chapter 22  modules the big picture

... how they can protect your information Let them know how important they are in the process, and let them know the consequences of failing to enforce your policies Give them the tools and the processes ... needs to be the smart one He then distributes the tools used in the attack around the Internet where it is picked up by young hacker wanna-bes The wanna-bes use the tools to commit the crime without ... knowing how it works because they don’t have to Rather than the criminal rising to the skill set needed for the crime, the skill set for the crime has now lowered itself to the criminal Dumpster diving...

Ngày tải lên: 18/10/2013, 18:15

... of the cans, the sound can be heard through the other can The can you talk into is the transmitter, the can you listen from is the receiver, and the string is the medium How does it work? The ... they would contact the operator at the central office and tell them the name of the person they wanted to talk to The operator would then connect the caller’s plug to the plug of the person being ... a receiver The transmitter is the device that creates the communication The medium is the device that carries the communication from the source to the destination The receiver is the device that...

Ngày tải lên: 22/10/2013, 16:15

... to it, then sends it to the next layer down the stack Once the packet reaches the bottom of the stack, it travels along the network wire to the remote host, then travels up the stack on the remote ... floor The third floor prepares the various courses by making the soup, tossing the salad, cooking the beef, and baking the pie Once all this is done they hand the food off to the fourth floor The ... gives the “Hello There” to the Application Layer of the protocol stack The Application Layer creates an empty packet and places the “Hello There” inside of it The Application Layer then sends the...

Ngày tải lên: 22/10/2013, 16:15

... REVISING: THE BIG PICTURE Support That’s Directly Related to the Thesis As important as the amount of support is its relevance to the thesis What good are ten supporting paragraphs if they’re ... to the assignment 108 – REVISING: THE BIG PICTURE Rewording Your Thesis If your thesis isn’t clear, or is not easily identifiable, you probably have one of these common problems: ■ ■ ■ No thesis ... REVISING: THE BIG PICTURE If you think professional writers work alone, think again They know how important it is to get feedback before they send their work to the publisher—it’s not uncommon for them...

Ngày tải lên: 25/10/2013, 17:20

... to all the other hosts on that network, which then act as the agents for the attack Being good little agents, they want to reply to the request However the only information they have is the spoofed ... it who the real Victim is, how long the attack should last, and any other information the Agents will need The Handler then relays that information to the Agents and off they go What the Victim ... of the DMZ is a firewall that protects the DMZ from the Internet On the other side of the DMZ is a firewall that protects the internal network from the DMZ (Editor’s note: in some cases, the...

Ngày tải lên: 26/10/2013, 23:15

... ran them, they interacted with a server somewhere on the network, they did the work on the server, you got the results, and you were done Then with the advent of the web, we started seeing the ... up, they don’t know who the publisher is, and no reason to think the control has any malicious intent They just know they want to see the dancing pigs! And they want to see them so much that they ... Generally, the strongest algorithm that the two programs support will be selected The client and the server will then exchange encryption keys These are the codes that will enable the two to...

Ngày tải lên: 26/10/2013, 23:15

... Is there a business case for intrusion detection? Intrusion Detection - The Big Picture - SANS GIAC © 2000 26 One of the threads we want to stay aware of during the course is whether or not the ... • There has to be a balance between the cost of improving protection and the value of what you are defending Intrusion Detection - The Big Picture - SANS GIAC © 2000 34 The threats are real The ... Intrusion Detection - The Big Picture - SANS GIAC © 2000 15 Having guessed the next sequence number, and assuming A has sent the SYN/ACK back to B, the attacker completes the connection establishment...

Ngày tải lên: 04/11/2013, 12:15

... challenge When the response comes back from the user, the server will compare the user’s response to the one it generated and is expecting If the two match, the user is authenticated and the processing ... As they are discovered, the anti-virus vendors develop methods for detecting and removing them They then put these new methods into updates to their software and distribute them to users of their ... prove the user belongs in the club No matter what form the authentication takes, they all serve to prove the identity of the person Once you know who someone is, and you have reasonably proven they...

Ngày tải lên: 04/11/2013, 12:15

... Intrusion Detection - The Big Picture - SANS GIAC © 2000 22 22 Deception Can Drive the Picture S S CIRT Meta CIRT S S CIRT S Intrusion Detection - The Big Picture - SANS GIAC © 2000 23 The point of this ... - The Big Picture - SANS GIAC © 2000 15 You can get the full system as a time-limited evaluation version, and then simply upgrade the licence key to get the commercial version RealSecure’s biggest ... at the top Then summary information about the packet The trace begins with the content of the detect RPC attacks like this are part of the Top Ten list (www.sans.org/topten.htm) Notice all the...

Ngày tải lên: 09/12/2013, 17:15

... ran them, they interacted with a server somewhere on the network, they did the work on the server, you got the results, and you were done Then with the advent of the web, we started seeing the ... up, they don’t know who the publisher is, and no reason to think the control has any malicious intent They just know they want to see the dancing pigs! And they want to see them so much that they ... Generally, the strongest algorithm that the two programs support will be selected The client and the server will then exchange encryption keys These are the codes that will enable the two to...

Ngày tải lên: 09/12/2013, 17:15

... to all the other hosts on that network, which then act as the agents for the attack Being good little agents, they want to reply to the request However the only information they have is the spoofed ... it who the real Victim is, how long the attack should last, and any other information the Agents will need The Handler then relays that information to the Agents and off they go What the Victim ... of the DMZ is a firewall that protects the DMZ from the Internet On the other side of the DMZ is a firewall that protects the internal network from the DMZ (Editor’s note: in some cases, the...

Ngày tải lên: 10/12/2013, 14:16

... ran them, they interacted with a server somewhere on the network, they did the work on the server, you got the results, and you were done Then with the advent of the web, we started seeing the ... up, they don’t know who the publisher is, and no reason to think the control has any malicious intent They just know they want to see the dancing pigs! And they want to see them so much that they ... Generally, the strongest algorithm that the two programs support will be selected The client and the server will then exchange encryption keys These are the codes that will enable the two to...

Ngày tải lên: 10/12/2013, 14:16

... challenge When the response comes back from the user, the server will compare the user’s response to the one it generated and is expecting If the two match, the user is authenticated and the processing ... As they are discovered, the anti-virus vendors develop methods for detecting and removing them They then put these new methods into updates to their software and distribute them to users of their ... prove the user belongs in the club No matter what form the authentication takes, they all serve to prove the identity of the person Once you know who someone is, and you have reasonably proven they...

Ngày tải lên: 10/12/2013, 14:16

... Detection - The Big Picture – SANS GIAC ©2000 11 The telnetd and the web demon are “real” They are compiled C code They simply simulate the services This could be important, since they might be ... attack other systems Of course, smap is not sendmail and just changing the banner from “smap” to “sendmail” will not fool the wise attacker The higher the fidelity of the honeypot, the greater the ... traffic In the slide above, the packet is addressed to TCP port 143, the IMAP service If the site does not allow IMAP through the firewall, then there will never be a SYN/ACK response, the TCP three...

Ngày tải lên: 10/12/2013, 14:16

... when you are in the office by the phone • Fix the red “priority” problems first Intrusion Detection - The Big Picture – SANS GIAC ©2000, 2001 15 There is no point in configuring the scanner to ... on the motherboard The idea was to speed up equipment inventory You walk down the hall transmitting a code and the PCs respond by transmitting their serial number back There was a bug in the ... allow them to make the decision on what to next This is known as “person in the loop” Let’s go back to the fundamental concept, you will respond The question is whether you will respond well If the...

Ngày tải lên: 10/12/2013, 14:16

... on the slide How you answer? Does this mean the manager doesn’t understand? There are a couple things to consider We have been talking about the big picture Management wants to know the big picture ... There is more than just the initial outlay for the hardware and software There is maintenance, training, and the employees’ time Management knows the purchase is just the tip of the iceberg Their ... practices) The Three Risk Choices • Accept the risk as is • Mitigate or reduce the risk • Transfer the risk (insurance model) Intrusion Detection - The Big Picture – SANS GIAC ©2000, 2001 Whether or...

Ngày tải lên: 10/12/2013, 14:16

... firewalls themselves, which are an amazingly effective perimeter, contribute to the problem The people protected by the firewall think everything is OK since the firewall stops the attacks and then they ... displayed at the top Then summary information about the packet is given The trace begins with the content of the detect RPC (Remote Procedure Call) attacks like this are part of the Top Ten list ... incidents.org, while they have their own customers that submit raw data, they correlate this with data from other CIRTs One or two attackers determined to confuse the picture could spoof the source addresses...

Ngày tải lên: 10/12/2013, 14:16

... attack other systems Of course, smap is not sendmail and just changing the banner from “smap” to “sendmail” will not fool the wise attacker The higher the fidelity of the honeypot, the greater the ... traffic In the slide above, the packet is addressed to TCP port 143, the IMAP service If the site does not allow IMAP through the firewall, then there will never be a SYN/ACK response, the TCP three-way ... open, or the SYN flag is set The system responds with “login” If the answer is either guest or root, the system moves to State In State it offers “Password” and if the password matches the list...

Ngày tải lên: 10/12/2013, 14:16

... compromise be? Well, once they compromise the box they have the ability to manipulate the addresses associated with the names of the network entities (such as computers) at your site These names and addresses ... consider the cost and the benefits before embarking on this journey You have spent the day learning about the big picture The real question is, can you explain it to your management? Can you show them ... than the initial purchase cost There is the labor cost of monitoring the devices There is a life-cycle cost Benefits are the reduction in risk Keep in mind the most important benefits to the organization...

Ngày tải lên: 10/12/2013, 14:16

... challenge When the response comes back from the user, the server will compare the user’s response to the one it generated and is expecting If the two match, the user is authenticated and the processing ... As they are discovered, the anti-virus vendors develop methods for detecting and removing them They then put these new methods into updates to their software and distribute them to users of their ... prove the user belongs in the club No matter what form the authentication takes, they all serve to prove the identity of the person Once you know who someone is, and you have reasonably proven they...

Ngày tải lên: 10/12/2013, 15:15