Cyber security Attacks ppt

network security attacks and defence ppt and security attacks in information security ppt
NicolusNorton Profile Pic
NicolusNorton,Germany,Professional
Published Date:08-07-2017
Your Website URL(Optional)
Comment
Network Security 15-441 Networks Fall 2002 1A Brief History of the World 15-441 Networks Fall 2002 2Overview  What is security?  Why do we need security?  Who is vulnerable?  Common security attacks and countermeasures – Firewalls & Intrusion Detection Systems – Denial of Service Attacks – TCP Attacks – Packet Sniffing – Social Problems 15-441 Networks Fall 2002 3What is “Security”  Dictionary.com says: – 1. Freedom from risk or danger; safety. – 2. Freedom from doubt, anxiety, or fear; confidence. – 3. Something that gives or assures safety, as: • 1. A group or department of private guards: Call building security if a visitor acts suspicious. • 2. Measures adopted by a government to prevent espionage, sabotage, or attack. • 3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant. …etc. 15-441 Networks Fall 2002 4What is “Security”  Dictionary.com says: – 1. Freedom from risk or danger; safety. – 2. Freedom from doubt, anxiety, or fear; confidence. – 3. Something that gives or assures safety, as: • 1. A group or department of private guards: Call building security if a visitor acts suspicious. • 2. Measures adopted by a government to prevent espionage, sabotage, or attack. • 3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant. …etc. 15-441 Networks Fall 2002 5What is “Security”  Dictionary.com says: – 1. Freedom from risk or danger; safety. – 2. Freedom from doubt, anxiety, or fear; confidence. – 3. Something that gives or assures safety, as: • 1. A group or department of private guards: Call building security if a visitor acts suspicious. • 2. Measures adopted by a government to prevent espionage, sabotage, or attack. • 3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant. …etc. 15-441 Networks Fall 2002 6What is “Security”  Dictionary.com says: – 1. Freedom from risk or danger; safety. – 2. Freedom from doubt, anxiety, or fear; confidence. – 3. Something that gives or assures safety, as: • 1. A group or department of private guards: Call building security if a visitor acts suspicious. • 2. Measures adopted by a government to prevent espionage, sabotage, or attack. • 3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant. …etc. 15-441 Networks Fall 2002 7Why do we need security?  Protect vital information while still allowing access to those who need it – Trade secrets, medical records, etc.  Provide authentication and access control for resources – Ex: AFS  Guarantee availability of resources – Ex: 5 9’s (99.999% reliability) 15-441 Networks Fall 2002 8Who is vulnerable?  Financial institutions and banks  Internet service providers  Pharmaceutical companies  Government and defense agencies  Contractors to various government agencies  Multinational corporations  ANYONE ON THE NETWORK 15-441 Networks Fall 2002 9Common security attacks and their countermeasures  Finding a way into the network – Firewalls  Exploiting software bugs, buffer overflows – Intrusion Detection Systems  Denial of Service – Ingress filtering, IDS  TCP hijacking – IPSec  Packet sniffing – Encryption (SSH, SSL, HTTPS)  Social problems – Education 15-441 Networks Fall 2002 10Firewalls  Basic problem – many network applications and protocols have security problems that are fixed over time – Difficult for users to keep up with changes and keep host secure – Solution • Administrators limit access to end hosts by using a firewall • Firewall is kept up-to-date by administrators 15-441 Networks Fall 2002 11Firewalls  A firewall is like a castle with a drawbridge – Only one point of access into the network – This can be good or bad  Can be hardware or software – Ex. Some routers come with firewall functionality – ipfw, ipchains, pf on Unix systems, Windows XP and Mac OS X have built in firewalls 15-441 Networks Fall 2002 12Firewall Firewall Firewalls Internet DMZ Web server, email server, web proxy, etc Intranet 15-441 Networks Fall 2002 13Firewalls  Used to filter packets based on a combination of features – These are called packet filtering firewalls • There are other types too, but they will not be discussed – Ex. Drop packets with destination port of 23 (Telnet) – Can use any combination of IP/UDP/TCP header information – man ipfw on unix47 for much more detail  But why don’t we just turn Telnet off? 15-441 Networks Fall 2002 14Firewalls  Here is what a computer with a default Windows XP install looks like: – 135/tcp open loc-srv – 139/tcp open netbios-ssn – 445/tcp open microsoft-ds – 1025/tcp open NFS-or-IIS – 3389/tcp open ms-term-serv – 5000/tcp open UPnP  Might need some of these services, or might not be able to control all the machines on the network 15-441 Networks Fall 2002 15Firewalls  What does a firewall rule look like? – Depends on the firewall used  Example: ipfw – /sbin/ipfw add deny tcp from cracker.evil.org to wolf.tambov.su telnet  Other examples: WinXP & Mac OS X have built in and third party firewalls – Different graphical user interfaces – Varying amounts of complexity and power 15-441 Networks Fall 2002 16Intrusion Detection  Used to monitor for “suspicious activity” on a network – Can protect against known software exploits, like buffer overflows  Open Source IDS: Snort, www.snort.org 15-441 Networks Fall 2002 17Intrusion Detection  Uses “intrusion signatures” – Well known patterns of behavior • Ping sweeps, port scanning, web server indexing, OS fingerprinting, DoS attempts, etc.  Example – IRIX vulnerability in webdist.cgi – Can make a rule to drop packets containing the line •“/cgi-bin/webdist.cgi?distloc=?;cat%20/etc/passwd”  However, IDS is only useful if contingency plans are in place to curb attacks as they are occurring 15-441 Networks Fall 2002 18Minor Detour…  Say we got the /etc/passwd file from the IRIX server  What can we do with it? 15-441 Networks Fall 2002 19Dictionary Attack  We can run a dictionary attack on the passwords – The passwords in /etc/passwd are encrypted with the crypt(3) function (one-way hash) – Can take a dictionary of words, crypt() them all, and compare with the hashed passwords  This is why your passwords should be meaningless random junk – For example, “sdfo839f” is a good password • That is not my andrew password • Please don’t try it either 15-441 Networks Fall 2002 20