states transitions and filters the big picture

... how they can protect your information Let them know how important they are in the process, and let them know the consequences of failing to enforce your policies Give them the tools and the processes ... Security: The Big Picture - SANS GIAC © 2000 We will spend the rest of the course talking about the importance of security, risk and threats, and the steps you can take to improve the security ... after year The reasons are obvious These people are already in a position of trust, they know their way around the systems, and they know what security controls are in place and usually how they can...

Ngày tải lên: 18/10/2013, 18:15

... call, they would contact the operator at the central office and tell them the name of the person they wanted to talk to The operator would then connect the caller’s plug to the plug of the person ... voice make the can vibrate That vibration is transferred through the string and sent to the other can The receiving can then repeats the vibrations from the string and replicates the sound of ... ways, it is the same as the Cans and String model, except the cans are replaced by the phones and the string is replaced by copper wire Like the can, the telephone picks up the voice of the person...

Ngày tải lên: 22/10/2013, 16:15

... purchased, the process goes in reverse The first floor gives the raw ingredients to the second floor The second floor checks that all the ingredients are there and then hands them off to the third ... floor The third floor prepares the various courses by making the soup, tossing the salad, cooking the beef, and baking the pie Once all this is done they hand the food off to the fourth floor The ... gives the “Hello There” to the Application Layer of the protocol stack The Application Layer creates an empty packet and places the “Hello There” inside of it The Application Layer then sends the...

Ngày tải lên: 22/10/2013, 16:15

... information and specific details Expand the example until you have two complete paragraphs In Short Revision deals with the content and style of the essay and should begin by addressing the big- picture ... of the deception To demonstrate how important transitions are, here’s the fourth paragraph of the essay with transitions removed and then repeated with transitions intact (and underlined): These ... REVISING: THE BIG PICTURE Support That’s Directly Related to the Thesis As important as the amount of support is its relevance to the thesis What good are ten supporting paragraphs if they’re...

Ngày tải lên: 25/10/2013, 17:20

... as the Handler It is the Handler’s responsibility to coordinate the attack on behalf of the Attacker When the Attacker is ready to launch the attack, he contacts the Handler and tells it who the ... real Victim is, how long the attack should last, and any other information the Agents will need The Handler then relays that information to the Agents and off they go What the Victim sees is a DoS ... to all the other hosts on that network, which then act as the agents for the attack Being good little agents, they want to reply to the request However the only information they have is the spoofed...

Ngày tải lên: 26/10/2013, 23:15

... ran them, they interacted with a server somewhere on the network, they did the work on the server, you got the results, and you were done Then with the advent of the web, we started seeing the ... language the server will understand, send it off to the server over the network, and waits for the reply When the server sends the reply, the browser will format it and display it for the user ... here to see the dancing pigs,” and then see the silly dialog box pop up, they don’t know who the publisher is, and no reason to think the control has any malicious intent They just know they want...

Ngày tải lên: 26/10/2013, 23:15

... work and somewhat costly • There has to be a balance between the cost of improving protection and the value of what you are defending Intrusion Detection - The Big Picture - SANS GIAC © 2000 34 The ... Intrusion Detection - The Big Picture - SANS GIAC © 2000 15 Having guessed the next sequence number, and assuming A has sent the SYN/ACK back to B, the attacker completes the connection establishment ... Intrusion Detection - The Big Picture - SANS GIAC © 2000 16 Now, the attacker goes in for the kill to crack open A’s security He sends an rshell command to add the string “++” to the file “/.rhosts”...

Ngày tải lên: 04/11/2013, 12:15

... Security: The Big Picture - SANS GIAC © 2000 If the world is moving toward the use of certificates, there must be some formal standard for specifying the use and format of certificates There is, and ... challenge When the response comes back from the user, the server will compare the user’s response to the one it generated and is expecting If the two match, the user is authenticated and the processing ... much into the glass? What happened? The foam and the beer spilled over the top of the glass, pouring down the side of the glass and spilling onto your table, your clothes, your keyboard and whatever...

Ngày tải lên: 04/11/2013, 12:15

... report the detect This is the more detailed log file, notice the rule that found the detect is displayed at the top Then summary information about the packet The trace begins with the content of the ... Libpcap is designed to get the data from the kernel space and pass it to the application There are implementations for Windows and Unix, it is reliable and has the big advantage of being free ... 192.168.1.1 and ( (tcp and ((tcp[13] & != 0) and (tcp[13] & 0x10 = 0)) and (not dst port 80)) or (udp and not dst port 53 and not dst port 137) or (icmp and (icmp[0] != 8) and (icmp[0] != 0) and (icmp[0]...

Ngày tải lên: 09/12/2013, 17:15

... ran them, they interacted with a server somewhere on the network, they did the work on the server, you got the results, and you were done Then with the advent of the web, we started seeing the ... language the server will understand, send it off to the server over the network, and waits for the reply When the server sends the reply, the browser will format it and display it for the user ... here to see the dancing pigs,” and then see the silly dialog box pop up, they don’t know who the publisher is, and no reason to think the control has any malicious intent They just know they want...

Ngày tải lên: 09/12/2013, 17:15

... as the Handler It is the Handler’s responsibility to coordinate the attack on behalf of the Attacker When the Attacker is ready to launch the attack, he contacts the Handler and tells it who the ... real Victim is, how long the attack should last, and any other information the Agents will need The Handler then relays that information to the Agents and off they go What the Victim sees is a DoS ... to all the other hosts on that network, which then act as the agents for the attack Being good little agents, they want to reply to the request However the only information they have is the spoofed...

Ngày tải lên: 10/12/2013, 14:16

... ran them, they interacted with a server somewhere on the network, they did the work on the server, you got the results, and you were done Then with the advent of the web, we started seeing the ... language the server will understand, send it off to the server over the network, and waits for the reply When the server sends the reply, the browser will format it and display it for the user ... here to see the dancing pigs,” and then see the silly dialog box pop up, they don’t know who the publisher is, and no reason to think the control has any malicious intent They just know they want...

Ngày tải lên: 10/12/2013, 14:16

... Security: The Big Picture - SANS GIAC © 2000 If the world is moving toward the use of certificates, there must be some formal standard for specifying the use and format of certificates There is, and ... challenge When the response comes back from the user, the server will compare the user’s response to the one it generated and is expecting If the two match, the user is authenticated and the processing ... much into the glass? What happened? The foam and the beer spilled over the top of the glass, pouring down the side of the glass and spilling onto your table, your clothes, your keyboard and whatever...

Ngày tải lên: 10/12/2013, 14:16

... Detection - The Big Picture – SANS GIAC ©2000 11 The telnetd and the web demon are “real” They are compiled C code They simply simulate the services This could be important, since they might be ... Intrusion Detection - The Big Picture – SANS GIAC ©2000 24 Egress filtering is focused on the addresses in the packet, but the most common filters are focused on the destination port The destination ... - The Big Picture – SANS GIAC ©2000 The Deception Tool Kit (DTK) was created by Fred Cohen, one of the most brilliant and well-loved individuals on the Internet (one out of two ain’t bad), and...

Ngày tải lên: 10/12/2013, 14:16

... Intrusion Detection - The Big Picture – SANS GIAC ©2000, 2001 Special thanks to Simson Garfinkle and the folks at Sandstorm (www.sandstorm.net) for the permission to use the PhoneSweep slides ... on the motherboard The idea was to speed up equipment inventory You walk down the hall transmitting a code and the PCs respond by transmitting their serial number back There was a bug in the ... know the tool very well Intrusion Detection - The Big Picture – SANS GIAC ©2000, 2001 16 In the previous example, it isn’t that you were wrong when you went to management and told them they were...

Ngày tải lên: 10/12/2013, 14:16

... about the big picture Management wants to know the big picture – and rightfully so There is more than just the initial outlay for the hardware and software There is maintenance, training, and the ... familiar with these core technologies and how they play together: – Host- and Network-Based Intrusion Detection – Vulnerability Scanners and Honeypots – Firewalls Intrusion Detection - The Big Picture ... We compare the effectiveness of the threat against the value of the assets it can affect We research to find out the known vulnerabilities and then evaluate the risk to determine whether we have...

Ngày tải lên: 10/12/2013, 14:16

... firewalls themselves, which are an amazingly effective perimeter, contribute to the problem The people protected by the firewall think everything is OK since the firewall stops the attacks and then they ... data from the kernel space and pass it to the application There are implementations for Windows (winpcap-based - the Windows version of libpcap) and Unix It is reliable and has the big advantage ... report the detect This is the more detailed log file Notice the rule that found the detect is displayed at the top Then summary information about the packet is given The trace begins with the content...

Ngày tải lên: 10/12/2013, 14:16

... attack other systems Of course, smap is not sendmail and just changing the banner from “smap” to “sendmail” will not fool the wise attacker The higher the fidelity of the honeypot, the greater the ... traffic In the slide above, the packet is addressed to TCP port 143, the IMAP service If the site does not allow IMAP through the firewall, then there will never be a SYN/ACK response, the TCP three-way ... open, or the SYN flag is set The system responds with “login” If the answer is either guest or root, the system moves to State In State it offers “Password” and if the password matches the list...

Ngày tải lên: 10/12/2013, 14:16

... Well, once they compromise the box they have the ability to manipulate the addresses associated with the names of the network entities (such as computers) at your site These names and addresses ... 2000 This and the previous project are related to one another The main difference is that in the SBS booklet the detailed information is shown up front, and is in the help files on the NSWC checklist ... Management • In order to present the business case we need to convey the Big Picture • We are now familiar with these core technologies and how they play together: – Host- and Network-Based Intrusion...

Ngày tải lên: 10/12/2013, 14:16

... Security: The Big Picture - SANS GIAC © 2000 If the world is moving toward the use of certificates, there must be some formal standard for specifying the use and format of certificates There is, and ... challenge When the response comes back from the user, the server will compare the user’s response to the one it generated and is expecting If the two match, the user is authenticated and the processing ... much into the glass? What happened? The foam and the beer spilled over the top of the glass, pouring down the side of the glass and spilling onto your table, your clothes, your keyboard and whatever...

Ngày tải lên: 10/12/2013, 15:15