubleshooting and general maintenance while affording the best control over system security configuration. c) What does NAC do when a computer attempts to connect to the network?

7–16 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

NAC queries the PC for information present in the Windows Security application to determine if all updates are current, AV is loaded, and other items. d) If a PC fails its initial health assessment, what are a NAC system’s two options?

NAC’s two options are to forbid access or provide access to a remediation server in order to fix the security issues. e) Does NAC control usually stop after access is granted?

After access is granted, the NAC will perform ongoing traffic monitoring. If the traffic after admissions indicates malware on the client, the NAC will drop or remediate. f) What things can Windows GPOs restrict?

Windows GPOs can restrict PCs from changing standard configurations and other important policies. g) Why are Windows GPOs powerful tools for managing security on individual Windows PCs? GPOs are powerful tools because they can maintain a high security standard on client PCs.

Conclusion Thought Questions 1.

Why do you think companies often fail to harden their servers adequately?

Student answers will differ.

Companies may lack comprehensive security policies that include server hardening.

They may not even know all of their servers.

It is difficult, time-consuming, and expensive.

There are many server operating systems and versions, each needing to be hardened in different ways.

So many patches need to be applied that fixing vulnerabilities is extremely different.

2.

Why do you think companies often fail to harden their clients adequately?

Student answers will differ.

Clients are typically controlled by people with little security knowledge (i.e., end users) and generally with an aversion to the limitations of security.

Companies have not invested sufficiently in technological solutions to manage clients.

Client PCs may not be given priority by the security staff.

7–17 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

4.

5.

6.

3.

What are some of the advantages and disadvantages of the diversity of Linux/UNIX offerings?The diversity of Linux/UNIX offerings is good because it breeds competition, resulting in lower purchase costs and possibly improved security performance over time.

Linux/UNIX diversity is bad because each variant will have its own security limitations and vulnerabilities requiring separate hardening baselines for each version, making administration of numerous Linux/UNIX versions very expensive.

Why do you think UNIX has such a limited ability to assign permissions compared with Windows?

Student answers will vary.

Historically, UNIX is very old, and its permissions structure was built in early, when flexibility in assigning permissions was not very important. Later, there was no coordinated way to change the way that permissions were assigned across UNIX variants.

Directory DunLaoghaire has several subdirectories. Each of these subdirectories has very sensitive information that should only be accessible to a single user. a) What permissions would you give in the top-level DunLaoghaire directory to the group all logged-in users if you do not want to change the Allow inheritable permissions from parent to propagate to this object box default in subdirectories?

For very sensitive information that should only be accessible to a single user, the “all logged in users” group should receive no permissions in DunLaoghaire. This way, they will not inherit any permissions in lower level directories. b) What would you then do in each subdirectory?

In each subdirectory, assign appropriate permissions only to accounts and groups that need them in the directory.

In their purest form, netbooks are PCs designed to have little or no software stored on them. Instead, they are designed to use cloud computing, in which the software and data are both stored on Internet servers. Netbooks in this pure form can only work when they have an Internet connection. Based on what you learned in this chapter, discuss security implications for netbooks, both pros and cons?

Student answers will vary.

Netbooks use networking extensively, so they need sophisticated network security.

Data are stored in the cloud, so security protections there must be strong.

Users do not control applications, so unless cloud service providers protect their software very well, netbooks may download viruses and worms along with the application software.

Many netbooks do not have optical disk drives. This makes data extrusion more difficult, but it also makes backup more difficult.

7–18 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

7.

8.

What password-cracking method would be used for each of the following passwords? a) swordfish Dictionary attack b) Lt6^ Brute-force attack c) Processing1 Hybrid dictionary attack d) nitt4aGm^ Brute-force attack Critique the safety of each of the following passwords, giving your specific reasoning. a) swordfish Swordfish is pathetically weak. It is a standard dictionary password in all lowercase letters and will be cracked immediately. b) Lt6^ Lt6^ is a good password in that it uses upper and lowercase letters, numbers, and special characters. However, it is too short and will be cracked by a brute-force attack in a relatively short time. c) Processing1 Processing1 is barely better than a standard dictionary word. Capitalizing the first letter and adding a number to the end is a common password technique and the reason why Hybrid dictionary attacks were created and are so successful. d) nitt4aGm^ nitt4aGm^ appears to be a randomly generated password. It is nine characters long, and it uses uppercase and lowercase letters, numbers, and special characters.

This is a strong password.

Hands-on Projects NOTE: Screenshots for individual students will vary.

PROJECT 1 FileVerifier++® is a tool that will compute hashes on any single file, or all of your files at once.

These hashes are then checked to see if there have been any changes to those files. FileVerifier++ can quickly check the integrity of a large number of files.

FileVerifier++ is useful if you need to verify that a given set of files has not been changed or altered in any way. For example, it could be used to verify that customer, employee, financial, or sales records were not manipulated. If a file was changed without authorization, it can be compared with an earlier version to determine which changes were made. Using a file verifier is a way IT security professionals can detect a possible intrusion.

1. Download and install FileVerifier++ from http://www.programmingunlimited.net.

7–19 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

2. Click Start Menu and search for FileVerifier++.

3. In FileVerifier, click the Options button.

4. Change the Default Algorithm to MD5.

5. Click OK. 6. Click on the Dirs button to select the directories you want. (You can also select individual files.)

7. Browse to and select your downloads directory.

8. Click OK. 9. Take a screenshot.

10. Click the Verify All button. (Browse to your downloads directory if necessary.)

11. Click OK. 12. Take a screenshot.

13. Create a new text file named YourNameHash.txt, and save it in your downloads folder.

(Replace YourName with your first and last names.)

14. Open the text file labeled YourNameHash.txt you just created in your downloads folder.

15. Add your name to the contents of the text file.

16. Save your changes to that text file by clicking File and Save.

17. Close the text file.

18. In the FileVerifier++ window, click Verify All again. (Browse to your downloads folder if necessary.)

19. Scroll down until you can see the text file that you changed. (It should be highlighted in red.)

20. Take a screenshot.

Project 2 Good administrators check their logs regularly. They need to know what went on when they were away. They need to look for intruders, compromised machines, stolen or deleted files, and so on. The list of things to look for can be extensive.

Microsoft Windows Event Viewer® is a simple program that organizes these logs in a way that makes them easy to view. Learning how Event Viewer works is a great training platform for beginners. It is also a useful diagnostic tool.In this example, you will enable logging of security events, log in and out of your machine, and then look up the event in Event Viewer.

1. Click on the Windows Start Menu and search for Local Security Policy.

2. Click on Local Policies and Audit Policy.

3. Double-click on the policy labeled “Audit account logon events.”

4. Select both Success and Failure.

5. Click OK. 6. Double-click on the policy labeled “Audit logon events.”

7. Select both Success and Failure.

8. Click OK. 9. Take a screenshot.

10. In the control panel, click System and Security, Administrative Tools, and Event Viewer.

11. Click Windows Logs and Security.

12. Take a screenshot.

7–20 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

13. Log off your computer (you don’t need to shut down) by clicking Start, the drop-down menu next to Shut down, and Log Off. 14. Log onto your computer by clicking your username and entering your password.

15. In the control panel, click System and Security, Administrative Tools, and Event Viewer.

16. Click Windows Logs and Security.

17. Take a screenshot.

18. Double-click on the Logon/Logoff event that was just recorded.

19. Take a screenshot.

20. Click Close.

21. Click Applications and Services Logs and Microsoft Office Sessions.

22. Click on one of the log events.

23. Take a screenshot.

PROJECT 3 On the Internet, use a search engine to find a security baseline for Microsoft Windows 10. List the title, the organization, and the URL. Briefly describe what is in the baseline.

Note: Not all sources use the term baseline.

Student answers will vary.

Project Questions 1.

2.

3.

4.

5.

6.

7.

Will these security logs track failed logon attempts? From remote machines too?

Yes, they will track all failed logon attempts, even from remote machines.

Will it track security events other than just logon/logoff events?

Yes, it tracks a variety of security events as defined by Microsoft.

Can you use Event Viewer to view other logs?

Yes, Event Viewer is a “generic” program that will allow you to view a variety of different logs.

Why is there a log that tracks which Microsoft office programs you use and how long you use them?

Yes, there is a log that will track when you use a MS Office product and how long you use it.

How could a top-notch hacker keep you from knowing which files were changed?

They could permanently delete your hashes.

Can you calculate a hash for a single file?

Yes, just right-click the file and select File Verifier++.

From the hash could you tell what was changed in the file?

7–21 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

8.

No, it just tells you that the file was changed. You will need to compare your backup files to determine what was changed.

Can you use the longest hash possible? How long is good enough?

Not necessarily. Many applications still use MD5 (128-bit), but there was an intrusion in 2008 that used a weakness in MD5. SHA-1 (160-bit) is currently widely used. However, as of June 2009, there have been theoretical concerns that it is too weak. SHA-2 and SHA-3 are likely successors. Key size all depends on the value of the information being used.

Case Discussion Questions 1.

How could new smart devices pose a security risk for a corporation?

IP-enabled tablets, smartphones, webcams, and printers bring a whole set of new opportunities and threats to corporations. Some of these new devices can take and send pictures and video. They also share live video feeds, connect to external data sources, and send messages. These capabilities make it difficult to secure a corporation’s intellectual property, proprietary processes, confidential communications, and new product development.

2.

How could corporations guard against threats from new smart devices?

Corporations can guard against new threats by fully understanding each new device and its capabilities. Then they need to construct new policies for each device that are congruent with the corporation’s overall goals and objectives.

Some corporations may allow a device, while others may prohibit it from being on premises.

3.

Could a ban on all smart devices from outside the corporation be a workable policy? Why or why not?

Banning all IP-enabled devices is probably not going to be a workable policy for most corporations. With the exception of certain military installations, most corporations will see the value in using smart devices. Many of them will rely on them for their competitive advantage. In fact, as these devices become more widely adopted by society at large, they will become more integrated into daily corporate operations (e.g., smart phones).

4.

Why is data mobility a security threat to businesses?

Data mobility is a security threat to businesses because of the difficulty in protecting sensitive data. Data is increasingly being stored in multiple locations, accessed from many locations, used by many different users, and utilized with many different types of devices. Changes in location, accessibility, applications, and devices have made securing data more difficult.

5.

How will diverse computing platforms affect IT security?

Diverse computing platforms will make it more difficult to secure corporate information systems. Diverse computing platforms take more resources, skill, knowledge, and time to secure than a homogeneous computing environment.

7–22 .

Chapter 7: Host and Data Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

6.

7.

Newly adopted platforms may be especially vulnerable because they have not been secured properly.

How must IT security evolve to address the development of new devices?

IT security personnel must address the desire for workers to store and access confidential corporate data on a variety of devices that they may not have control over. Some of these devices may be corporate-owned, and others may be a worker’s property. IT security policies and procedures must evolve with the changing technological landscape to account for these new devices.

Would IT security policies need to be adjusted for corporate offices in different countries? Why or why not?

Yes, some countries are more susceptible to cyber-attacks than others. Corporate information systems in certain countries must be “hardened” to a much greater extent than in other countries. There may also be differences in local laws that must be adhered to (e.g., prohibitions against cryptographic software, or differences in privacy laws).

Perspective Questions 1.

What material was most surprising for you in this chapter?

Student answers will vary.

2.

What material was most difficult for you in this chapter?

Student answers will vary.

7–23 .

.

Instructor’s Manual

Chapter 8

Application Security Learning Objectives After studying this chapter, students should be able to: ➢ List the main steps in securing applications. ➢ Know how to secure WWW service and e-commerce services. ➢ Describe vulnerabilities in web browsers. ➢ Explain the process of securing e-mail. ➢ Explain how to secure voice over IP (VoIP). ➢ Describe how to secure other user applications.

Teaching Suggestions Special Issues The material in this chapter is relatively straightforward. The main problem students might have is keeping track of different things because applications work differently.

There are also two challenging concepts in this chapter: the first is the mix of standards surrounding email; and the second is the collection of devices and standards in the box on securing VoIP.

.

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Role in the Book Although host hardening, as discussed in Chapters 7, is an important topic, most hacking attacks today take place at the application layer. And there are many different applications, each with their own security needs. Therefore, this chapter deals with security issues in a number of different applications.

Teaching the Material Flow of Material ➢ Most attacks on computers today target applications rather than host operating systems. If an attacker can take over an application, he or she receives all of the permissions of the application. These often are super user permissions. Application hardening is especially difficult because although the firm has only a few operating systems, it has many different applications, which have many different hardening profile requirements. ➢ The chapter surveys the main steps in securing applications: understanding the server’s role and the threat environment; hardening the host (as discussed in Chapter 7); hardening main applications and subsidiary applications, guided by security baselines; avoiding blank passwords and well-known default passwords; installing patches for all applications; minimizing the permission of applications; adding application layer authentication, authorizations, and auditing; implementing cryptographically secure communications with the user; securing major servers offering WWW, e-commerce, email, VoIP, Skype, and other applications; and securing TCP/IP supervisory protocol. ➢ The chapter then discusses securing WWW service and e-commerce service. ➢ The chapter then discusses securing e-mail. Few organizations have secured some or most of their e-mail. ➢ The chapter then discusses VoIP security, including Skype security. ➢ The chapter then illustrates that there are many other applications to harden, such as instant messaging and other applications.

Covering the Material Lecturing is a good way to cover most of this material. However, you might find good success in having students first list major applications that need to be protected, then list potential security problems they raise.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master.

Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

8–2 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report. The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report. Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

8–3 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key

Application Security and Hardening Executing Commands with the Privileges of a Compromised Application 1.

a) What can hackers gain by taking over application programs?

They get the privileges of the application program they take over. b) What is the most popular way for hackers to take over hosts?

By taking over an application with root privileges

Buffer Overflow Attacks 2.

a) What is a buffer?

A temporary storage area in memory b) What is a buffer overflow attack?

An attack that writes data longer than the space allocated for it in the buffer. c) What impacts can buffer overflows have?

The impact of a buffer overflow can range from nothing to the crashing of the server, or the ability to execute any command on the server. d) In a stack overflow, what is overwritten by the overflow?

The return address in a stack is overwritten in a stack overflow. e) To where does the overwritten return address point?

The overwritten address will point to data in the buffer, which will actually be program/attack code that will be executed instead of legitimate code. f) In the IIS IPP buffer overflow attack, what buffer is overflowed?

The host to which the request should go is overflowed. The host name is replaced with a 420-character string that causes a buffer overflow.

Few Operating Systems, Many Applications 3.

Why is patching applications more time consuming than patching operating systems?

8–4 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

There are many more applications compared to only one OS, and finding information about application vulnerabilities takes a lot of time.

Hardening Applications 4.

5.

a) Why must you know a server’s role to know how to protect it?

Knowing what a server is meant to do allows you to determine what services must be kept on, and all others can be disallowed. b) Why is it important to minimize both main applications and subsidiary applications?

The few applications you have, the fewer security risks there will be. c) Why are security baselines needed for installing applications?

A complex series of actions is needed for any major application. This requires the checklist of a security baseline. d) Why is it important to minimize permissions for application programs?

Application permissions must be minimized because if a hacker takes over an application, he or she can take over the entire host if the permissions are too great. a) Why is application-level authentication superior to operating system authentication?

Application-level authentication is superior because it requires the hacker to not only have an exploit, but also authenticated access to a server (versus just an exploit). b) Why should cryptographic protections be used?

To prevent eavesdropping by unauthorized people

Securing Custom Applications 6.

a) What is a login screen bypass attack?

In a login screen bypass attack, the attacker bypasses the login page by typing a URL for a page beyond the login screen. b) What is a cross-site scripting (XSS) attack?

An XSS attack is one in which some input is echoed back in the form of information on a webpage. If a script can be put into the original input, this script will be executed when it is sent back to the user. c) What is a SQL injection attack?

SQL injection attacks occur when an attacker enters a string that includes the user’s info and another SQL query. When the program enters the input string in the SQL query, it may execute both the user’s and attacker’s query, providing info the attacker should not have (such as bank account routing info). d) What attitude should programmers have about user input?

Programmers should never trust user input. Input should be checked to make sure it does not contain anything a valid user would not enter.

8–5 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

e) What training should programmers who do custom programming have?

Programmers need to be trained in secure programming both in general and for their particular language and application.

WWW and E-Commerce Security The Importance of WWW and E-Commerce Security 7.

What risks do webservice and e-commerce service create for corporations?

Attacks can disrupt service, harm a company’s reputation, and expose private information with heavy repercussions to the firm. They can also enable customer fraud against the firm to succeed more effectively.

WWW Service versus E-Commerce Service 8.

a) Distinguish between WWW service and e-commerce service.

E-commerce adds functionality to webservice. b) What kinds of external access are needed for e-commerce?

An e-commerce server needs to have network access to a number of systems external to itself, including servers within firms (for order entry, accounting, shipping, and so forth) and servers outside the firm in merchant banks and companies that check credit card numbers for validity. The webmaster or ecommerce master often has no control over the security of other systems. c) Does the webmaster or e-commerce administrator have control over the security of other servers?

Neither the webmaster nor e-commerce administrator have control over the security of other systems outside their purview. d) Why are custom programs especially vulnerable?

Custom programs offer security through obscurity, but because they are often not programmed securely, hackers have automated tools that can find common exploits (such as buffer overflows) to allow them to attack the application.

Some Webserver Attacks 9.

a) What is website defacement?

Changing the contents of a webpage b) Why is it damaging?

It may be embarrassing to the company. c) In directory access commands and URLs, what does “..” represent?

It means move to the parent of the current directory.

8–6 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

d) What are directory traversal attacks?

Attacks in which a user reaches a directory outside of the WWW root directory and its subdirectories e) Create a URL to retrieve the file aurigemma.htm under the rainbow directory on the host www.pukanui.com. The WWW root is three levels below the system’s true root directory and the rainbow directory, which is under the projects directory, which is directly under the root directory. (Hint: Draw a picture.) http://www.pukanui.com/../../projects/rainbow/aurigemma.htm f) In what two ways have attackers circumvented filtering designed to stop directory traversal attacks?

Hackers have used hexadecimal and Unicode character sets to enter the value for the “..” characters to be executed.

Patching the Webserver and E-Commerce Software and Its Components Other Website Protections 10.

a) What software must be patched on an e-commerce server?

The webserver, the e-commerce server, and subsidiary programs must all be upto-date on their patches. b) What three other webserver protections were mentioned in the text?

The three other webserver protections mentioned in the text were (1) website vulnerability assessment tools, like Whisker, (2) reading website error logs, and (3) using a webserver proxy in front of the webserver. c) Where is an application proxy firewall placed relative to the webserver?

Application proxy firewalls would be placed in front of the webserver, between the webserver and the border router.

Controlling Deployment 11.

a) In staged development, what three servers do companies use?

A development server, a testing server, and a production server b) What permissions does the developer have on the development server?

Developers get extensive permissions on the development server. c) On the testing server?

Developers get no permissions on the testing server. d) On the production server?

Developers get no permissions on the production server. e) On what servers does the tester have access permissions?

The tester should only have access to the test servers.

8–7 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Web Browser Attacks 12.

13.

a) Why do hackers attack browsers?

Attackers might want to have data stored on the client, and attackers can use a compromised client to attack other systems for which the client has access credentials. b) What is mobile code?

Mobile code consists of commands written into a webpage that are downloaded when the page is visited. c) Why is it called mobile code?

It is called mobile code because the code travels from the webpage to the client to execute. d) What is a client-side script?

A client-side script is code that is written to execute on the client PC, allowing the attacker access to the PC. e) What is a Java applet?

A Java applet is a small program written in the Java language. The Java applet is downloaded into a webpage. f) Why is Active-X dangerous?

Active-X is dangerous because it has significant permissions on the machine. If a hacker writes in Active-X, it could compromise the PC easily. g) How do scripting languages compare to full programming languages?

They are simpler and more limited. h) Is JavaScript a scripted form of Java?

No a) Why is it bad to go to a malicious website?

Malicious websites can have attack scripts that automatically load an executable on a PC, which is bad. b) How can social engineering be used to trick a victim to go to a malicious website?

Hackers can send messages saying something bad (or good) has happened and directs you to a malicious website. c) Why do attackers want to get domain names such as micosoft.com?

Common misspellings of legitimate websites will naturally draw users. Once at the site, the malicious websites can download mobile code to attack the PC. d) Why can malware that allows an attacker to execute a single command on a user’s computer not really be limited to executing a single command?

Malware that allows an attacker to execute a single command may be used to initiate another program that provides much greater PC access (such as a command shell).

8–8 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

e) What may happen on a compromised computer if a user mistypes the host name in a URL? Mistyping a URL may send a user to a malicious website, where hostile mobile code is waiting to attack your PC. f) What dangers do cookies create?

Cookies can be used to track a user’s activity, which could violate privacy.

Cookies can also hold PII.

Enhancing Browser Security 14.

a) What can users do to enhance browser security?

Ensure patches are installed and upgrade the software when updates are available. b) Under Internet Options in IE, what can the user do on the Security tab?

The user can select the general security settings for general, intranet, trusted, and restricted websites. c) What are your computer’s settings for the four zones?

Answers will vary. d) In which tab are cookies controlled?

Cookies are controlled under the Privacy tab.

E-Mail Security E-Mail Content Filtering 15.

a) Why are HTML bodies in e-mail messages dangerous?

HTML can contain malicious scripts. b) What is spam?

Spam is unsolicited commercial email. c) What three problems does spam create?

Spam clogs mailboxes, slows user computers, and annoys users by requiring them to spend time deleting the unwanted messages. d) Why is spam filtering dangerous?

Spam filtering is dangerous because valid email will eventually be affected. e) For what legal reason should companies filter sexually or racially harassing message content?

Filtering explicit message content shows that the company does not tolerate this type of action and tries to stop it. (In case of lawsuits, this may help.) f) What is extrusion prevention?

8–9 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Preventing certain information from leaving the company g) Why is extrusion prevention needed for intellectual property?

It prevents the loss of trade secrets. h) What is PII, and why must it be prevented from leaving the firm?

PII is Personally Identifiable Information (such as SSN, date of birth, address, etc.) that must be prevented from leaving a firm in order to avoid lawsuits related to identify theft or credit card theft.

Where to Do E-mail Malware and Spam Filtering E-Mail Encryption 16.

a) Is encryption widely used in e-mail?

Encryption is not widely used in email because of the difficulties of end-to-end encryption systems. b) What part of the e-mail process does SSL/TLS usually secure?

SSL/TLS usually only secures the transmission of email from the client to the server. c) Is this end-to-end security? Explain.

This is not end-to-end security because unless all other links in the path are encrypted (such as between mail servers, and the POP3/IMAP connection from mail server to end user client application), there is no end-to-end security. d) What standards provide end-to-end security?

S/MIME and PGP provide end-to-end security. e) Compare PGP and S/MIME in terms of how applicants learn the true party’s public key.

S/MIME uses the traditional PKI to share keys. In PGP, keys are shared via circles of trust. f) Describe the advantages and disadvantages of each approach.

Using PKI offers the strongest security, but it is labor-intensive and can be expensive to get key pairs issued to all participants. PGP is cheaper, but the possibility of misplacing trust and having bogus public key/name pairs is high.

Thus, PKI has been used in corporate environments, while PGP is primarily used in person-to-person communications.

8–10 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Voice over IP (VoIP) Security Sending Voice between Phones 17.

a) What is VoIP? Voice over IP, or VoIP, is the digitization of voice and its transmission over a data network. b) Distinguish between IP telephones and soft phones.

IP telephones are telephones that contain everything needed to attach to a VoIP network.

A soft phone is a computer with hardware and software for VoIP. c) List in order of appearance at the receiver, the headers and message of a packet carrying voice between phones.

IP header UDP header RTP header Codec byte stream d) What does RTP add to compensate for the limitations of UDP? RTP adds sequence numbers (for in-order delivery) and time stamps (to control jitter).

Transport and Signaling SIP and H.323 Registration SIP Proxy Servers PSTN Gateway 18.

a) Distinguish between transport and signaling.

In transport, data/voice is sent. In signaling, the parameters for the communication channel are determined, configured, and managed. b) In Figure 8-29, is the packet shown a transport packet or a signaling packet?

The packet shown is a transport packet because it contains the Codec byte stream. c) What are the two main signaling standards in VoIP? SIP and H.323 8–11 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

d) What does the registrar server do? (Hint: Don’t say, “It registers things.”)

The registrar server adds the user and his location to the registration database for proxy servers to use to route calls. e) What type of SIP message does a VoIP phone use when it wants to connect to another VoIP phone?

First, the caller’s phone sends a SIP INVITE message to the caller’s own SIP proxy server. f) How is this message routed to the called VoIP phone?

The caller’s proxy server checks the IP telephone’s registration information, then contacts a proxy server on the destination end. The destination proxy passes the INVITE to the called VoIP phone. g) Are SIP proxy servers involved during transport transmissions? Explain.

No, SIP proxy servers are only used in signaling. h) What two types of communication does the media gateway translate between the VoIP network and the PSTN? It translates between both signaling and transport standards.

VoIP Threats Eavesdropping Denial-of-Service Attacks Caller Impersonation Hacking and Malware Attacks Toll Fraud Spam over IP Telephony New Threats 19.

a) What is eavesdropping?

Listening in on another’s conversations b) Why can DoS attacks be successful even if they only increase latency slightly?

By increasing latency, DoS attacks can severely degrade the performance of VoIP systems, making them almost unusable.

8–12 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

c) Why is caller impersonation especially dangerous in VoIP? VoIP caller impersonations can provide spoofed credentials, making the impersonation seem more realistic. d) Why are hacking and malware dangerous in VoIP? As with all applications, hacking and malware can render VoIP completely vulnerable to the attacker, where they can issue commands, such as SIP BYE, when they want to disrupt service or re-route data. e) What is toll fraud?

Toll fraud is when someone breaks into a corporate VoIP system to make free long distance calls. f) What is SPIT? Spam over IP Telephony g) Why is SPIT more disruptive than e-mail SPAM? Unlike e-mail spam, which you only get when you read e-mail, SPIT causes your phone to ring, annoying you directly.

Implementing VoIP Security Authentication Encryption for Confidentiality Firewalls NAT Problems Separation: Anticonvergence 20.

a) What authentication mechanisms are common on IP telephones?

SIP Identity protocols authenticate across second-level domains, increasing authentication between companies. b) What does SIP Identity ensure?

SIP Identity ensures that traffic is authenticated between two companies holding public/private keys. c) How can eavesdropping be thwarted?

Eavesdropping can be thwarted by encrypting both transport and signaling traffic. d) What sound quality problem may encryption create?

Encryption adds a small delay, which may impact performance.

8–13 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

e) Why do firewalls have problems with typical VoIP traffic?

Firewalls don’t like VoIP traffic because the packets are small, there are lots of them, they cannot be appreciably delayed to minimize latency, and they use multiple ports for signaling and transport. f) For SIP signaling, what port has to be opened on firewalls?

SIP signaling requires port 5060 to be open. g) Describe firewall port openings for VoIP transport.

Firewall port openings are required for SIP/H.323 messages. Additionally, the firewall must read these messages in order to open the transport ports. h) Why is NAT traversal problematic?

NAT adds latency to VoIP packets, and VoIP relies on IP addresses between participants; using NAT may break the VoIP protocol being used. i) How are VLANs useful in VoIP? Placing VoIP on a separate VLAN makes it difficult for attackers to come through the data side of the network to hack VoIP, and vice versa. It also helps to reduce traffic on the network for the data side.

The Skype VoIP Service 21.

a) What is Skype?

Skype is a VoIP service that currently offers free calling among Skype customers over the Internet and reduced-cost calling to and from Public Switched Telephone Network customers. b) Why is Skype’s use of proprietary software problematic?

Skype’s use of proprietary software is problematic because Skype uses proprietary software and protocols that have not been studied by security professionals. This causes security professionals to be concerned with the existence of vulnerabilities, backdoors, and other security threats. c) What problem is there with Skype’s encryption for confidentiality?

The problem with Skype’s encryption for confidentiality is that its method is unknown. Worse yet, Skype controls the encryption keys so that it can read traffic if it wants. d) Does Skype control who can register a particular person’s name?

No, an attacker can use another person’s name and impersonate him or her. Skype initial registration is open and uncontrolled. e) Why do firewalls have a difficult time controlling Skype?

Firewalls have a difficult time controlling Skype because Skype protocol is unknown and changes frequently to avoid analysis. Skype uses its structure to help users communicate through NAT firewalls. This is good for the user but bad for corporate security. f) Does Skype’s file transfer generally work with antivirus programs?

8–14 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

No, Skype’s file transfer generally does not work with antivirus programs. g) Overall, what is the big problem with Skype?

Although Skype concerns are theoretical, the fact that Skype cannot be well controlled by corporate security policies makes it unacceptable in many firms.

Other User Applications Instant Messaging (IM) 22.

a) In IM, what does a presence server do?

Presence servers allow two users to locate each other. b) What does a relay server do?

Relay servers have all messages pass through them, allowing filtering and recording. c) For corporate IM, what are the advantages of using a relay server instead of only a presence server?

Using a relay server allows the company to report IM messages to satisfy legal retention and other compliance regulations.

TCP/IP Supervisory Applications 23.

a) What is the Danvers Doctrine?

The general thrust by the IETF to add strong security to all or nearly all of its standards b) Distinguish between security in SNMP V1 and security in SNMP V2.

SNMP v1 had no security at all. SNMP v2 introduces community strings in which a shared secret between manager and managed devices was used to authenticate messages. However, the same secret was used on all devices, making it easy to crack and lose control of the secret. Also, the secret is sent in the clear, making it vulnerable to network sniffers. c) Distinguish between security in SNMP V2 and security in SNMP V3.

SNMP v2 security, consisting of community strings, was an improvement over SNMP v1, but still very inadequate. SNMP v3 added individual secrets shared between manager and devices for authentication. SNMP v3 also added confidentiality, message integrity, and time stamps to guard against replay attacks. d) What still needs to be done for SNMP security?

Future versions of SNMP should include a public-key implementation to provide strongest cryptographic controls for authentication, confidentiality, and message integrity.

8–15 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Conclusion Thought Questions 1.

2.

3.

4.

5.

6.

Do you think programmers should be allowed to develop server-side dynamic webpages given the dangers that are involved in their doing so?

Yes, programmers should be allowed to develop server-side dynamic webpages.

This capability is required in order to keep the company competitive or provide competitive advantage by adding rich features to websites. However, they need to be better trained in security to ensure their code is less susceptible to hacking.

Client-side scripting attacks usually require the client to visit a webserver with malicious content. How do you think attackers get users to visit such webpages?

There are many social engineering techniques to get users to visit webservers with malicious code. Links to these websites can be embedded in Phished emails or embedded in advertising pop-ups. As mentioned in the text, slight mistyping of URLs has been used by the bad guys. Also, many legitimate websites have been hacked to include malicious scripts; this is the most insidious attack because a user is going to a trusted website and still gets stung.

What three main topics would you select for a one-hour user training session on e-mail security? This question requires you to be selective. Do not create topics that are extremely broad to avoid being selective.

Answers will vary. Students should be forced to consider only three topics.

What three main topics would you select for a one-hour training session for senior managers on e-mail security? This question requires you to be selective. Do not create topics that are extremely broad to avoid being selective.

Should focus on things managers need to know, such as retention An employee working at home complains that some of her messages to fellow employees at the firm’s headquarters site are not getting through. What might be the problem?

The first thing to consider is the spam filtering policies. It is possible that the filtering policies are preventing her email from entering the firm. Other possible reasons could be that her system is corrupted and attempting to send viruses with her emails, and these are being filtered out by corporate virus protection services.

Additionally, she may be trying to send certain types of files that are automatically stripped (such as Access database files) and could contain scripts/malicious code, whether they are infected or not.

A company is warned by its credit card companies that it will be classified as a high-risk firm unless it immediately reduces the number of fraudulent purchases made by its ecommerce clients. Come up with a plan to avoid this outcome.

First and foremost, the company needs to inventory and patch all the WWW and e-commerce software (including third-party software components) running on their servers. It is easy to miss a single application or component that has a vulnerability that opens the site to fraudulent attacks. The company should use 8–16 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

website vulnerability assessment tools after the patches have been applied to verify the baseline is adequate. Website logs should be reviewed regularly for error messages that indicate possible attacks. Finally, the company should seriously consider installing one or more application proxy firewalls. They may be costly, but not as costly as the damage to its reputation and the increased fees from the credit card companies.

8–17 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Hands-on Projects NOTE: Screenshots for individual students will vary.

PROJECT 1 Computer newbies commonly ask how they can see which websites their spouse, son, daughter, significant other, roommates, and so on, have been looking at. They are unaware that most web browsers have built-in logging functions to keep track of all websites visited. It’s surprising how many people don’t know this tracking occurs.

In the following exercise, you’ll see that there is a tremendous amount of information logged about your web activities. It’s turned on by default in most web browsers. This exercise will use Microsoft Edge®. Chrome® and Firefox® have similar tracking functions.

1. Open Microsoft Edge. (You can search for “Microsoft Edge” from the Start menu.)

2. Press Ctrl-H to see your browser’s history (Edge, Firefox, and Chrome).

3. Take a screenshot.

4. Open up a folder from a prior day or week.

5. Take a screenshot.

6. Right-click any one of the prior days (or today) and click Delete.

7. Click Clear history and Clear.

8. In your browser, press Ctrl-H to see your browser’s history. (It should be empty.)

9. Take a screenshot.

PROJECT 2 There are a lot more than just cookies being passed around the web. For example, web bugs can track your browsing behavior across multiple websites. Thus, your behavior across multiple websites can be analyzed. It’s interesting to know which websites are using certain cookies, web bugs, or common advertising networks.

Ghostery® is an add-on that can be added to your web browser that will automatically give you a list of sources (i.e., companies) tracking you as you visit each website. For this project, we will use the Firefox web browser.

1. Download and install the latest version of Firefox from www.mozilla.org.

2. Open Firefox.

3. Click on the Firefox menu, and then Add-ons. (You can also press Ctrl-Shift-A.) 4. In the Search box, enter “Ghostery.”

5. Press Enter.

6. Click Install for the Ghostery add-on.

7. Click Restart now.

8. After Firefox restarts, browse to www.microsoft.com.

9. Note the Ghostery notice in the top right-hand corner of your web browser.

10. Take a screenshot of any trackers Ghostery may have found.

8–18 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

11. Visit a few well-known news websites. (News websites such as www.cnn.com, ww.msnbc.msn.com, www.foxnews.com, and www.abcnews.go.com will have a dozen or so trackers.)

12. Take a screenshot of the website that has the most trackers.

13. Browse to your university main page (e.g., www.longwood.edu).

14. Click on the Ghostery icon to read about any trackers that your university may be using.

15. Enter your name in the Firefox search box.

16. Take a screenshot.

M08_

Project Thought Questions 1. Why do you want to keep your browser history?

Keeping the browser history saves time by eliminating the need to download the same files each time you view them while also decreasing the amount of data being downloaded.

2. Do the benefits of having a browser history outweigh the potential costs of it being used inappropriately?

Student answers will vary. While having a browser history enables faster loading of previously visited sites and eliminates repetitive downloading of online content, periodic clearing of the browser history protects personal privacy in the online environment.

3. How could someone use your browser history for malicious purposes?

4. Your personal browsing history can be used to discover private sites you’ve been visiting that you may not want to be public information. Browsing history can also be used to target advertising to you based on that private browsing history. Could you edit the history file manually to show any browsing history you want?

Yes. By using CTRL+H, individual searches can be selected and deleted.

5. What are ad networks?

Ad networks act as an intermediary in the ad supply chain between supply sources (publishers) and demand sources (advertisers). Similar to a broker, an ad network is a collection of ad inventory available for sale to advertisers according to demand.

6.

Would websites share tracking information? Why? 6. It is possible that some websites will share tracking information with other companies.

Many collect user data and sell it to other businesses as a revenue stream.What is a white list?

A list of people or things that are considered to be trustworthy is called a white list.

7. Why would websites be interested in tracking your behavior?

Companies would be interested in using tracking information for websites to analyze users’ time spent on different areas of the site to determine which areas are of most 8–19 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

interest. This knowledge is used to provide content that relates to this implied preference. Advertisers are interested in behavior tracking for compiling advertisements and suggestions to encourage further engagement based on demonstrated preferences. Behavior tracking is sometimes used to assess the usability of website interfaces and enables developers to make appropriate changes to improve the engagement experience.

Case Discussion Questions 1.

2.

3.

4.

5.

6.

Could an insider use the fact that news feeds are scanned for trading decisions to manipulate the stock market? How? Yes, an insider could take a position in stocks (long or short), issue false news stories that would impact the price of the stocks, and then close the position to reap a large reward. The ability to manipulate information about a stock’s perceived future value can greatly affect its current market price.

How could highly integrated information systems be a threat to corporations?

Highly integrated information systems could be a threat to corporations if they create an inordinately large vulnerability. Any time systems are integrated, they become slightly more vulnerable due to their interrelated nature. For example, suppose an auto manufacturer shares its corporate database with a contracted tire manufacturer. The tire manufacturer may be able to gain access to other internal systems at the auto manufacturer that outsiders are blocked from. The tire manufacturer may then be able to add, delete, and modify any information in the auto manufacturer’s database. This could be a serious information security risk.

Could a subcontractor with weak security practices make a corporation more vulnerable?

How? Yes, a corporation that relies on a subcontractor may experience increased security risks if the subcontractor has weak security policies, procedures, and practices. For example, suppose a subcontractor sets up a temporary WLAN within a secure corporate network. The security of the corporation as a whole would then be compromised.

Why would web threats see such a drastic sixfold (600 percent) increase?

The drastic increase in web threats came from the use of a variety of attack vectors such as social media, mobile, and e-mail. The increase was also due to the fact that much of the new malware is being found on compromised legitimate websites.

According to the Websense report, how were attackers using social media?

Attackers are using shortened Web links to hide malicious URLs. They also took advantage of confusing new features and changing services on legitimate websites.

How can malware writers adapt to software detection techniques?

Fifty percent of web-connected malware became significantly bolder, downloading additional malicious executables within the first 60 seconds of 8–20 .

Chapter 8: Application Security Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

7.

infection. The remainder of web-connected malware proceeded more cautiously, postponing further Internet activity by minutes, hours, or weeks, often as a deliberate ruse to bypass defenses that rely on short-term sandboxing analytics.

How can organizations limit their exposure to malware?

Using a variety of malware and antivirus detection applications on hosts, servers, and network appliances can greatly reduce exposure to malware. Training users to avoid existing malware and updating them on new malware techniques is a good way to avoid human errors that lead to malware infections.

Perspective Questions 1.

2.

What was the most surprising thing for you in this chapter?

Student answers will differ.

What was the most difficult material in this chapter for you?

Student answers will differ.

8–21 .

.

Instructor’s Manual

Chapter 9

Data Protection Learning Objectives After studying this chapter, students should be able to: ➢ Explain why it’s important to secure data. ➢ Describe backup scope and methods. ➢ Describe the different RAID (redundant array of independent disks) levels. ➢ Explain the need for data storage policies. ➢ Explain database protections including access controls, auditing, and encryption. ➢ ➢ Describe how to prevent data loss, and how to securely delete data.

Teaching Suggestions Special Issues In terms of learning difficulty, this is a moderately difficult chapter for students. Students typically need more explanation about RAID levels and database security. It's best to go more slowly over these sections. If students have already had a database course, this chapter will be fairly easy to digest.

.

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Role in the Book This chapter covers material specifically related to data security. Chapter 7 covered host hardening, and Chapter 8 covered application hardening. This chapter is the last section in the "protect" part of the plan-protect-respond cycle.

Teaching the Material Flow of Material ➢ The chapter begins with a discussion of the importance of data. It shares a few examples where data breaches occurred and some of the impacts of those breaches. Emphasis is placed on securing data while it is being stored. ➢ The chapter then covers one of the most important things you can do to protect your data – backup. It discusses the scope of backups, shadowing, and full versus incremental backups. Various backup technologies are discussed, including local backup, centralized backup, continuous data protection, online backup, and a peer-to-peer model. ➢ The discussion then turns to backup media and RAID levels. The chapter includes a general discussion of the advantages and disadvantages of magnetic tape, DVDs, and hard disks. RAID levels 0, 1, and 5 are discussed using a shipping and storage metaphor.

There is a small section on computing parity. ➢ The next section focuses on data storage policies. It emphasizes how often backup should be done and tested, where they should be stored, and how they should be encrypted. The section ends with recommendations about access control, retention, and auditing policies as they relate to data storage, e-mail, and spreadsheets. ➢ The chapter then turns to database security. This section starts with a short primer on databases and relevant terminology. An explanation is given for why restrictions on database views are necessary. This section also covers how to protect against SQL injection attacks. It concludes with database policy audits, triggers, encryption, and a discussion about the benefits of a multi-tiered architecture. ➢ The last section focuses on data loss prevention. More specifically, it looks at issues surrounding data collection and web scraping. The discussion then looks at DRM, and data loss prevention systems. Emphasis is placed on preventing data from leaving a corporation. The section ends with a discussion about how to securely delete, wipe, and destroy data.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master.

Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

9–2 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report. The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report. Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

9–3 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key

Introduction Data’s Role in Business Securing Data 1.

a) What is the difference between data and information?

Data are raw facts. Information is meaning extracted from data. b) How can data be protected while it is being transmitted?

It can be encrypted (e.g., using a cryptographic system). c) How can data be protected while it is being processed?

Data can be protected by making sure applications are securely coded and hosts are hardened. d) What are some ways that data can be attacked when it is stored?

It can be accessed by unauthorized persons, destroyed, copied without permission, and taken outside the organization (i.e., data loss). e) How can data be protected while it is being stored?

It can be properly backed up, encrypted, and when necessary, destroyed.

Restrictions on access to the data can also be implemented while it is being stored.

Data Protection: Backup The Importance of Backup Threats 2.

a) List the ways in which data can be lost, adding some of your own.

Data can be lost by mechanical failure, environmental casualties, malware, lost or stolen devices, and human error.

9–4 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

b) How does backup ensure availability?

Backup will ensure availability because you will still be able to access your files from backup copies, even if your primary hard disk fails. c) Have you ever had to use a backup to restore a file? Explain.

Student responses will vary.

Scope of Backup 3.

a) Distinguish between file/directory data backup and image backup.

File/directory data backup copies data (not programs, registry settings, configurations). Image backup copies data and all those other things. b) Why is file/directory backup attractive compared with image backup?

File/directory backup is more attractive compared to image backup because it takes up less storage space and is much faster. c) Why is image backup attractive compared with file/directory data backup?

Image backup is attractive because it requires minimal additional work to restore a functioning, fully capable PC. d) What is shadowing?

Shadowing frequently records a backup copy of each file actively being worked.

If there is a failure, little will be lost. e) What is the advantage of shadowing over file/directory data backup?

The advantage of shadowing is that it allows for more current file changes to be restored. f) How is shadowing limited?

Shadowing is limited because when the capacity of the storage is exceeded, the oldest files are deleted first.

Full versus Incremental Backups 4.

a) Why don’t most companies do a full backup every night?

Full backups take a long time and thus companies usually only conduct full backups weekly. b) What is incremental backup (be precise)?

Incremental backups only back up data that has changed since the most recent full backup. c) A company does a full backup one night. Call this backup Cardiff. On three successive nights, it does incremental backups, which it labels Greenwich, Dublin, and Paris. In restoration, what backups must be restored first and second?

Cardiff, then Greenwich. (Dublin and Paris come next.)

9–5 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Backup Technologies 5.

a) What are the advantages of centralized backup compared with local backup?

Centralized backup alleviates the key problems associated with local backup, which are: Limited ability to enforce backup policy Limited ability to audit which computers were backed up per policy, how backups were done, or how data was protected b) Define CDP. CDP is continuous data protection. This is where two sites back up each other. c) Why is CDP attractive?

CDP is attractive because other sites can take over very quickly in case of a disaster, with little data loss. d) Why is it expensive?

CDP is expensive because ample bandwidth is needed between CDP sites to allow the real-time backup of data. e) Why is backup over the Internet to a backup storage provider attractive for client PC users?

The main reason for this being attractive is because it is very convenient. f) What security risk does it create?

There is the concern that the company owning the PC loses control over its data, which is a very large security risk. g) What is mesh backup?

Mesh backup is peer-to-peer backup onto other client computers. It sends backup data in parcels to many other client PCs. h) What are its technical challenges?

First, mesh backup operation must not slow down the computer on which packets are being written or from which packets are being retrieved. Second, specific client PCs are not always available for packet retrieval, so parcels need to be sent out redundantly. The most difficult technical problem is security. When a client PC receives a backup parcel, its user must not be able to read it, modify it, or delete it. i) Why is mesh backup desirable?

Mesh backup is desirable because it could make client PC backup automatic and, thus, eliminate the human factor in failing to conduct regular backups. It also utilizes corporate PC power that is often underused, compared to expensive separate backup hardware.

9–6 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Backup Media and RAID 6.

a) Why is magnetic tape desirable as a backup medium?

Magnetic tape can store vast amounts of data at the lowest cost per bit of any backup medium. b) Why is tape not desirable?

Tape is not desirable because it is painfully slow and there are many different tape formats and readers (not much standardization like optical media). c) Why is backup onto another hard drive attractive?

This method is attractive because it is a very fast method of backup. d) Why is it not a complete backup solution?

This is not a complete solution because it could also be lost if a computer is stolen or damaged in a fire. This method is also too expensive for long-term storage. e) How can this limitation be addressed?

Many companies use a hybrid backup method, using additional hard drives for storage for as long as possible, then transferring to tape at a pre-determined time or data size. f) How much data can be stored on a DVD or Blu-ray optical disk?

Currently, dual-layer DVDs store about 8 GB of data, and Blu-ray disks store 50 GB to 128 GB of data.g) What is the advantage of burning backup data onto optical disks?

The advantage would be that almost all users have optical disk burners. h) Is storing backups on optical disks for several years likely to be safe?

Probably not, because the life of optical disks is still unknown and is probably short.

Disk Arrays—RAID Raid Levels 7.

a) How can disk arrays ensure data reliability and availability?

A system using an array of drives increases reliability because redundant data are stored on multiple disks. Failure of a single drive in the array would not precipitate data loss. An array of drives can also increase read-write performance.

Disk performance is increased because data can be written to, or read from, multiple disks simultaneously. b) Explain RAID 0.

A RAID 0 configuration increases data transfer speeds and capacity by writing simultaneously to multiple hard disks. Writing data across multiple disks is 9–7 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

8.

known as striping. The striped set of disks is fast, but offers no reliability. If one of the drives fails, data on all disks are lost. c) Explain RAID 1.

In a RAID 1 configuration, the client operating system writes data to both the primary hard drive and the backup hard drive at the same time. No striping is used, so data transfer speeds remain approximately the same. Storage capacity also remains the same because the additional drive is just a mirror of the primary drive. d) Explain RAID 5.

A RAID 5 configuration stripes data across multiple disks to increase data transfer speeds. Reliability is provided by parity bits that enable reconstruction of data stored on other disks. A RAID 5 configuration can recover from a single drive failure, but not a multi-drive failure. a) What are the advantages of RAID 5 over RAID 1?

A small amount of storage capacity is lost by storing the parity bits (RAID 5), but it is much less than it would be if the entire array were mirrored (RAID 1). The recovery/rebuild time on RAID 5 would be much longer than on RAID 1. No recalculation of the lost data is necessary in RAID 1. b) Which RAID level discussed in this chapter has the fastest read-write speeds?

RAID 0 c) Is RAID 5 appropriate for home users? Why, or why not?

RAID 5 would be great for home users, but it is likely too expensive and difficult to configure. The tech-savvy end user could have a RAID 5 configuration at home, but most end users won't.

Computing Parity 9.

a) What is parity?

Parity bits enable reconstruction of data stored on other disks in case of failure.

Parity bits are stored on disks such that they can be used to reconstruct the original parts of any lost disk in the array. b) How does the XOR operator work?

The XOR parity bit will be a 1 if one or the other bits is a “1,” but not both bits are 1s. The parity bit will be a 0 if both bits are either “1” or “0.” c) How can parity be used to restore lost data?

Suppose Disk 3 (of 3) experienced complete failure. Data from Disk 1 (Part 1, Part 3, and Parity 5 & 6), together with data from Disk 2 (Part 2, Part 5, and Parity 3 & 4) could be used to recalculate the lost data on Disk 3 (Part 4, Part 6, and Parity 1 & 2). No data would be lost. After all calculations are done, the data on new Disk 3 will be identical to the data before the fire. d) How long would it take to recalculate the data on a lost disk?

9–8 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

It depends on the number of disks, size of the disks, read/write speeds, etc. It could take anywhere from several hours to several days. Rebuild times vary widely.

Data Storage Policies 10.

a) What should backup creation policies specify?

Backup creation policies should specify what data should be backed up, frequency of backups, restoration test intervals, and other related guidance.

Policies should address different types of data and computers to ensure the right backup is provided for the resource. b) Why are restoration tests needed?

Restoration tests are needed because if the data is important enough to spend precious time and resources to backup, it needs to be available when called upon.

Not testing will almost guarantee some failure that could have been addressed with simple testing. c) Where should backup media be stored for the long term?

Backup media should be stored on another site. d) What should be done about backup media until they are moved?

Backup media should be stored in a fireproof and waterproof safe until they are moved. e) Why is the encryption of backup media critical?

Encryption of backup media is critical because backup data can be lost or stolen.

Encrypting the data protects the company from expensive losses of PII or trade secrets. f) What three dangers require control over access to backup material?

The dangers of lost, stolen, or damaged backup material require control over access to the data g) If Person A wishes to check out backup media, who should approve this?

The manager of the person requesting media should approve the checkout. h) Why are checkouts of backup media suspicious?

Checkouts of backup media are rare, so every checkout should be examined carefully. There must be a valid operational reason for retrieving the backup media. i) Why should business units and the legal department be involved in creating retention policies?

There are many business and legal requirements regarding the retention of certain types of data; these departments should be involved in creating retention policies. j) What should backup audits include?

9–9 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Backups, like all other processes, require audits to make sure the established policies are being followed. Backup audits should examine backups for compliance with policy, including tracing what happened to samples of data that should have been backed up.

E-Mail Retention 11.

a) Why is retaining e-mail for a long period of time useful?

Retaining e-mail is useful in that it provides a history to be searched. b) Why is it dangerous?

It is dangerous because if it can be searched, info in the e-mail could be used against you. c) What is legal discovery?

Legal discovery is the process wherein a firm must provide records related to a lawsuit, including e-mails. d) What are courts likely to do if it would be very expensive for a firm to discover all of its e-mail pertinent to a case?

Courts do not care; the firm will have to pay to get the e-mails recovered. e) What can happen if a firm fails to retain required e-mail?

A firm can be fined or lose a lawsuit if they fail to retain e-mail. f) What is accidental retention?

Accidental retention is when e-mail or other files are located on backup tapes when they were thought to be deleted. g) How long can third-party e-mail providers keep your e-mails?

Indefinitely h) Is there a specific law that specifies what information must be retained for legal purposes?

No, there are multiple laws that specify what information must be retained. i) What two requirements in the U.S. Rules of Civil Procedure are likely to cause problems for firms that do not have a good archiving process?

In the initial discovery meeting, which occurs shortly after a lawsuit begins, the defendant must be able to describe what information it has and how it will provide it. This requires a good in-place archiving system.

The firm must be able to put a hold on all destruction of potentially relevant information if the possibility of a lawsuit is foreseen. It needs a good in-place archiving system to be able to do this. j) Why is message authentication important in an archiving system?

Without message authentication, there is no way to prove who sent a particular email. k) Comment on a corporate policy of deleting all e-mail after 30 days.

9–10 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Deleting e-mail after 30 days will inevitably get the firm in big trouble, fined, or possibly losing lawsuits.

User Training 12.

a) Are e-mail messages sent by employees private?

No e-mails sent over corporate resources should be considered private. b) What should employees be trained not to put in e-mail messages?

Employees should be trained not to say anything in e-mail that they would not want to see in court.

Spreadsheets 13.

a) Why is spreadsheet security an IT security concern?

Spreadsheets are a major focus of new compliance regulations resulting from the Sarbanes-Oxley Act of 2002. Spreadsheets are highly concentrated with PII and are used for many proprietary financial calculations that would be disastrous to have hacked or deleted. Also, manipulation of spreadsheets is a key technique of criminals attempting fraud. b) What two protections should be applied to spreadsheets?

Two protections are extensive testing for errors and fraud indicators, and the use of spreadsheet vault servers. c) Briefly list the functions of a vault server.

Spreadsheet vault servers offer the following: • strong access control, authentication, authorizations, and auditing • limited access to what a particular user can do and see in a spreadsheet • extensive auditing • version control of files • cryptographic protection between PC and server • active detection tools looking for policy violations • strong management tools to state and update policies d) Comment on vault server authorizations.

Vault server authorizations go beyond what a person can do with a file. They also limit what files a user can see on the spreadsheet (like when the user can see values in the cells but not the formulas that created them). e) Describe vault server auditing.

Vault server auditing includes check in/check out of files and individual cell changes. Individual cell change logs can be used for forensic analysis when required.

9–11 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Database Security Relational Databases 14.

a) What is a relational database? Explain.

Relational databases store their data in relations, commonly referred to as tables.

Entities are types of objects that represent persons, places, things, or events.

Entities are things (nouns) you want to store information about. Attributes, the columns in the table, are characteristics (adjectives) about the entity that you want to collect. b) Why would a database administrator want to restrict access to certain tables?

For example, an accountant at a hospital would not need to see tables containing patient medical records. Even though the accountant may be an honest and hardworking employee, his job does not require access to tables containing patient medical records. Conversely, a medical doctor would not need access to tables containing financial data. c) Why would a database administrator want to restrict access to certain columns?

For example, only a few employees might be allowed to retrieve information in the salary column. Other employees could read other attributes in the Employee table, but not salaries. d) Why would a database administrator want to restrict access to certain rows?

For example, access to employee data can be restricted to rows for each department. Each department could view their own employee records, but not the records for other departments. e) How would limiting data granularity protect the underlying database?

For instance, in analyzing data for personnel, privacy concerns may restrict searches to being no more detailed than sums and averages at the department level. f) What is a data model?

A data model consists of entity names, attributes, and the structure of relationships between entities.

Database Access Control 15.

a) What is a DBMS? Database management systems (DBMS) such as Microsoft SQL Server, MySQL, IBM DB2, and Oracle can manage database structures, and restrict access to individual databases. b) Can a DBMS manage multiple databases? Why?

9–12 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Yes, a DBMS (like Microsoft Access) can access many different databases. The DBMS simply manages access to the database. c) How can validation protect against a SQL injection attack?

Incoming data can be validated by making sure they are in the expected data type (e.g., text, integer, or binary), size (e.g., 32 bits, 10 characters, or less than 5 KB), or format (e.g., DD/MM/YY or (555) 555-5555). d) How can sanitation protect against a SQL injection attack?

Incoming data can be sanitized to remove unacceptable characters that could be used to manipulate the SQL statement.

Database Auditing 16.

a) What types of database events should be audited?

Logins, changes, warnings, exceptions, and special access should be audited. b) How could SQL triggers be used to secure a database?

Triggers can also be used to implement audit policies and detect noncompliance with security policies. c) What is a DDL trigger?

Data Definition Language (DDL) triggers can be used to produce automatic responses if the structure of the database has been altered. d) What is a DML trigger?

Data Manipulation Language (DML) triggers can be used to produce automatic responses if data have been altered. e) What type of sensitive data exists at your organization?

Answers will vary.

Database Placement and Configuration 17.

a) What is a multi-tiered architecture? Why is it important?

A multi-tiered architecture separates the presentation (webserver), application processing (middleware server), and database management (database server) functions. It protects other layers by separating functions. If one layer is compromised, it won't necessarily compromise the other layers. b) How could a multi-tiered architecture stop or mitigate the effects of an attack?

A tiered architecture provides a greater level of protection to the database because vulnerabilities or attacks on one layer won’t necessarily affect other layers. For example, a DoS attack against the webserver won’t overwhelm the database server and shut down the database. c) Why is changing the default database listening port important?

Attackers use automated port scanners to look for databases running on known default ports. Changing the default port can slow down an attacker.

9–13 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Data Encryption 18.

a) Why is encryption usually attractive for sensitive data from a legal standpoint?

From a legal standpoint, loss of encrypted data comes with negligible risk of exploitation and the costly responsibility to report lost unencrypted data. b) How long must an encryption key be to be considered strong today?

An encryption key must be at least 8 characters long to be considered strong today. c) What happens if the encryption key is lost?

If the key is lost, this could be disastrous for the firm. People with legitimate access will also be locked out. d) How do companies address this risk?

Companies address the risk of lost encryption keys by holding copies of the keys in escrow, either on-site or off. e) Why is entrusting users to do key escrow risky?

The user may not do it, or may not be able to find it, and if fired, may refuse to give it up, locking up all the data on the computer. f) In what sense is encryption usually transparent to the user?

Encryption is usually fully transparent to the PC user. As long as you know the password for your computer, you can work with encrypted directories and files exactly as you do with unencrypted directories and files. g) Why is this attractive?

It is attractive because once the user is logged in, he or she can see all encrypted data. h) Why is this dangerous?

Encryption is only as good as the security of accessing a computer. If a computer is poorly secured with inadequate or no passwords, encryption will not matter if the attacker has full access to the PC. i) What must users do to address this danger?

Users must have strong login passwords. j) How does encryption make file sharing more difficult?

File sharing requires files to be unencrypted prior to sharing; adding encryption adds another step to the file sharing processes.

Data Loss Prevention Data Collection 19.

a) What is data loss prevention (DLP)?

9–14 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Data loss prevention (DLP) is a set of policies, procedures, and systems designed to prevent sensitive data from being released to unauthorized persons. b) Are there some types of data that are too risky to collect?

Yes, healthcare records, credit card information, or social security numbers (SSN) may have additional legal requirements related to proper storage and handling.

Loss of these data may lead to enormous liabilities. The potential cost of being sued may outweigh the benefit of having them on file. c) In your judgment, do most organizations adequately protect their data? Why? Student answers will vary. d) What is PII? Please give a couple examples of PII. Personally identifiable information can be used to uniquely identify a person.

Examples include name, SSN, driver license number, tax ID number, address, photo, etc. e) What is data masking?

Data masking obscures data such that it cannot identify a specific person, but still remains practically useful.

Information Triangulation 20.

a) How are linking attributes used to connect disparate databases?

Attributes from one database match, or closely match, attributes in a second database. For example, a person’s name from a public voter list could be associated with medical data through linking attributes. b) Explain information triangulation?

Data from multiple sources can be combined to identify individuals in a form of information triangulation. The combination of two compliant “anonymous” datasets can be used to create a third dataset that is noncompliant, and possibly against the law. c) What are the odds of correctly identifying a person based on their ZIP code, date of birth, and gender? Why? Professor Latanya Sweeney at Carnegie Mellon University combined data from a public voter list with seemingly anonymous medical data. She found that it was possible to correctly re-identify 87 percent of individuals using ZIP code, birth date, and sex. d) What is profiling?

Profiling uses statistical methods, algorithms, and mathematics to find patterns in a dataset that uniquely identifies an individual.

9–15 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Document Restrictions Data Loss Prevention Systems 22.

a) What is DRM? Give an example of how DRM works.

Digital Rights Management restricts what people can do with certain types of data, such as copyrighted material. Examples may include music, books, pictures, etc. b) Why is DRM desirable?

DRM is desirable because it can be used to protect trade secrets, sensitive personal data, and copyrighted material. c) Give some examples of use restrictions that a company may wish to impose on a document.

A firm may only allow a person to download a document but not save it locally, print it, change it, or take other actions. d) How can many DRM protections against unauthorized printing be circumvented?

If the information appears on the screen, screen capture software can make a copy to be put in another file for saving, printing, and other undesired actions. e) What is the purpose of data extrusion management?

Data extrusion management attempts to prevent restricted data from leaving the firm without permission. f) How can DLP systems be effective when placed at the gateway, on clients, and on a database server?

DLP systems can filter all incoming and outgoing content including e-mail, instant messaging, FTP transfers, unapproved webmail, and so on. Client content can be scanned before data are sent. This would prevent illicit content from being passed across the local network. DLP systems can actively search out, tag, and monitor sensitive data anywhere on corporate databases. They can also monitor access to sensitive data. g) What is watermarking?

Watermarking is adding invisible information to a file that can be used to identify the source. h) In what two ways can watermarking be used in data extrusion management?

Files can be watermarked for internal use only, and these files can be filtered out if attempts are made via e-mail attachments, FTP, or other means to send them outside the firm.

Also, each copy of a file can be given a different watermark. If a file is extruded to the outside world and then found again, the file can be traced back to its first receiver through the file’s specific watermark. i) Why is it desirable to prevent a computer from working with removable media?

9–16 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

It is easy to steal data through removable media. j) Why should restrictions on removable media be enforced technologically?

Non-technological restrictions on the use of removable media are almost impossible to enforce. k) Why have document protections not been used heavily in organizations?

They are very difficult to enforce and companies usually restrict access and functionality from documents in uncomfortable ways.

Employee Training 23.

a) Why do employees have to be trained about data security?

Yes, most employees must be trained on data security policies and procedures.

Oftentimes, employees are unaware that they are violating data security policies.

They may be unaware of how their actions could lead to data loss. b) Do you know someone who has posted information about work on their blog or social networking site? Was it positive or negative?

Answers will vary. It's not uncommon for most students to say that they know someone who has posted negative comments about their employer. c) From a security point of view, do you think social networking sites have made corporations more or less secure?

Answers will vary. In general, social networking has improved communication and connected people in unique ways. However, it has also created unique security problems that did not previously exist. In this sense, it has made it less secure.

Data Destruction 24.

a) Why is it important to destroy data on backup media and PCs before discarding them or transferring them to someone else?

If they contain sensitive information, this information may be used subsequently by unauthorized parties. b) What is the difference between basic file deletion and wiping?

Basic file deletion happens when you empty the Recycle Bin. The pointers referring to certain sectors are removed, but the data in those sectors remain. Only the reference to the sectors has been removed. The file has been logically, but not physically, removed. Wiping, or clearing, is logically and physically erasing data so that it is unrecoverable. Even recovery software cannot restore files if they have been securely deleted. The hard drive remains usable, but prior data cannot be recovered. c) Is it safe to wipe a hard disk and then give it to someone else? Why, or why not?

Yes, secure file deletion, known as wiping or clearing, is logically and physically erasing data so that it is unrecoverable. Even recovery software cannot restore files if they have been securely deleted. The hard drive remains usable, but prior 9–17 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

data cannot be recovered. You could safely give it to someone else without worrying about them recovering your data. d) What does degaussing do?

It demagnetizes the media. e) Name some effective methods of data destruction?

Media can be shredded, melted, or degaussed (demagnetized). f) How can optical disks be destroyed?

The best way to destroy an optical disk is to destroy it physically. It is recommended to run a disk through a shredder.

Conclusion Thought Questions 1.

2.

3.

4.

5.

Is there data in your organization that should be encrypted, but isn’t? Why? Answers will vary. Typically, most organizations contain at least some data that they feel should be encrypted, but isn't. It's usually not encrypted because they 1) don't make the time to encrypt the data, or 2) don't know how to encrypt it. Most wish there was an automated way of encrypting important data.

Could you get enough information from the Internet to take out a loan in another person’s name?

Typically not, unless it is stolen. Enough data can be stolen through the Internet to perform identity theft many times over. However, taking out a large loan usually requires a photo ID (e.g., driver's license), SSN, and an in-person interview.

These are substantial barriers, but not impossible to overcome.

How much data would you lose if your computer’s hard drive crashed right now? Could you reduce the amount of data that would be lost? How? Answers will vary. A small number of students do weekly backups. A fairly large portion of students do backups once a month, or every couple of months. Another group will fall into the category of never having performed a backup.

What effect do you think cloud computing will have on data security?

Answers will vary. Some students will argue that data security will be better with cloud computing because systems administrators who manage the cloud will have more experience at securing data. Others will argue that it creates a single point of failure. One weakness in the cloud will expose an enormous amount of data.

What do you think the impact of social networking will have on data security? Provide your reasoning.

Answers will vary. Most students will respond that social networking will create more data security problems. For example, attackers can learn your date of birth if your friends post happy birthday messages that can be seen publicly.

9–18 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

6.

Why do so many data thefts originate from outside the victim’s host country (Hint: Think extradition)?

Many countries won't, or can't legally, extradite their citizens for computer-based crimes. Criminals know this and take full advantage of the fact that they won't be prosecuted. Some of the data thefts may be state-sponsored.

Hands-on Projects NOTE: Screenshots for individual students will vary.

PROJECT 1 VeraCrypt® makes the process of securing your private files easy. Using VeraCrypt, you can create a mountable virtual drive from a file on your existing C: drive. The new virtual drive is fully encrypted. You can just drag-and-drop your files into this new drive. Once you are done using the files on the encrypted drive, you just unmount the drive with VeraCrypt.

After unmounting the drive, it will look like a normal (and big) file again. All your data is safely encrypted. If you want to access the files, you simply use VeraCrypt to mount the drive again.

The ability to move files directly to another drive without having to enter a password for each individual file saves a great deal of time. VeraCrypt reduces the overall load on users.

VeraCrypt is a great solution if you are working with a large number of files that need to be encrypted.

VeraCrypt can also encrypt your entire hard drive, a USB, or a partition. The best part about VeraCrypt is its price. It’s free.

1. Download VeraCrypt from www.veracrypt.fr/en/Downloads.html.

2. Click Download for the Windows version. (There are also versions for Mac OS and Linux.)

3. Click Save.

4. Select your C:\security folder.

5. If the program doesn’t automatically open, browse to your C:\security folder.

6. Right-click on VeraCrypt Setup 1.21.exe and select Run as administrator.

7. Click I Accept, Next, Next, Install, OK, No, and Finish.

8. Double-click the VeraCrypt icon on your desktop.

9. Click Tools and Volume Creation Wizard.

10. Click Next, Next, and Select File.

11. Browse to your C:\security folder.

12. Select any text file with your name showing. (You can create a new text file if one doesn’t exist. In this case, it’s RandyBoyle.txt.)

13. Click Save and Yes. 14. Take a screenshot.

15. Click Next.

16. Note the encryption algorithm used.

17. Click Next.

18. Enter 20 MB for the size of the container.

9–19 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

19. Click Next.

20. Enter a password that you can remember (in this case, “tiger1234” without quotes).

21. Click Next, Format, Yes, OK, and Exit. (The VeraCrypt Volume Creation Wizard will close, but the main VeraCrypt window should still be open.)

22. Click on the Q: drive. (You can select any available drive.)

23. Click Select File.

24. Browse to your C:\security folder.

25. Select the text file you chose earlier. (In this case, it was RandyBoyle.txt.)

26. Click Open.

27. Click Mount.

28. Enter the password you chose earlier.

29. Click OK. 30. Open Windows Explorer.

31. Drag-and-drop any file from your C:\security folder to the newly created drive (in this case, the Q: drive).

32. Take a screenshot.

33. Close Windows Explorer.

34. Back in VeraCrypt, click on the Q: drive.

35. Click Dismount.

36. Open Windows Explorer.

37. Browse to your C:\security folder.

38. Note the size of the text file you selected earlier. (In this case, RandyBoyle.txt is now 20 MB.) 39. Take a screenshot showing your new text file.

PROJECT 2 After people learn that all of the files they have deleted in the past could be recovered they only want to know one thing − how to permanently delete those files. It’s not that they are trying to hide anything. They may just want to protect their privacy.

File shredders permanently delete files so they are unrecoverable. Some file shredders can permanently delete files that are still recoverable. In other words, they do this by "wiping" the free space on the hard disk. Free space may contain files that were not securely deleted.

Individuals and companies also need to make sure all confidential data are deleted from hard drives before they dispose of them. Recovering files from discarded hard drives is extremely easy to do. Eraser® will delete any files on your hard drive that were not securely deleted. It will not delete any existing data. It only wipes the free space.

1. Download Eraser from http://eraser.heidi.ie/.

2. Click Downloads.

3. Click on the latest stable build. (At the time of this writing, it was Eraser 6.0.10.)

4. Click Save.

5. Select your download folder.

6. If the program doesn’t automatically open, browse to your download folder.

7. Right-click the Eraser executable file you downloaded.

8. Select Run as administrator.

9–20 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

9. Click Next, Accept, Next, Typical, Install, and Finish.

10. Click Start, All Programs, and Eraser. (You can also click on the Eraser icon that was put on your desktop.)

11. Right-click the empty Eraser table and select New Task.

12. Click Add Data.

13. Select Unused disk space.

14. Select the drive you want to clean. (A small USB works faster than your hard drive.)

15. Click OK and OK. 16. Right-click the task labeled "Unused disk space."

17. Select Run now.

18. Double-click the task labeled "Unused disk space" to see the progress of the wiping.

19. Take a screenshot while it is running. (If it takes too long, you can click Stop. If you selected your C: drive, it will take hours to complete.)

20. Open Windows Explorer (i.e., your file browser).

21. Browse to your downloads folder.

22. Right-click any file you want to delete. (You can select any of the prior downloads.)

23. Select Eraser and Erase.

Project Thought Questions 1.

2.

3.

4.

5.

6.

What would you see if you opened the text file you used in this project?

It is full of jumbled up characters.

What is the purpose of a “hidden” volume? (This was an option when you created the first volume.)

In case you are forced to open your encrypted drive, you could give a fake password and it would open a secondary “hidden” volume showing the files you chose. This is for the truly paranoid.

What are keyfiles and how do they work?

The TrueCrypt website states, “Keyfile is a file whose content is combined with a password (for information on the method used to combine a keyfile with password, see the section Keyfiles in the chapter Technical Details). Until the correct keyfile is provided, no volume that uses the keyfile can be mounted.” This will stop a criminal even if they use a keylogger to get your password. Without the keyfile, they won’t be able to access your encrypted drive.

Can VeraCrypt encrypt an entire drive (e.g., an external hard drive)?

Yes, it can easily encrypt an external hard drive. You can keep all your data from prying eyes even if they have administrator-level privileges on your machine.

What methods does Eraser use to “shred” the files?

It overwrites the file with multiple passes. There are multiple methods for erasing files. The DOD 5220 standard is typically sufficient.

Can you right-click any file and shred it directly (or securely move it to another directory)?

Yes, you can right-click on files and delete them directly.

9–21 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

7.

8.

Why does it take so long? Could it go faster?

Yes, it could go faster if you select a different protocol.

Why isn’t this functionality included with Windows?

It’s not clear exactly why it’s not included as part of Windows. Most users actually believe their files are permanently deleted when they empty the recycle bin. It might be helpful not to permanently delete files because users may need them recovered later.

Case Discussion Questions 1.

2.

3.

4.

5.

6.

How should a corporation respond to a large-scale loss of customer data?

Once a corporation realizes that they have experienced a large-scale data loss, they should immediately contact law enforcement, forensic computer examiners, and then their customers. They should be open and forthright about how the loss occurred, the steps they are taking to mitigate its effects, and efforts that are underway to keep it from happening again.

How might a corporation be hurt by acknowledging a large-scale data loss?

Many corporations fear the reputational damage that might be done if they admit to a large-scale data loss. Consumers may perceive that the company has weak security protections in place to safeguard their data. As a result, consumers may cease to do business with that company.

As data loss admissions become more widespread, how would they affect consumers’ willingness to share information with corporations?

Consumers may become weary of sharing their confidential information with corporations if they see widespread data losses occurring. They may choose to give corporations false, or “dummy,” information about who they are. Or they may perceive the relationship as too risky and simply cease using the service.

How should a corporation decide the appropriate level of resources to devote to securing its data?

A good guide to understanding the appropriate level of resources to allocate to securing corporate data is to look at existing regulation requirements. For example, if a company stores credit card information, they will need to adhere to PCI-DSS standards. If they store patient information, they will need to adhere to HIPAA standards. They should also consider following industry best practices for their respective industry. Certain corporations may need to take additional precautions if they are in an industry that is a prime target for cyber espionage by external nation states.

Why is the health care sector such a big target for data thieves?

Health care data often contain all the information necessary to initiate identify theft. Health care records often contain names, addresses, dates of birth, social security numbers, credit card numbers, etc.

Why are corporations worried about insider threats with respect to data loss?

9–22 .

Chapter 9: Data Protection Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

7.

Corporations are especially concerned about insider threats because of the access they have to corporate data. Insiders can easily extricate (steal) large amounts of data without being noticed. They know the systems, procedures, logs, and may be motivated to steal the data.

Why have the incidents of data loss seen a rise in the past few years?

Following a fall in reported incidents in 2009-2010, the trend reversed with a higher number of incidents reported in 2011, and total incident numbers in 2012 almost returning to 2008 levels. This could be explained by a maturing regulatory environment in which incidents are being identified and monitored more thoroughly. But it is also likely to be a result of the dramatic increase in the sophistication and variety of attacks we have seen in the last 18 months.

Perspective Questions 1.

2.

What was the most surprising thing you learned in this chapter?

Student answers will differ.

What part was the most difficult for you?

Student answers will differ.

9–23 .

.

Instructor’s Manual

Chapter 10

Incident and Disaster Response Learning Objectives After studying this chapter, you should be able to: ➢ Explain the basics of disaster response. ➢ Describe the intrusion response process for major incidents. ➢ Describe the functions and types of intrusion detection systems (IDSs). ➢ Describe business continuity planning. ➢ Know the IT disaster recovery process and how to respond to security incidents.

Teaching Suggestions Special Issues In terms of learning difficulty, this is a rather easy chapter for students. The only specific concept that causes problems for students is the difference between IT disaster recovery and business continuity planning.

Role in the Book This chapter completes the plan-protect-respond cycle. Chapter 2 covered planning, Chapters 3 through 9 covered protection, and this final chapter covers response.

.

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Teaching the Material Flow of Material ➢ The chapter begins with information about how incidents happen and gauging severity.Planning is crucial, and plans must vary for different types of incidents: false alarms, minor incidents, major incidents, and disasters. Rehearsals are crucial for the speed and accuracy needed to minimize losses. ➢ The chapter then discusses intrusion response for major security incidents, which are defined as incidents too large for the on-duty staff to handle. Response must be handled by a computer security incident response team (CSIRT), which draws on staff in many departments from across a firm. Response proceeds through detection, analysis, escalation, containment, recovery, apology, punishment, and postmortem evaluation. ➢ If a company wishes to prosecute an attacker, it needs to have a good understanding of the legal system. The chapter has a box on legal considerations in prosecution. Teachers must decide whether to cover this material and what to cover based on their students’ background in business law. ➢ The next section discusses intrusion detection system (IDS) technology, which is crucial in detecting attackers quickly. The section focuses on distributed IDS technology, the aggregation of log file data, and correlation. This section also covers managing IDSs and honeypots. ➢ The next section covers business continuity planning. A response to business continuity threats requires an understanding of business processes and their interrelationships, prioritizing business processes, specifying resource needs, and specifying actions and sequences. It is also important to test the plan and update the plan frequently. ➢ The final section covers IT disaster recovery. Depending on the situation, IT disaster recovery can be a stand-alone concern or part of a broader business continuity effort. This section considers types of backup sites, office PCs, and the restoration of data and programs.

Covering the Material After two chapters that are covered primarily by lecture, we come to a third chapter that again lends itself to lectures. To keep things more dynamic, try to have students come up with as many concepts as possible by themselves. For business continuity planning and IT disaster response, ask them to come up with a list of what they would do, and then take them through the material in the book. However, the legal section and the IDS section are best covered by lectures.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master.

Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

10–2 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Case Study Some teachers like to start class off with a case discussion that illustrates the material covered in the chapter. Starting class off with a case discussion increases student involvement and encourages students to read the chapter material before class.

Each chapter includes a business case that directly relates to the material covered in the chapter. The business case comes directly from a real-world example. At the end of each business case, you will find “key findings” from a related annual industry report. The report’s key findings are related to the business case and are focused on current industry issues. All industry reports are online and completely free. Footnotes provide URLs to each report. Industry reports tend to be 20-60 pages in length and can be assigned as additional reading.

10–3 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key

Introduction Incidents Happen 1.

a) Can good planning and protection eliminate security incidents?

No amount of planning can eliminate security incidents, but good planning can provide a baseline to build from in order to recover quickly. b) Name three terms that successful attacks are commonly called?

Successful attacks are commonly called security incidences, breaches, and compromises.

Incident Severity 2.

a) What are the four severity levels of incidents?

The four severity levels of incidents are false alarms, minor incidents, major incidents, and disasters. b) What is the purpose of a CSIRT? The purpose of a CSIRT is to respond to severe computer security incidents with impacts that are too large for the on-duty IT staff to handle. c) From what parts of the firm do its members come?

CSIRT members come from legal, PR, IT, and senior management. d) What is business continuity?

Business continuity is the maintenance of the day-to-day revenue generating operations of the firm. e) Who should head the business continuity team?

A senior manager should head the business continuity team.

Speed and Accuracy 3.

a) Why is speed of response important?

Speed of response is important because it can reduce damage. The attacker/s will have less time to do damage, and they cannot burrow as deeply into the system and become very difficult to detect. In these ways, speed is necessary for a more complete recovery. b) Why is accuracy of response important?

10–4 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Accuracy of response is equally as important as speed. It is a common mistake to act on incorrect assumptions. If the problem is misdiagnosed or the wrong approach is taken, things can get much worse. c) Define incident response in terms of planning.

Incident response means reacting to incidents according to plan. d) Why are rehearsals important?

Rehearsals improve speed and accuracy. Rehearsals are critical because no plan is useful until it is tested to find out its faults in implementation. e) What is a walkthrough or table-top exercise?

A walkthrough or table-top exercise is when managers and other key personnel get together and discuss, step by step, what each will do during an incident. These involve people from many departments. f) Why is a live test better?

Live tests are better than walkthroughs because live tests reveal subtleties that walkthroughs may miss or may not be able to address. g) What is the problem with live tests?

The problem with live tests is that they are very expensive.

The Intrusion Response Process for Major Incidents Detection, Analysis, and Escalation 4.

a) Distinguish between detection and analysis.

Detection is learning that an incident has occurred. Analysis is a deeper understanding of the incident needed to determine its potential damage and gather information to begin containment and recovery. b) Why is good analysis important for the later stages of handling an attack?

When proper analysis is done and gives good information, the company can proceed effectively through later stages of handling an attack. c) What is escalation?

Escalation means passing the incident up to the CSIRT or business continuity team.

Containment 6.

a) What is containment?

Containment means stopping the damage. b) Why is disconnection undesirable?

Disconnection is undesirable because it prevents legitimate business users from getting to a necessary server, which amounts to lost revenue.

10–5 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

c) What is black holing?

Black holing the attacker’s IP address means to drop all future packets from that IP address. d) Why may it only be a temporary containment solution?

Black holing is usually only effective against attacks from amateur hackers who do not have the resources to use bots or other agents to continue an attack. e) Why might a company allow an attacker to continue working in the system for a brief period of time?

A company may allow an attacker to continue working in a system for a brief period of time in order to collect data on what the attacker is doing and/or collect evidence for prosecution. f) Why is this dangerous?

The longer attackers are in a system, the more invisible they become through the deletion of IDS logs, and the more backdoors and other damage the attackers can create. g) Who should make decisions about letting an attack continue or disconnecting an important system?

Senior business executives should make the decision whether to let an attack continue.

Recovery 6.

a) What are the three major recovery options?

1. Repair during continuing server operation 2. Restoration from backup tapes 3. Total software reinstallation b) For what two reasons is repair during continuing operation good?

Repair during continuing server operation might be good because doing this on a server with a critical function keeps those services available to users. It also means that no data is lost because there is no need to resort to backup tapes, which only contain information since the last backup. c) Why may it not work?

Unfortunately, it is very difficult to root out all of the Trojan horses, registry entries, rootkits, and other unpleasant surprises planted by an attacker. For a virus or worm attack, there are programs that remove the specific artifacts created by the specific attack. For handcrafted break-ins, however, there is no general detection program, leaving a strong concern that “we may have missed one.” d) Why is the restoration of data files from backup tapes undesirable?

Restoration of data files from tapes takes a long time and data collected after the last backup will be lost. e) What are the potential problems with total software reinstallation?

10–6 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Total software reinstallation does not address lost data since the last backup and the software will have to be re-baselined to proper security, which is a timeconsuming process. f) How does having a disk image reduce the problems of total software reinstallation?

Disk imaging reduces the problem of having to re-baseline the system to proper security levels.

Apology 7.

What are the three rules for apologies?

The three rules for apologies are acknowledge responsibility and harm, explain what happened, and explain what action will be taken to compensate, if any.

Punishment 8.

a) Is it easier to punish employees or to prosecute outside attackers?

It is easier to punish employees than to prosecute outside attackers. b) Why do companies often not prosecute attackers?

Companies do not often prosecute attackers because prosecutions are expensive, with a low probability of success. There is also the possible loss of reputation from a public prosecution, showing that the company could not prevent the attack in the first place, which is made worse if they lose the case. c) What is forensics evidence? Contrast what cybercrimes the FBI and local police investigate.

Forensic evidence is evidence that is acceptable for court proceedings. The FBI mostly investigates matters of interstate commerce. Local police investigate violations of local and state laws. d) Why should both be called?

Both should be called because one or both may have jurisdiction based on the circumstances of the incident. e) Under what conditions will you need to hire a forensics expert?

In civil lawsuits, the company must use a certified forensics expert to collect data and interpret it in court. If it attempts to collect evidence on its own, the evidence will probably not be permissible in court. f) Why should you hire a forensics expert rather than doing your own investigation?

A forensic expert should be hired because they are experts in the field and know how best to handle evidence once detected. Also, they are allowed to give interpretative testimony. g) What is the chain of evidence, and why is documenting it important?

Chain of evidence is the documented history of all transfer of evidence between people and all actions taken to protect the evidence while in each person’s

10–7 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

possession. Without this documentation, the evidence may be rejected from being used in court.

Postmortem Evaluation 9.

Why should companies undertake a postmortem evaluation after an attack?

Conducting an after-action review allows the company to determine what went wrong or right after an attack in order to improve the response process.

Organization of the CSIRT 10.

a) Why should a senior manager head the CSIRT? Because all security decisions during a major incident are business decisions, a senior manager should head the CSIRT. b) Why should members of affected line departments be on CSIRT? Decisions cannot be made intelligently without an understanding of how affected line departments will be impacted. c) Who is the only person who should speak on behalf of the firm?

The only person who should speak on behalf of a firm should be the PR director. d) Why should the firm’s legal counsel be on the CSIRT? The firm’s legal counsel should be on the CSIRT to place actions in the proper legal framework and advise on the legal implications of various actions. e) Why should a firm’s human resource department be on the CSIRT? The firms HR department should be on the CSIRT to offer guidance on labor issues and implement sanctions against employees, if required.

Legal Considerations Criminal versus Civil Law 11.

a) What different actions do criminal and civil law deal with?

Criminal law deals with violations of criminal statutes. Civil law deals with interpretations of rights and duties that companies or individuals have relative to each other. b) How do punishments differ in civil and criminal law?

Criminal punishments include jail time and fines; civil penalties only result in fines and/or orders to a defendant not to take certain actions. c) Who brings lawsuits in civil and criminal cases?

Prosecutors charge defendants in a criminal case; plaintiffs bring a case against a defendant in a civil case. d) What is the normal standard for deciding a case in civil and criminal trials?

10–8 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Criminal trials require proving a defendant’s guilt beyond a reasonable doubt; civil trials require proving a defendant’s liability with a preponderance of the evidence (more than 50%). e) What is mens rea?

Mens rea is when the prosecutor must prove the defendant was in a certain mental state, such as having the intention to commit the act. f) In what type of trial is mens rea important?

Mens rea is important in criminal cases. g) Can a person be tried separately in a criminal trial and later in a civil trial?

Yes, a defendant whose actions violate both criminal and civil rules may be criminally prosecuted by the state and later civilly sued by a victim for monetary damages.

Jurisdictions The U.S. Federal Judicial System U.S. State and Local Laws International Law 13.

a) What is case law?

Decisions based on individual cases set precedents for how laws are interpreted in trials. b) What are jurisdictions?

Jurisdictions are areas of responsibility within which authorities can make and enforce laws but beyond which they cannot. c) What is cyberlaw?

Cyberlaw is any law dealing with information technology. d) What are the three levels of U.S. federal courts?

The three levels of US federal courts are: • 94 U.S. District Courts • 13 U.S. Circuit Courts of Appeal • The U.S. Supreme Court e) Which levels can create precedents?

The U.S. Circuit Courts of Appeal and Supreme Court can create precedents. f) Does federal jurisdiction typically extend to computer crimes that are committed entirely within a state and that do not have a bearing on interstate commerce?

10–9 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Crimes that are committed entirely within a state do not normally meet federal jurisdiction guidelines. g) Who is likely to investigate a cybercrime that takes place within a city?

The local police are likely to investigate a cybercrime that takes place within a city. h) Are international laws regarding cybercrime fairly uniform?

No, they are not. Internationally, cybercrime laws vary widely. i) Why should companies that do business only within a country be concerned about international cyberlaw?

The laws involving computers are different between countries and are changing rapidly. International law is important for multinational companies and also for companies that deal with customers or suppliers in other countries.

Evidence and Computer Forensics 13.

a) Why will courts not admit unreliable evidence?

Courts will not admit unreliable evidence because there is a belief that juries cannot be trusted to evaluate unreliable evidence properly. b) What is a computer forensics expert?

A computer forensics expert is a professional who is trained to collect and evaluate computer evidence in ways that are likely to be admissible in court. c) What type of witness is allowed to interpret facts for juries?

Expert witnesses are allowed to interpret facts for juries. d) Why should companies work with forensics professionals before they have a need for them?

Given the importance of admissibility, companies should use forensics experts when prosecution is anticipated and they should have prior discussions with their chosen forensics experts to understand what may be required.

U.S. Federal Cybercrime Laws Computer Hacking, Malware Attacks, Denial-of-Service Attacks, and Other Attacks (18 U.S.C. § 1030) Confidentiality in Message Transmission Other Federal Laws 15.

a) What section of which title of the U.S. Code prohibits hacking?

18 U.S.C. 1030 is the U.S. Code that prohibits hacking.

10–10 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

b) What other attacks does it prohibit?

It also prohibits DoS and malware attacks. c) Does it protect all computers?

18 U.S.C. 1030 only protects “protected computers” including government computers, financial institution computers, and any computer used in interstate or foreign commerce or communications. d) What are damage thresholds?

Damage thresholds are minimum amounts of damage that must occur before attackers are in violation of the law. e) What types of acts does 18 U.S.C. § 2511 prohibit?

18 U.S.C. 2511 prohibits the interception of electronic messages, both en route and after the message is received and stored, with the exception of e-mail systems owned by a company.

Intrusion Detection Systems (IDSs) 15.

a) What is an IDS? An intrusion detection system (IDS) is software and hardware that captures suspicious network and host activity data in event logs, and provides automatic tools to generate alarms, as well as query and reporting tools to help administrators analyze the data interactively during and after an incident. b) Is an IDS a preventative, detective, or restorative control?

It is only a detective control. Of course, if attackers believe that they are likely to be caught by an IDS, it may have preventative benefits as well. c) What are false positives?

False positives in an IDS are known as false alarms. d) Why are false positives problems for IDSs? IDSs tend to be ignored if they generate many false positives.

Functions of an IDS 16.

a) What are the four functions of IDSs? The four functions of IDSs are logging, automated analysis, administrator actions, and management. b) What are the two types of analysis that IDSs usually do?

Two types of analysis IDSs usually perform are attack signature detection and anomaly detection. c) What types of action did this section mention?

10–11 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Actions mentioned include alarms and log summary reports with interactive manual log analysis tools. d) What information should alarms contain?

Alarms should give the security administrator a description of what the problem is, a way to test the alarm for accuracy, and advice about what action the security administrator should take. e) What is the purpose of log summary reports?

Log summary reports list various types of suspicious activity. They also indicate threat priority by type of threat or by statistical analysis, indicating high frequency. The purpose of log summary reports is to give IDS administrators notice of threats that aren’t high risk or detected by alarms. f) Describe interactive log file analysis.

Interactive log file analysis allows administrators to drill down into log files to better understand an ongoing or completed attack, while filtering out irrelevant entries.

Distributed IDSs 17.

a) What is the advantage of a distributed IDS? A distributed IDS can collect data from many devices at a central manager console to allow a security manager to detect a more complex attack. b) Name the elements in a distributed IDS. There is a manager, an integrated log file, an agent host IDS, an agent network IDS, and an IDS vendor. c) Distinguish between the manager and agents.

The agent collects event data and stores them in log files on the monitoring devices. The manager program is responsible for integrating the information from the multiple agents that run on multiple monitoring devices. d) Distinguish between batch and real-time transfers for event data.

In batch transfers, the agent waits until it has several minutes or several hours of data and then sends a block of log file data to the manager. In real-time transfers, each event’s data goes to the manager immediately. e) What is the advantage of each type?

Batch transfer is the least expensive and has the lowest network load, while realtime transfer allows capturing of log files without worrying about attackers deleting log files. f) What two types of communication must be secure?

Communication between IDS agents and manager should be secure in order to ensure an attacker cannot spoof either and cause mass confusion to the IDS.

10–12 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Network IDSs 18.

19.

a) At what information do NIDSs look?

NIDSs look at all information traveling through a network. b) Distinguish between stand-alone NIDSs and switch-based or router-based NIDSs. Stand-alone NIDSs are boxes located at various points in a network. They read and analyze all network frames that pass by them. They are essentially corporateowned sniffers. Switch NIDSs and router NIDSs are switches and routers that have IDS software. Typically, these capture data on all ports. c) What are the strengths of NIDSs? The strength of NIDSs is that they can see all packets passing through some locations in the network. Often, these packets are highly diagnostic of attacks. d) What are the two weaknesses of NIDSs? The two weaknesses of NIDSs are that they leave blind spots on the network where no NIDSs are placed, and they cannot read encrypted data. a) What is the major attraction of a HIDS? The main attraction of HIDSs is that they provide highly specific information about what happened on a particular host. This is important for problem diagnosis. b) What are the two weaknesses of host IDSs? The two weaknesses of HIDSs are that they have limited views of what is happening on a network because they can only see on a particular host, and they can be compromised if the system is owned by an attacker. c) List some things at which host operating system monitors look.

Some things host operating system monitors look at are multiple failed logins, creating new accounts, adding new executables that may be attack programs, modifying executables (installing Trojan horses does this), adding registry keys (changes how system works), and changing or deleting system logs and audit files.

Log Files 20.

a) Why are integrated log files good?

Integrated log files are good because they are an aggregation of event logs from multiple IDSs. b) Why are they difficult to create?

They are difficult to create because of format incompatibilities. c) Explain the time synchronization issue for integrated log files.

If the times on the various IDSs are off by even a few thousandths of a second, it will be extremely difficult to see what is happening at a particular moment in time—especially if the attack is automated and occurs quickly. d) How do companies achieve time synchronization?

10–13 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Companies achieve time synchronization using the Network Time Protocol (NTP) service. e) What is event correlation?

Event correlation is the analysis of suspicious patterns in a series of events across multiple devices. f) Distinguish between aggregation and event correlation.

Aggregation is the collection of all log files, whereas event correlation requires analysis to determine related attack patterns. g) Why is analyzing log file data difficult?

Analyzing log file data is difficult because the relevant event exists in much larger event streams than are logged. h) In Figure 10-16, how long is the delay between the first attempted login and the second?

The delay is 44.28 seconds. i) Does this indicate that the attack is a human attack or an automated attack?

This is most likely a human attack (based on memory of the logs) because the attack is done in a reasonably human amount of time.

Managing IDSs 22.

a) What is precision in an IDS? Precision in IDS means that the IDS should report all attack events and report as few false alarms as possible. b) What are false positives, and why are they bad?

False positives are also known as false alarms and are bad because they will outnumber true alarms ten-to-one or even more. In fact, the large number of false positives generated by IDSs is the major problem with IDSs today, causing many firms to stop using them after a trial period. c) What are false negatives, and why are they bad?

False negatives are failures to report true attack activities. They are bad because they fail to notify the user of a valid attack. d) How can tuning reduce the number of false positives?

Tuning turns off unnecessary rules, and reduces the severity level of alarms generated by other rules, in order to limit the total number of false positives. e) What does an IDS do if it cannot process all of the packets it receives?

IDSs that are overwhelmed by packets will simply skip packets and possibly miss a valid, suspicious attack packet. f) What may happen if a system runs out of storage space?

When the system nears the point of running out of storage space, the IDS will transfer the log file to backup and start a new log file. g) Why is limiting the size of log files necessary but unfortunate?

10–14 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Limiting the size of log files is necessary to avoid exceeding storage capacity, and this limits the amount of log file data available for historical analysis.

Honeypots 22.

a) What is a honeypot?

A honeypot is a fake server or entire network segment with multiple clients and servers. b) How can honeypots help companies detect attackers?

Because legitimate users will not access the honeypot network assets, honeypot activities are normally attacker activities. c) Could a honeypot attract unwanted attention from attackers?

Yes, due to the number of ports being faked, a honeypot could attract additional attention from attackers looking for a specific service, operating system, or port.

Business Continuity Planning 23.

a) What do business continuity plans specify?

Business continuity plans specify how a company will maintain or restore core business operations after disasters. b) Distinguish between business continuity plans and IT disaster recovery plans.

Business continuity plans specify how a company, as a whole, will maintain or restore core business operations after disasters. Disaster recovery plans are geared only toward IT functions after a disaster.

Principles of Business Continuity Management 24.

a) What four protections can firms provide for people during an emergency?

Four protections are evacuation plans and drills, not allowing people to go back inside, accounting for all members, and counseling after a disaster. b) Why is accounting for all personnel important?

Accounting for all personnel is important because it shows that the company believes in its employees, takes care of them, and demonstrates corporate citizenship. c) Why does human cognition in crises call for extensive pre-planning and rehearsal?

Human cognition in crises is stifled; only extensive preplanning and practice provides a decent chance of proper human action during a crisis. d) Why is it necessary not to make plans and processes for crisis recovery too rigid?

10–15 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Avoiding rigidity is key because each crisis will be somewhat unique and require flexibility to address unexpected conditions. e) Why do communication systems tend to break down during crises?

Communication systems tend to rely on electrical power, which usually does not survive long during crises.

Business Process Analysis 25.

a) List the four steps in business process analysis?

Identification of business processes and interrelationships Prioritization of business processes Specification of resource needs Specification of actions and sequences b) Explain why each is important.

Identification of business processes and their interrelationships is important because all business processes must be identified and understood in order to move to the next step.

Prioritization of business processes is important because it helps the firm restore the most important functions of the business first.

Specifying resource needs is important and necessary when there are disruptions during and after the disaster.

Specifying actions and sequences is important because it will get the job done.

Testing and Updating the Plan 26.

a) Why are business continuity plans more difficult to test than incident response plans?

The processes involved in incident response plans are complex, but business continuity response processes are far more complex and therefore far more difficult to test. b) Why is frequent plan updating important?

Frequent plan updating is important because business conditions change constantly and because businesses reorganize constantly. c) Why must companies update contact information even more frequently?

The people holding specific roles changes very frequently. d) For what two reasons is a business continuity staff necessary?

The reason a business continuity staff is necessary is because there is constant updating and the staff will act as the operational manager when there is a disaster.

10–16 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

IT Disaster Recovery 27.

a) What is IT disaster recovery?

IT disaster recovery looks specifically at the technical aspects of how a company can get IT back into operation using backup facilities. b) Why is it a business concern?

IT disaster recovery is a business concern because decisions that seem purely technical may have major implications for the business that IT professionals may not accept and should not have the authority to make.

Types of Backup Facilities 28.

a) What are the main alternatives for backup sites?

The main alternatives for backup sites are hot sites, cold sites, and continuous data protection (CDP). b) What is the strength of each?

Hot sites have everything ready to go in an emergency and have little down time.

Cold sites offer the physical facilities to support a backup site, but do not have the equipment in place that a hot site does; this is cheaper than a hot site. As its name suggests, CDP provides continuous data protection with instantaneous recovery. c) What problem or problems does each raise?

Hot sites are very expensive, cold sites take significant time to procure and install needed equipment and software, and CDP sites usually cannot handle duties of both sites and must prioritize applications. d) Why is cloud-based hosting beneficial?

Reasons include lower costs, better disaster recovery, increased reliability, ubiquitous access to data, improved scalability, and elasticity. e) What might be the downside to cloud-based hosting?

Companies lose control over the exact location of their data and become dependent on the cloud provider. Companies also have to trust that the cloud provider is adequately protecting their data. As companies increase their use of cloud providers, they also inadvertently make their data potentially less secure. f) How does cloud-based hosting limit the damage from a local disaster?

Backup sites are spread across the globe, so redundant backups mitigate damage from a local disaster.

Office PCs 29.

What three things should a firm do about disaster recovery planning for office PCs? When recovery planning for office PCs, a company should first do a backup of everything. Then the firm should get in touch with computer vendors to preorder

10–17 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

for new office PCs. Finally, a firm should find a good working environment in which to use the office PCs, especially if the previous office is damaged.

Restoration of Data and Programs 30.

a) What must be done to restore data at a backup site via tapes?

First, the backup tapes must be delivered to the backup site; then the backup site must have the proper equipment to do the restoration. b) How does this change if a firm uses continuous data protection?

With CDP, the backup site already has the proper equipment and data, so recovery is instantaneous.

Testing the IT Disaster Recovery Plan

Conclusion Synopsis Thought Questions 1.

2.

You are advising a small company. a) Would you recommend using a firewall? Explain.

Advise the company to use a firewall because firewalls are part of intrusion prevention, which is designed to prevent or block any malicious activity into the network. Implementation of this may be long and expensive, but it is well worth it, depending on the type of data and information the company wants to protect and keep safe. b) Would you recommend using antivirus filtering? Explain.

Yes. Antivirus filtering is very necessary for a company to implement because it is one of the things that will protect a system from outside attacks. Also, because a company can’t fully regulate the Internet browsing activities of its employees, antivirus filtering can help protect against this as well. This is also something that doesn’t take much time to do and is relatively inexpensive. c) Would you recommend an intrusion detection system? Explain.

For a small company, an IDS would probably be too difficult to manage.

When IDSs generate alerts, it can send them to a console in the security center, to a mobile phone, or via e-mail. Discuss the pros and cons of each.

Putting an alarm on the manager console screen is not effective at nights or on weekends if no one will be at the console.

10–18 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

3.

Mobile phone warnings will reach the security administrator, but only very highprobability attacks should be signaled this way or the security administrator will throw the mobile away.

E-mail also is not good for instant announcements. E-mail is best if the security administrator checks e-mail frequently, but during attacks, e-mail cannot be trusted because the e-mail system may be compromised.

Examine the integrated log file shown in Figure 10-16. a) Identify the stages in this apparent attack.

Lines 1 – 8 Lines 9 – 11 Lines 13 – 16 Lines 17 – 21 b) For each stage, describe what the attacker seems to be doing.

Lines 1 – 8: Human attacker attempting and finally succeeding in logging into account Lee on 60.3.4.5 Lines 9 – 11: Compromised computer 60.3.4.5 opens a TFTP connection to transfer files from suspect host, possibly downloading hacker toolkit Lines 13 – 16: Compromised host communicating with another suspect host, possibly sending data retrieved by hacker software or downloading new hacker programs to exploit the compromised host Lines 17 – 21: Compromised host scanning computes on the 60.0.1.x network, looking for HTTP services for possible exploitation c) Decide whether the actions in this stage work at human speed or at a higher speed, indicating an automated attack.

Lines 1 – 8: Speed appears to be human driven Lines 9 – 11: Speed appears to be human driven Lines 13 – 16: Speed appears to be human driven Lines 17 – 21: Speed appears to be machine driven d) Decide whether the evidence in each stage is suggestive of an attack or conclusive evidence.

Lines 1 – 8: Suggestive of an attack, but not conclusive. Need to know more about the Lee account and who might be using it.

Lines 9 – 11: This is conclusive; do not expect any legitimate user to open TFTP connections to an outside host.

Lines 13 – 16: Suggestive, but not conclusive, as we don’t know what data is being transferred.

Lines 17 – 21: Conclusive – this is an obvious port 80 scan by a machine. e) Overall, do you have conclusive evidence of an attack?

Yes, there is conclusive evidence that an attack has taken place, based primarily upon the TFTP and HTTP port scanning.

10–19 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

4.

5.

f) Do you have conclusive evidence of who committed the attack?

The attacks were committed by a person or a program on 60.3.4.5. However, the evidence that 1.15.3.6 took over the Lee account is not strong. Trying to log in three times is not that uncommon. On the other hand, the attack occurred right after the Lee account login.

A firm is trying to decide whether to place its backup center in the same city or in a distant city. List the pros and cons of each choice.

• Same city pros: o Shorter distance between sites means cheaper costs for the dedicated bandwidth required for CDP-type backup. o Shorter distance for IT personnel to travel to get cold or hot backup site functional in shortest amount of time • Same city cons o Major environmental disaster could possibly take out both primary and backup sites o Even if the backup site is available, it may not be safe to have personnel travel to backup site due to inclement environmental conditions • Distant city pros: o Chance that an environmental disaster occurs at both primary and secondary site simultaneously is hopefully very slim • Distant city cons: o Less visibility of conditions at hot or cold site at time of disaster at primary site may make switching to backup site take longer o Higher cost in transferring data (CDP), material (computers and backup tapes) and personnel to backup site o May be unable to get knowledgeable personnel from primary site to backup location quickly in order to facilitate cutover To get out of taking exams, students occasionally phone in bomb threats just before the exam. Create a plan to deal with such attacks. This should take one single-spaced page. It should be written by you (a policy advisor) for your dean to approve and post in your college.

• Actions to be taken before the term begins: o Each teacher should decide on an alternate place to meet in case there is a bomb threat. The alternate place should be written into the syllabus. This removes the motivation to call in a bomb threat.

• Actions to be taken by recipient of bomb threat (assuming it’s a phone call): o Remain calm and attempt to obtain as much information as possible from the caller. Ask the caller to repeat the message and record every word.

10–20 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

•

•

•

•

o If the caller does not indicate the location of the bomb or time of detonation, ask for this information. Note if the caller appears familiar with the buildings. o Listen closely to the voice of the caller to determine voice quality, sex, age, accents, or words used repeatedly. If the caller is talkative, ask questions to try to ascertain the caller’s name and/or location. o Note background noises that could indicate the location of the caller. o If bomb threat is made via electronic means, save the information and provide it immediately to campus security for investigation.

After the threat is received: o Immediately call Campus Security. o Notify your immediate supervisor that you have received a bomb threat and have called security. Do not state the nature of the call to anyone else. o Complete the university’s Bomb Threat Checklist. Remain at your location until the security officer arrives. The officer will interview you regarding the call and review the checklist.

Evacuation: o Based on recommendations from Campus Security and/or HPD, the appropriate university designee will determine if an evacuation is necessary and coordinate the evacuation of threatened buildings.

Do not evacuate until told to do so by security, as evacuation routes may be unsafe. Follow security instructions. Move to the designated evacuation location stated in the evacuation plan. o Campus Security will not allow anyone to enter a suspected building except authorized personnel. The Campus Security Director will decide when re-entry is permitted. o Supervisors will account for all personnel and teachers will attempt to account for all students in class at the time of evacuation.

Admissions will prepare to contact all students known to have classes in the affected building, in case of emergency.

Search procedures: o Campus Security will be in charge of the search. The search will be conducted by Campus Security personnel only. o Under no circumstances should faculty, staff, or students touch or move a suspected bomb. Notify the security officer in charge of the search in your location of any suspicious objects.

Those found guilty of false or real bomb threats will be expelled from the university in accordance with current university bylaws and prosecuted under state and federal laws.

10–21 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

6.

After you restore files following an incident, users complain that some of their data files are missing. What might have happened?

Users did not save their files to the file server and they were lost in the incident.

Backup tapes do not include data since last backup, and their files may not have been backed up.

The backup may not have been done properly. Restoration tests should be done to see if there is a problem.

Hands-on Projects NOTE: Screenshots and IP addresses for individual students will vary.

PROJECT 1 HoneyBOT® is a simple honeypot for beginners to use. Honeypots can give you a good idea of how many people are probing your machine for weaknesses. Without a honeypot, you may not be able to tell if anyone is scanning your machine.

In this example, you will use your web browser to generate some entries in HoneyBOT. You will try to make FTP and HTTP connections with your own computer. The honeypot will record the IP address of the remote machine that is scanning your computer and each port that was scanned.

1. Download HoneyBOT from http://www.atomicsoftwaresolutions.com.

2. Download the Academic release.

3. Click Save.

4. Select your downloads folder.

5. Browse to your downloads folder.

6. Double-Click HoneyBOT_018.exe. (The version number may be different as newer releases become available.)

7. Click Run, Next, I Accept, Next, Next, and Next.

8. Check Create desktop icon.

9. Click Next, Install, and Finish.

10. Press the Start button or click File and Start.

11. HoneyBOT may ask you to select an adapter if you have multiple NICs (network interface cards) in your computer; select your current IP address. (It could be a non-routable IP that starts with "192.168" or it could be a typical IP address.)

12. Click OK. 13. Take a screenshot showing the total number of sockets loaded in the bottom status bar.

14. Click Start.

15. Open a web browser and go to FTP://[Your IP Address]. (Replace Your IP Address with the IP address that is being used by HoneyBOT. 16. When prompted for a username, enter your first name.

10–22 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

17. Enter your last name for the password. (Entering your first and last name as username and password will record them in the HoneyBOT log. You don't really have an FTP server running. It's being "faked" by HoneyBOT.) 18. Open a web browser and go to HTTP://[Your IP Address]. (Replace Your IP Address with the IP address that is being used by HoneyBOT.) 19. Return to HoneyBOT and take a screenshot.

20. Double-click on one of the entries with the local port listing 21. (The remote IP and local IP should be the same.)

21. Take a screenshot of the HoneyBOT log entry showing your first and last name being used to access an FTP server.

PROJECT 2

Project Thought Questions 1. What impact would more open ports have on the ability of your honeypot to attract hackers?

Having more ports open may attract certain hackers. Some hackers look for certain open ports. Some larger servers have many different services running, so hackers look for those machines with many open ports.

2. Can hackers tell that you have a honeypot running?

Yes, some hackers may be able to tell that you have a honeypot running based on certain responses given by your honeypot. Since extradition to another country is unlikely, they may not care too much. However, they might want to avoid spending too much time on your machine if they think your computer is just faking all ports.

3. Do they have honeypots for spammers to keep them from harvesting e-mails from your webpages?

Yes, there are honeypots for spammers. It’s against the law to “harvest” e-mails from any webpage. Security professionals are starting to use different e-mail notation to stop harvesting programs. Instead of posting their e-mail address as John.doe@company.com, they will post it as “john dot doe at company dot com” or a variation thereof.

4. Do you think law enforcement agencies (e.g., CIA, FBI, NSA, etc.) in the United States run honeypots to track criminal behavior?

Yes, they have many different honeypots and IDSs running. They watch criminal behavior very closely and know who is doing what. They watch certain blocks of IP addresses very closely. They even know who is producing viruses and malware. They have big budgets and pretty smart people. It’s a good idea to just stay away from government computers.

5. Would this work on your cell phone if it were connected to your computer?

Yes, this will recover data on any device that shows up as a drive. If your phone has this ability, then you can recover lost data/pictures. You can also purchase 10–23 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

hardware and software from Paraben that is specifically designed to recover data from mobile devices.

6. What effect does the “condition” of the file have on its ability to be recovered?

Some files have been written over and are only partially recoverable. Some files may have been written over many times and are not recoverable. You may have to take an image of that part of your hard drive and examine the files directly.

7. What other recovery options does Recuva come with?

This program comes with multilingual support. It will look at both logical and physical drives. It will look in hidden system drives and do a deep scan. It will also show you the information about the file and the detailed file contents.

8. Does Recuva have the ability to find a deleted file by its specific file name?

Yes, you can search by a specific file name.

Case Discussion Questions 1. Why are merchants usually responsible for merchandise purchased with stolen credit cards?

Merchants are usually responsible for dollar losses related to stolen credit cards as part of their contract with their credit card company. Making merchants liable for losses makes them very weary to accept stolen credit cards.

2. What is the most common way to detect corporate fraud? Why? Occupational fraud is more likely to be detected by a tip than by any other method. The majority of tips reporting fraud come from employees of the victim organization.

3. Which forms of fraud are the most common? Why? Asset misappropriation schemes are by far the most common type of occupational fraud, comprising 87% of the cases reported. They are also the least costly form of fraud, with a median loss of $120,000.

4. Which forms of fraud are the most costly? Why? Financial statement fraud schemes make up just 8% of the cases, but cause the greatest median loss at $1 million. Corruption schemes fall in the middle, occurring in just over one-third of reported cases and causing a median loss of $250,000. Financial statement fraud cases have the potential to inflict much larger damages due to the nature of the fraud.

5. Why does a perpetrator’s level of authority in the organization, or time working for the organization, affect the average amount of money stolen?

Perpetrators with higher levels of authority and longer tenure with the organization tend to cause much larger losses. They may have greater responsibility over larger assets, be better able to conceal their fraud, be more motivated to commit the fraud, be more knowledgeable about the corporation’s procedures (to avoid getting caught), and may be able to coerce/co-opt subordinates into the fraud scheme.

10–24 .

Chapter 10: Incident and Disaster Response Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

6. Why are banking and financial services, government and public administration, and manufacturing sectors the most commonly targeted?

These are industries that deal with large budgets, lucrative contracts, and large sums of liquid money. They provide very attractive targets for fraudsters.

7. Why are workers in accounting, operations, sales, executive/upper management, customer service, and purchasing functions most likely to commit fraud?

These workers have access to the systems, personnel, and paperwork to be able to commit the fraud. They also likely have a higher level of knowledge about how internal systems might be manipulated.

8. What are some “red flags” that a person might be involved in fraudulent activities?

Red flags discussed in the report include living beyond one’s means (36% of cases), financial difficulties (27%), unusually close association with vendors or customers (19%), and excessive control issues (18%).

Perspective Questions 1.

2.

What was the most surprising thing you learned in this chapter?

Student answers will differ.

What was the most difficult material in this chapter for you?

Student answers will differ.

10–25 .

.

Instructor’s Manual

Module A

Networking Concepts Overview The broad goal of this module is to review networking concepts. Because the review is designed to prepare the student to deal with networking concepts in the security context, there are many notes about the security implications of networking individual concepts. Therefore, it is suggested that this Module is reviewed before Chapter 3, which is the first chapter to deal with networking concepts.

Teaching Suggestions Special Issues If your students do not have networking as a prerequisite or co-requisite, this material may be challenging for them. However, without a decent knowledge of networking, it is impossible to master security today.

Even students who have had a networking course will probably find that they have forgotten much of what they learned, so even they will be challenged. And they may not have seen some topics introduced here, such as TCP sequence numbers and acknowledgement numbers, which are important in networking.

Teaching the Material Flow of Material ➢ The module starts with a sampling of networks to show the main elements of networks. ➢ Network protocols and vulnerabilities are covered next. This is a pure security topic.

.

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

➢ The next topic is core layers in layered standards architecture. This section divides network protocols into single-network protocols, Internet protocols, and application protocols. ➢ The next section introduces the OSI and TCP/IP standards architectures. It discusses the hybrid TCP/IP-OSI standards architecture that most real organizations use. ➢ The following section looks at physical and data link layer standards, including switch operation, transmission media, and switch supervisory standards. ➢ Next is a discussion of the standards used in Internetworking. This is followed by sections on the Internet Protocol (IP), TCP, UDP, and TCP/IP supervisory standards.

Although these are being listed in a single bullet point, they collectively make up the majority of the chapter. ➢ The final section covers application standards in general and looks specifically at HTTP, HTML, e-mail, Telnet, FTP, and SSH. It notes the security issues regarding this standard.

Covering the Material This is pretty much a lecture module.

Assigning Homework To focus students, you can assign specific Test Your Understanding questions, Hands-On Projects, Project Questions, and end-of-chapter questions they should master or even hand in as homework. You can also specify questions or parts of questions they do not have to master.

Multiple choice and true/false questions in the test bank are tied to specific parts of specific questions, so creating multiple guess questions on exams is relatively straightforward.

A-2 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Answer Key Module A

Networking Concepts Introduction 1.

a) What is an octet?

A collection of 8 bits b) What is a host?

Any device with an IP address c) Is a home PC connected to the Internet a host?

Yes d) Distinguish between the terms internet and Internet.

When the term is spelled with a lowercase “i,” it refers to any internet or the internet layer. When it is spelled with an uppercase “I,” it refers to the global Internet.

A Sampling of Networks A Simple Home Network 2.

a) What are the functions of an access router? Explain each function in one sentence.

It is a switch, a wireless access point (sometimes), a router to connect the firm to the Internet, a DHCP server, and a NAT provider. b) Describe the technology of 4-pair UTP wiring.

A UTP cord contains eight copper wires organized as four pairs. The two wires of each pair are twisted around each other several times an inch to reduce interference. c) What is an Internet access line?

A-3 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

A transmission line that connects a home or business to its Internet service provider d) What is a broadband modem?

A broadband modem transmits signals over a broadband access line. e) Why is wireless transmission dangerous?

Eavesdroppers can intercept wireless transmissions.

A Building LAN 3.

a) What is a local area network?

A local area network (LAN) is a network that operates on the customer’s premises. b) What is the customer premises?

The land and buildings owned by the corporations c) Distinguish between workgroup switches and core switches.

Workgroup switches connect users to the network. Core switches connect switches to other switches. d) Why is UTP dangerous?

It is easy to tap and generates signals that can be picked up even without tapping the UTP cord. e) Why is 802.1X needed?

Most switches today have 802.1X capability that requires any device connecting to a wall jack to authenticate itself before being allowed to transmit beyond the switch.

A Firm’s Wide Area Networks 4.

a) Distinguish between LANs and WANs. LANs operate within a company’s premises. WANs connect different premises. b) Why do companies use carriers for WAN transmission?

They lack the right of way to lay communication facilities between sites. c) What two WAN technologies are illustrated in the figure?

Point-to-point networks and public switched data networks (Frame Relay) d) Why is carrier WAN traffic generally considered safe?

Access to the network is limited, and internal routing is hidden.

The Internet 5.

a) Which organization created the Internet?

The Defense Advanced Research Projects Agency b) What is the function of a router?

A-4 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

To connect networks together c) Distinguish between frames and packets.

Frames are messages sent through LANs or WANs. Packets are messages sent through an internet. Packets are carried within frames. d) If two hosts are separated by five networks, how many packets will there be along the way when a host transmits a packet to another host?

One e) If two hosts are separated by five networks, how many frames will there be along the way when a host transmits a packet to another host?

Five f) Why was intranet security initially light?

It was believed that attackers would have a difficult time getting into an intranet.

This belief has since been called into question.

Applications 6.

a) What type of applications usually generates the most traffic in an organization?

Business-specific applications b) Why is managing application security time-consuming?

There are many applications to protect.

Network Protocols and Vulnerabilities Inherent Security Security Explicitly Designed into the Standard Security in Older Versions of the Standard Defective Implementation 7.

List the four security problems with protocols. Write one sentence describing each.

Some protocol designs are inherently insecure.

Others have had security added but have done so in an awkward way that causes problems.

Security in older versions may still be causing problems.

Defective implementation of a standard can lead to unsecure products based on secure protocols.

A-5 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Core Layers in Layered Standards Architectures 8.

a) What are the three core standards layers?

Single network Internet Application b) Distinguish between the single-network core layer and the internet core layer.

The single-network core layer is responsible for delivering frames within LANs or WANs. The internet core layer is responsible for delivering packets from source host to destination host across an internet. c) At what core layer do you find LAN standards?

Single network d) At what core layer do you find WAN standards?

Single network e) At what core layer do you find standards for the global Internet?

Internet

Standards Architectures 9.

What is a standards architecture?

A standards architecture is a broad layering plan that specifies layers. Later, standards are created for individual layers.

The TCP/IP Standards Architecture 10.

a) Which organization creates Internet standards?

The Internet Engineering Task Force b) What is the name of its standards architecture?

TCP/IP c) What is an RFC? RFC stands for Request for Comments. It is a document with a proposed standard and other information. d) How can you tell which RFCs are Internet Official Protocol Standards?

Periodically, the IETF issues an RFC listing Internet Official Protocol Standards.

The OSI Standards Architecture 11.

a) What two standards agencies govern OSI? (Just give their acronyms.)

A-6 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

ISO and ITU-T b) Distinguish between OSI and ISO. OSI is the architecture.

ISO is one of the two standards agencies responsible for OSI. c) How many layers does the OSI architecture have?

7 d) Which of these layers are similar to the layers in TCP/IP? Physical, data link, internet, and transport e) Compare the TCP/IP application layer with comparable OSI layers.

TCP/IP has a single application layer.

OSI has three standards layers: session, presentation, and application.

The Hybrid TCP/IP-OSI Architecture 12.

a) What architecture do most firms actually use?

The hybrid TCP/IP-OSI architecture b) In the hybrid TCP/IP-OSI architecture, which layers come from OSI? Physical and data link d) From what standards architecture do application layer standards come?

Both OSI and TCP/IP standards are used, often in combination.

Single-Network Standards 13.

What two layers define LAN and WAN standards?

Physical and data link

The Data Link Layer 14.

What is a data link?

The path a frame takes across a single network, from the source host to the destination host, across multiple switches.

The Physical Layer 15.

a) Distinguish between physical links and data links.

Physical links connect adjacent devices.

Data links are paths between the source host and destination host, usually across multiple physical links. b) What advantage of optical fiber over UTP was listed in the text?

A-7 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

UTP cords act like radio antennas when they carry signals, allowing people to intercept UTP signals by placing devices near (but not touching) the cord. Optical fiber requires physically tapping into the fiber cords. c) Why is spread-spectrum transmission used in wireless LANs? To reduce transmission problems d) Why are switch supervisory frames needed?

They are needed to allow the network to run efficiently. e) Why does optical fiber have better inherent security than UTP? Optical fiber signals cannot be read without physically tapping the fiber cord.

UTP signals can be read without tapping the cord. f) What dangers does radio transmission create?

Radio signals can be intercepted easily. g) Does spread-spectrum transmission in commercial wireless LANs provide security?

No h) Why is the 802.1AE standard necessary?

The 802.1AE LAN security standard is designed to limit switch-to-switch communication to authenticated switches, thus preventing attacks based on impersonating switches

Internetworking Standards 16.

a) Why was IP made to be a very simple standard?

The standards developers could not assume much functionality in the individual networks through which IP packets would travel. b) Why was complexity needed in the TCP standard?

To add error correction and other desirable features that IP did not offer

A-8 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

The Internet Protocol (IP) The IP Version 4 Packet The First Row The Second Row The Third Row Options 17.

a) If the header length field’s value is 6 and the total length field’s value is 50, how long is the data field? Show your work.

Header is 6 x 4 = 24 octets Total length = 50 octets Data field is 50 – 24 = 26 octets b) What is the general function of the second row in the IPv4 header?

To handle fragmentation and reassembly c) Why is a TTL field needed?

So that misaddressed packets will not circulate endlessly d) If a router receives a packet with a TTL value of 1, what will it do?

It decreases the TTL value to 0 and then drops the packet. e) What does the protocol field in the IP header tell the destination host?

What is in the data field f) How is the header checksum field used?

To determine if there is a header error, which might cause routing problems If an error is found, the router or destination host drops the packet. g) Are IPv4 options used frequently?

No h) Why is fragmentation a threat indication?

Hackers use it so firewalls cannot see entire packets. i) How can attackers use the TTL field to map a network?

The attacker keeps sending packets to an IP destination address.

In each successive packet, the TTL field is increased by one.

The router that sets the TTL value to zero and drops the packet sends the attacker an ICMP message that contains the router’s IP address.

Each packet reveals one more router along the route to the destination host.

A-9 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Doing this with different destination hosts will map a good deal of the network.

The Source and Destination IP Addresses Masks IP Version 6 18.

a) How long are traditional IP addresses?

32 bits long b) What are the three parts of an IP address?

Network part, subnet part, and host part c) Why are masks needed?

To identify the size of the network part or network and subnet parts d) What is the main advantage of IPv6?

It will support many more possible IP addresses.

IPsec 19.

a) In what sense is IPsec a general protection strategy for all internet, transport, and application protocols?

It provides transparent protection to everything in the packet’s data field. This definitely includes the transport and application protocols. It may include the entire IP packet. b) Does IPsec work with IPv4, IPv6, or both?

Both c) Compare IPsec transport mode and tunnel mode.

In transport mode, there is protection all the way from the source host to the destination host. In tunnel mode, there is only protection between sites and none within sites. Transport mode gives stronger protection but is much more expensive to implement. In addition, firewalls cannot easily filter transport mode traffic, which is unreadable unless the firewall has the decryption key for the communication.

The Transmission Control Protocol (TCP) 20.

a) How many TCP/IP transport layer protocols are there?

Two (TCP and UDP) b) What is a TCP message called?

A-10 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

TCP segments

TCP: A Connection-Oriented and Reliable Protocol 21.

a) Describe a TCP session opening.

One side sends a TCP SYN segment to indicate that it wishes to open a connection. The other side sends back a TCP SYN/ACK segment to indicate its willingness. The original side then sends an ACK to acknowledge the receipt of the SYN/ACK. b) Describe a normal TCP closing.

One side sends and TCP FIN segment while the other side sends an ACK. The other side may continue to send content segments. The original side will continue to respond to ACKs. Later, the other side sends a TCP FIN segment while the original side sends a TCP ACK. c) Describe an abrupt TCP closing.

One side sends a TCP RST segment. There is no acknowledgement or any other further communication. d) Describe how reliability is implemented in TCP. If a TCP process on the destination host correctly receives a TCP segment, it sends an acknowledgement to the sender. If the original sender does not receive an ACK promptly, it retransmits the segment. e) Describe a TCP half-open DoS attack.

The attacker sends a SYN segment. The victim sends a SYN/ACK and sets aside resources for the connection. The attacker never sends the final ACK. The victim continues to reserve the resources for the connection and the attacker continues to send SYNs to tie up more resources. f) What information does a RST segment give an attacker?

The RST segment is carried within an IP packet. Therefore, the attacker learns the IP address of the host sending the RST.

Flag Fields 22.

a) What is a flag field?

A one-bit field b) What does it mean to say that a flag field is set?

Its value is equal to one.

Sequence Number Field 23.

a) A TCP segment carries octets 23,802 through 23,875. What is its sequence number?

23,802 b) The next segment is a FIN segment that carries no data. What is its sequence number?

A-11 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

23,803 c) What does an attacker have to predict to be able to do TCP session hijacking?

The sequence number of the next TCP segment to be sent

Acknowledgment Number Field 24.

A TCP segment carries octets 23,802 through 23,875. What will be the acknowledgement number in the TCP segment that acknowledges this segment?

23,876

Window Field Options 25.

a) What is the purpose of the TCP window field?

To limit the transmission rate of the other host in the connection b) How does the window field automatically control congestion?

The window size begins small in order to avoid congestion.

If a segment is lost (probably due to congestion), the window size is again set to a small value. c) Does TCP use options frequently?

Yes

Port Numbers 26.

a) A packet has the source socket 1.2.3.4:47 and the destination socket 10.18.45.123:4400. Is the source host a client or a server? Explain.

The source port number is 47. This is a well-known port number. Therefore, the source host is a server. b) Is the destination host a client or a server? Explain.

The destination port number is 4400. This is an ephemeral port number, so the destination host is a client. c) A server sends a packet with the source socket 60.32.1.79:25. What kind of server is it? Explain.

It uses the well-known port number, which indicates that it is a mail server. d) What is socket spoofing?

Sending a packet with a false IP address and port number

TCP Security 27.

a) Does TCP have comprehensive security comparable with IPsec for IP?

A-12 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

No b) Why is a lack of an automatic key exchange a problem for TCP electronic signatures?

There is none.

The User Datagram Protocol 28.

a) What is the attraction of UDP? It places a small load on the hosts and the network. b) What kinds of applications specify the use of UDP at the transport layer?

Those that do not need reliability and those that cannot wait for retransmissions of lost or damaged messages. c) Why is UDP more dangerous than TCP? TCP’s sequence numbers make TCP session hijacking very difficult. UDP lacks this protection.

TCP/IP Supervisory Standards Internet Control Message Protocol 29.

a) What is the TCP/IP internet layer supervisory protocol?

The Internet Control Message Protocol (ICMP) b) Describe ping.

One side sends an ICMP Echo message. The other side sends back an ICMP Echo reply message. c) Describe ICMP error messages.

When a router or destination host must drop a packet, it sends back an ICMP error message. d) What information does ping give an attacker?

The fact that there is a host at a given IP address e) What information does tracert give an attacker?

The route a packet takes to a destination host f) What information does an ICMP error message give an attacker?

The IP address of the host sending the error message

A-13 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

The Domain Name System Dynamic Host Configuration Protocol 30.

31.

a) Why would a host contact a DNS server?

To learn the IP address of a host to which it wants to send packets b) If a local DNS server does not know the IP address for a host name, what will it do?

It will contact one or more other DNS servers. c) What kind of organization must maintain one or more DNS servers?

An organization with a second-level domain name d) What is DNS cache poisoning?

An attacker replaces the IP address of a host name with another IP address. e) Describe the status of DNSSEC. It is under development. f) Why are root servers attacked?

If most or all root servers were taken down, the effectiveness of the DNS system would begin to degrade. a) What kind of IP addresses do servers get?

Static IP addresses b) Why are DHCP servers used?

To give IP addresses to clients c) Will a PC get the same dynamic IP address each time it uses the Internet?

Not necessarily d) Both DHCP servers and DNS servers give IP addresses. How do these IP addresses differ?

DHCP servers give a host an IP address for the host to use.

DNS servers give a host the IP address of a host to which the original host wishes to send packets.

Dynamic Routing Protocols Simple Network Management Protocol 32.

a) Why are dynamic routing protocols needed?

So that routers can get information for their routing tables b) What is the main TCP/IP interior dynamic routing protocol for large networks?

OSPF A-14 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

c) What is the main TCP/IP exterior dynamic routing protocol?

BGP d) Why is Cisco’s EIGRP attractive?

It is not limited to TCP/IP routing. e) Is a company free to select its interior dynamic routing protocol, exterior dynamic routing protocol, or both?

Only its internal dynamic routing protocol f) How could an attacker use dynamic routing protocols to attack a network?

It could send false routing information to the network’s routers.

Application Standards 33.

34.

a) What is the purpose of SNMP? To get configuration information from managed devices on the network and to change the configuration of managed devices b) Distinguish between the SNMP GET and SET commands.

GET asks for configuration information.

SET tells the managed device to change its configuration. c) Why do many organizations disable the SET command?

SET is dangerous in terms of what it allows an attacker using SET to do. a) Why are there usually two protocols for each application?

Application protocols need a protocol for message delivery and a protocol for message format. b) In e-mail, distinguish between SMTP and POP. SMTP is used to send messages.

POP is used to download mail from a mail server. c) Why are Telnet and FTP dangerous?

They have no security, sending passwords in the clear. d) What secure protocol can be used instead of Telnet and FTP? SSH (Secure Shell) e) What is the security standards situation in e-mail?

There is no consensus on e-mail security standards, so the standards are not widely used.

A-15 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

Conclusion Hands-on Projects NOTE: Screenshots and IP addresses for individual students will vary.

PROJECT 1 One of the most well-known packet sniffers is Wireshark® (formerly named Ethereal®). This is a flexible and powerful tool. Any network administrator worth his or her salt will know how to run Wireshark. Most professionals use it often. Wireshark has been getting better and better with every release. It will likely be around for a long time as the industry standard.

You will install Wireshark and do a few examples to give you a small taste of what Wireshark can do. In addition to loading Wireshark you will also have to load WinPCap® in order to actually capture the packets being sent over your network.

1.

2.

3.

4.

5.

6.

Download Wireshark from http://www.wireshark.org/download.html.

Click Download Windows Installer. (Download the latest stable release.)

Click Save.

Save the file in your download folder.

If the program doesn’t automatically open, browse to your downloads folder.

Double-click Wireshark-setup-3.0.3.exe. (The software version numbers will be slightly different as newer versions are released.)

7. Install Wireshark and WinPCap. 8. Double-click the Wireshark icon on your desktop.

9. Click Interface List. (This will display a list of all available network interfaces on your computer. You will want to note the description and IP address of the interface with the most traffic. You will need to select this interface in the following steps.)

10. Note the interface with the most traffic. (You will select this interface in the following steps.)

11. Close the Capture Interfaces window.

12. Click Capture, and Options.

13. Select your Network Interface Card if it is not already selected.

14. Close all other programs you currently have open except your word processing program .

15. Click Start.

16. Let it run for 10 seconds.

17. While you are waiting, open a web browser and go to www.google.com.

A-16 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

18. Return to your Wireshark window.

19. In the file menu, click Capture and Stop.

20. Scroll up until you see a green and blue area. (These are the packets you captured when you requested Google’s main page.)

21. Take a screenshot.

22. Scroll down until you see a line that has GET / HTTP/1.1. (You may have to try more than one until you get to the packet that shows “www.google.com” in the bottom pane.)

23. Select that row.

24. In the bottom pane, you will see a bunch of numbers to the left. (It’s the packet’s contents in hexadecimal.) Just to the right, you will see the content of the packet in a column.

25. Select the text: www.google.com.

26. Take a screenshot.

Note: You just picked packets off your network and looked at their contents. There may have been a lot of traffic that you couldn’t interpret. Don’t worry about the information on your screen that is difficult to understand. In the next project, you will use a filter to capture only web traffic going over port 80.

PROJECT 2 In this project, you are going to filter out all the “extra” packets you captured and just look at web traffic. Too often, you will capture much more information than you will ever want or need.

Being able to filter out the traffic you don’t want is an important skill.

Wireshark can filter packets by IP address or by port number. A thorough understanding of TCP/IP will greatly aid your understanding of how packet filtering works. There are several great online tutorials available that will teach you the basics of TCP/IP. Below are instructions on how to filter out all packets except web traffic by creating a filter for just Port 80. This will capture all the web traffic going to all the computers on your local network. Reread the last sentence. Yes, you read that correctly, it may even capture web traffic intended for other computers on your network. This is one of the reasons why packet sniffers are important to learn.

1. With Wireshark open, click Capture and Options.

2. If you haven’t already done so, select your network interface card (NIC) 3. Double-click the interface you have selected. (This will allow you to enter a capture filter.)

4. Click Capture Filter.

5. Type “YourName_TCP_port_80” for the filter name. (Replace YourName with your first and last name. In this case, the filter name was RandyBoyle_TCP_port_80.)

6. Type “tcp port 80” in the filter string text box next.

7. Take a screenshot.

8. Click OK. A-17 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

9. Close all other programs you currently have open except your word processing program.

10. Click OK. (You should see the capture filter set.)

11. Click Start.

12. Click “Continue without Saving” when prompted.

13. Open a web browser and go to www.microsoft.com.

14. Return to your Wireshark window.

15. Click Capture and Stop.

16. Scroll down until you see a line that has GET / HTTP/1.1. (You may have to try more than one until you get to the www.microsoft.com packet.)

17. Select that row.

18. In the bottom pane, you will see a bunch of numbers to the left. (It’s the contents of the packet in hexadecimal. Just to the right, you will see the contents of the packet in a column.)

19. Select the text www.microsoft.com.

20. Take a screenshot.

Project Thought Questions 1.

2.

3.

4.

5.

6.

What do the different colors mean in the Wireshark log?

Different color codes help the end user quickly identify specific types of packets.

Color coding helps reduce the time it takes to sift through packets.

Why does your computer get packets that are addressed to another machine?

Your NIC can pick up all packets sent to it if it is in promiscuous mode.

How many packets does your computer send/receive in a single mouse click when you visit a website?

You can get 1,000 or more packets with a single mouse click, depending on the website.

Could you organize or filter the traffic to make it easier to understand?

Yes, filters make understanding the types and quantities of traffic going over your network much easier.

Why does your computer send so many packets? Why not send just one really big packet?

It sends many smaller packets for a variety of reasons. Some of the packets are sent/received as part of the TCP/IP connection. Other packets are HTML content, pictures, or fragments of larger files. Some networks fragment packets, which would produce even more packets.

What do SYN, ACK, FIN, and GET mean?

These are all packets used in the TCP/IP connection. They stand for synchronize (SYN), acknowledgement (ACK), final (FIN), and get (GET).

A-18 .

Module A: Networking Concepts Corporate Computer Security, 5th Edition Randall J. Boyle and Raymond R. Panko

7.

8.

Can you capture all of the packets for an entire network?

Yes, as long as the packets are on your local network, you can capture all packets in promiscuous mode.

Can Wireshark automatically resolve the IP address into host names?

Yes, there is an option to automatically resolve all IP addresses on captured packets to hostnames. This option is on the configuration screen.

Perspective Questions 1.

2.

What was the most surprising thing for you in this chapter?

Student answers will differ.

What was the most difficult thing for you in this chapter?

Student answers will differ.

A-19 .