let apos s look at the big picture

Ngày tải lên: 31/10/2014, 14:26

Ngày tải lên: 25/08/2016, 12:17

... • Insiders Information Security: The Big Picture - SANS GIAC © 2000 When looking at the possible sources that threaten your organization s systems, you have to look at several types The first ... people, the system is of no use The system must run according to specifications This means that the system must have a formal specification of its operation and can not deviate from that specification ... consequences The first is loss of company assets This the most obvious, as it deals with real, definable losses – damage to computers, loss of data, service disruptions on your network, etc When most...

Ngày tải lên: 18/10/2013, 18:15

... checked against a list of the users that are allowed to access that object If the user is on the list, they pass If the user is not on the list, their access is denied User based security works well ... computer security, these standards are mandatory A side effect of these has been that private industry has picked up on them as well One of the first standard attempts was the Trusted Computer System ... Please note that the information I have on these organizations was taken mostly from the web sites of the various organizations themselves The Computer Security Institute (CSI) is a membership...

Ngày tải lên: 22/10/2013, 16:15

... table and finds the IP address that has been assigned to that system It then sends that address to the system, who then uses it as long as the system is turned on If the IP address needs to be changed, ... addresses These are the addresses it shows to the outside world It then assigns private addresses to all of its internal machines Unlike official, routable, addresses that must be unique across the ... address in the pool and gives that back to the requesting system Once the system receives the address, it also gets a license for that address That license can last from several minutes or hours...

Ngày tải lên: 22/10/2013, 16:15

... Rich s claim about silent deceptions It clearly states the thesis in the last two sentences It also sets the tone by using words like deceives and devastating, which will be repeated in the essay ... – REVISING: THE BIG PICTURE Support That s Directly Related to the Thesis As important as the amount of support is its relevance to the thesis What good are ten supporting paragraphs if they’re ... have sufficiently narrowed your thesis during the planning stage Recall in Lesson the discussion concerning the need to have a thesis that correlates with the space confines of an essay It must be...

Ngày tải lên: 25/10/2013, 17:20

... compromised and attackers will break into your DMZ systems The inside firewall limits the systems that the DMZ machines can access So, if the DMZ systems are successfully attacked, the attackers will ... attacker spoofs the information in the echo request Instead of using the attacker s machine as the source machine, the attacker uses the address of the target machine as the source address It also uses ... able to see or use any of the information in the transmission 20 Session Replay • Record transmissions as they occur • Start another session with host • Send old packets during new session • Acting...

Ngày tải lên: 26/10/2013, 23:15

... wants to send a message to Bob she selects a key to encrypt the information She then sends the message to Bob Bob then uses the same key to decrypt the message It s clean, and it s simple Because ... in class can’t read the passed note, the opposing baseball team can’t read the coach s hand signals, and the secretary s boss can’t read the shorthand notes unless they first learn the codes being ... internal database systems on the Internet presents some serious security concerns You need to take special care with these systems to make sure they are as protected as possible, have as tightly controlled...

Ngày tải lên: 26/10/2013, 23:15

... attacks on their networks Let s look at some business reasons for intrusion detection 29 Value/Acceptable Loss Threats Countermeasures Intrusion Detection - The Big Picture - SANS GIAC © 2000 30 There ... changed since late 1994 These attacks still work on many systems and so are still common attacks today 11 Two Systems, Trust Relationship A A trusts B A is talking to B B Intrusion Detection - The Big ... often set up these sort of relationships, usually as a convenience In this particular example, the systems are Unix and the trust relationship is the use of “r” utilities But similar trust relationships...

Ngày tải lên: 04/11/2013, 12:15

... your ID and password for one system, the SSO system If he can break into that, he automatically has access to all the other systems you have access to So, the debate goes, SSO systems theoretically ... is presented with user name and password prompts The user enters this information and it is sent to the TACACS server The TACACS server authenticates the user and sends back a pass or fail response ... algorithm was used to sign the certificate there is no way of verifying the signature A certificate also contains validation dates These are the dates that the certificate was issued and the date it...

Ngày tải lên: 04/11/2013, 12:15

... timestamp, the attack, and the source address) as their primary information source, not raw data Many IDSes create realistic false positives (and the analyst does not have access to raw data ... questions The greatest number of threats is via internet attacks A huge percent of these fall to firewalls, even the successful ones, while numerous, not cause as much harm as an insider that ... on the inside, simply feed it the TCPdump Shadow files We’d like to see more vendors take measures to make their sensors attack-resistant, or stealthy, and make them less valuable targets The sensor...

Ngày tải lên: 09/12/2013, 17:15

... wants to send a message to Bob she selects a key to encrypt the information She then sends the message to Bob Bob then uses the same key to decrypt the message It s clean, and it s simple Because ... in class can’t read the passed note, the opposing baseball team can’t read the coach s hand signals, and the secretary s boss can’t read the shorthand notes unless they first learn the codes being ... internal database systems on the Internet presents some serious security concerns You need to take special care with these systems to make sure they are as protected as possible, have as tightly controlled...

Ngày tải lên: 09/12/2013, 17:15

... compromised and attackers will break into your DMZ systems The inside firewall limits the systems that the DMZ machines can access So, if the DMZ systems are successfully attacked, the attackers will ... attacker spoofs the information in the echo request Instead of using the attacker s machine as the source machine, the attacker uses the address of the target machine as the source address It also uses ... able to see or use any of the information in the transmission 20 Session Replay • Record transmissions as they occur • Start another session with host • Send old packets during new session • Acting...

Ngày tải lên: 10/12/2013, 14:16

... wants to send a message to Bob she selects a key to encrypt the information She then sends the message to Bob Bob then uses the same key to decrypt the message It s clean, and it s simple Because ... in class can’t read the passed note, the opposing baseball team can’t read the coach s hand signals, and the secretary s boss can’t read the shorthand notes unless they first learn the codes being ... internal database systems on the Internet presents some serious security concerns You need to take special care with these systems to make sure they are as protected as possible, have as tightly controlled...

Ngày tải lên: 10/12/2013, 14:16

... your ID and password for one system, the SSO system If he can break into that, he automatically has access to all the other systems you have access to So, the debate goes, SSO systems theoretically ... is presented with user name and password prompts The user enters this information and it is sent to the TACACS server The TACACS server authenticates the user and sends back a pass or fail response ... algorithm was used to sign the certificate there is no way of verifying the signature A certificate also contains validation dates These are the dates that the certificate was issued and the date it...

Ngày tải lên: 10/12/2013, 14:16

... address families from RFC 1918 and assign those addresses to the systems The firewall keeps track of all the connections and translates from the single address to the private addresses 29 NAT in ... listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl S0 S0 S0 S0 S0 S0 S0 S0 S0 S0 Init PASS^M USER taldric^M PASS taldric^M USER taldric^M PASS ... system moves to State In State it offers “Password” and if the password matches the list with root or guest spelled backwards, the system “logs them in” and gives them a prompt We move to State Here...

Ngày tải lên: 10/12/2013, 14:16

... tools, like nmap and Nessus Another breakdown is system scanner tools that run as a program to inspect the operating system configuration, and network scanner tools that work across the network There ... a significant issue The most serious case of this to date is the Milloworm attackers that broke in and posted nuclear design information from Indian and possibly Pakistani resources 33 Information ... the advanced attacks will probably require a dress rehearsal One attack that proved to be somewhat damaging to the United States is called Solar Sunrise In this case, the attackers could be seen...

Ngày tải lên: 10/12/2013, 14:16

... up to speed fast 23 Risk Assessment • Theory of risk assessment - short version • Knowledge-Based (qualitative) application of risk assessment (Windows NT example) • Business case for intrusion ... comptroller s office The sticky issue is how to calculate the value of locally developed software and the data on the systems A simple metric is the amount of seat time that was used to create the software ... deploy intrusion detection and response assets To manage risk, one must be able to assess it In this section of the course we will cover the basic theory of risk assessment We will also talk about...

Ngày tải lên: 10/12/2013, 14:16

... like to see more vendors take measures to make their sensors attack-resistant, or stealthy, and make them less valuable targets The sensor is the attacker s first target - 10 Network Intrusion Detection ... information it has The Shadow sensor is designed to be stupid It lives outside the firewall If it should fail, no information about the site will be lost This is one of the characteristics that sets ... administratively IF DETECTED, since you know where they live The greatest threat in terms of financial loss is insiders Period, no questions That said, the greatest number of threats is via Internet...

Ngày tải lên: 10/12/2013, 14:16

... listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl listen.pl S0 S0 S0 S0 S0 S0 S0 S0 S0 S0 Init PASS^M USER taldric^M PASS taldric^M USER taldric^M PASS ... with the system on TCP port 23, telnet with an active open, or the SYN flag is set The system responds with “login” If the answer is either guest or root, the system moves to State In State it ... offers “Password” and if the password matches the list with root or guest spelled backwards, the system “logs them in” and gives them a prompt We move to State Here we are looking for one of the...

Ngày tải lên: 10/12/2013, 14:16