mopdf.com

Security intelligenceIT Security AuditingMr. Watcharaphon WongaphaiSenior Information Security InstructorGIAC GCFA ,SSCP ,E CSA ,C EH ,CNE6 ,Security ,CCNA ,Network

Security intelligenceClass Introduction Introduce Instructor Watcharaphon WongaphaiGIAC GCFA ,SSCP ,E CSA ,C EH ,CNE6 ,Security ,CCNA ,Network Contact Point [email protected] [email protected] (MSN) facebook.com/watcharaphon.wo Session & Break Session 1 09:00 – 10:30 Coffee Break10:30 – 10:45 Session 2 10:45 – 12:00 Lunch12:00 – 13:00 Session 3 13:00 – 14:30 Coffee Break14:30 – 14:45 Session 4 14:45 – 16:00 Summary of the Daywww.cdicconference.com16:002

Security intelligenceWatcharaphon WongaphailKurpaik0 GCFA ,SSCP ,E CSA ,C EH ,CNE6 ,Security ,CCNA ,Network Instructor / Speaker ,Researcher My Folio ACIS Article– SSLStrip– How to steal cookie– How to recover Social Network and Vulnerability Public VDO– Vimeo.com (Kurapiko)– Youtube.com (lKurapiko)3

Security intelligencePublic VDO on Youtube.com ,Vimeo.com4

Security intelligenceIntroduction Penetration Testing

Security intelligenceObjective Importance of information security in today‟s worldElements of securityPenetration Testing FrameworkHacking methodologyHacktivismVulnerability research and tools

Security intelligenceEssential Terminologies Threat– An action or event that might compromise security. A threat is apotential violation of security Vulnerability– Existence of a weakness, design ,or implementation error that canlead an unexpected and undesirable event compromising thesecurity system Target or Victim– An IT system .Product or component that is subjected to requiresecurity evaluation

Security intelligenceEssential Terminologies (Cont’d) Attack– An assault on the system security that is derived fromintelligent threat Exploit– A defined way to breach the security of and IT systemthrough vulnerability

Security intelligenceElements of Security ConfidentialityAuthenticityIntegrityAvailability

Security intelligenceBalance the Security

Security intelligenceEC-Council Hacking Methodology Foot printingScanningEnumerationGaining AccessMaintaining AccessCovering Tracks

Security intelligenceTypes of Hacker Attacks There are several ways an attacker can gainaccess to a system The attacker must be able to exploit a weaknessor vulnerability in a system– Attack Types Operating System attacksApplication-Level attacksShrink Wrap code attacksMisconfiguration attacks

Security intelligence1. Operating System Attacks

Security intelligence1. Operating System Attacks (Cont’d) Today‟s operating systems are complex in nature Operating systems rum many services, Ports and modesof access and require extensive tweaking to lock themdown The default installation of most operating systems haslarge numbers of services running and ports open Applying patches and hotfixes are not easy in today‟scomplex network Attackers look for OS Vulnerabilities and exploit them togain access to a network system

Security intelligence2. Application Level Attacks Software developers are under tight schedules to deliverproducts on time Extreme Programming is on the rise in softwareengineering methodology Software applications come with toms of functionalitiesand features Sufficient time is not there to perform complete testingbefore releasing products Poor or non-existent error checking in applications whichleads to “Buffer Overflow Attacks”

Security intelligence3. Shrink Wrap Code Attacks Why reinvent the when you can buy off-the-shelf“libraries” and code? When you install an OS/Application ,it comes withtons of sample scripts to make the life of anadministrator easy The problem is “not fine tuning” or customizingthese scripts

Security intelligence3. Shrink Wrap Code Attacks (Cont’d)

Security intelligence4. Misconfiguration Attacks Systems that should be fairly secure are hacked becausethey were not configured correctly Systems are complex and the administrator does not havethe necessary skills or resources to fix the problem Administrator will create a simple configuration that works In order to maximize your chances of configuring a machinecorrectly, remove any unneeded service and software

Security intelligenceRemember This Rule! If a hacker really want to get inside your system,He will and there is nothing you can do about it The only thing you can do is Make it harder forhim

Security intelligenceHacker Classes Black HatsWhite HatsGray HatsSuicide Hackers

Security intelligenceCan Hacking be Ethical Hacker: Refers to a person who enjoys learning thedetail of computer systems and to stretch his capabilities Cracker: Refer to a person who uses his hacking skills foroffensive purpose Hacking: Describes the repid development of newprograms or the reverse engineesing of the alreadyexisting software to make the code better and moreefficient Ethical hacker: Refers to security professionals whoapply their hacking hacking skills for defensive purposes

Security intelligenceWhat is Vulnerability Research Discovering vulnerabilities and designing weaknesses that will open anoperating system and its applications to attack or misuse Includes both dynamic study of products and technologies and ongoingassessment of the hacking underground Relevant innovations are released in the form of alerts and are deliveredwithin product improvement for security systems Can be classified based on– Severity level (Low, Medium ,Or high)– Exploit range (Local or remote)

Security intelligenceWhy Hackers Need Vulnerability ResearchTo identify and correct network vulnerabilitiesTo protect the network from being attacked by intrudersTo get information that helps to prevent security problemsTo Gather information about virusesTo find weaknesses in the network and to alert the networkadministrator before a network attack To know how to recover from a network attack

Security intelligenceVulnerability Research Websites tymagazine.com

Security intelligenceNational Vulnerability Database

Security intelligenceExploit-db.com26

Security intelligenceHow to Conduct Ethical Hacking Step 1: Talk to your client on the needs of testing Step 2: Prepare NDA document and ask the client to signthem Step 3: Prepare an ethical hacking team and draw upschedule for testing Step 4: Conduct the test Step 5: Analyze the results and prepare a report Step 6: Deliver the report to the client

Security intelligenceEthical hacking Testing Approaches to testing are shown below:– Black box: with no prior knowledge of the infrastructureto be tested– White box: With a complete knowledge of the networkinfrastructure– Gray box: Also known as internal Testing.It examines theextent of the access by insiders

Security intelligenceHacking methodology EC – Council Hacking Methodology Foundstone Hacking Methodology Hacking Exposed Methodology

Security intelligenceEC-Council Hacking Methodology Foot printingScanningEnumerationGaining AccessMaintaining AccessCovering Tracks

Security intelligenceSecurity Testing Framework Open source security testing methodology manual(OSSTMM) SP 800-115 NIST Publication The Information System Security AssessmentFramework (ISSAF)

Security intelligenceNIST SP800-115: Technical Guide toInformationSecurity Testing (Draft)Release date: Nov 14, 2007Replace: SP800-42The publication provides practical recommendations fordesigning, implementing, and maintaining technicalinformation security testing processes and procedures.SP 800-115 provides an overview of key elements ofsecurity testing, with an emphasis on technical testingtechniques, the benefits and limitations of each technique,and recommendations for their use.

Security intelligenceInformation Security TestingOverviewInformation security testing is the process of validating theeffective implementation of security controls for informationsystems and networks, based on the organization‟s securityrequirements.Technical information security testing can identify, validate,and assess technical vulnerabilities, which helpsorganizations to understand and improve the securityposture of their systems and networks.Security testing is required by FISMA and other regulations.

Security intelligenceInformation Security TestingMethodologyThe testingmethodology shouldcontain at least thefollowing phases:PlanningExecutionPostExecutionNIST does not endorse one methodologyover another; the intent is to provide optionsto organizations so they can make aninformed decision to adopt an existingmethodology or take several others todevelop a unique methodology that bestsuits the organization.One of these methodologies was created byNIST and is documented in SpecialPublication (SP) 800-53A, Guide for Assessingthe Security Controls in Federal InformationSystems (Draft), which offers suggestions forassessing the effectiveness of securitycontrols recommended in NIST SP 800-53

Security intelligenceInformation Security Testing TechniquesTargetVulnerabilityValidationTechniques Password cracking Remote access testing Penetration testing Social engineering Physical security testingReviewTechniques Documentation review Log review Ruleset review System configurationreview Network sniffing File integrity checkingTarget Identificationand AnalysisTechniques Network discovery Network port and Serviceidentification Vulnerability scanning Wireless scanning Application security testing

Review Techniques:Documentation tecturesSecurity policiesDocuments toreview fortechnical accuracyand completenessincludeSystemsecurityplans andauthorizationagreementsMemorandaofunderstanding andagreementfor systeminterconnections Security intelligenceIncidentresponseplans

Security intelligenceReview Techniques:Log ReviewThe following are examples of log information that may beuseful when conducting security testing:– Authentication server or system logs may include successful andfailed authentication attempts.– System logs may include system and service startup and shutdowninformation, installation of unauthorized software, file accesses,security policy changes, account changes (e.g., account creation anddeletion, account privilege assignment), and use of privileges.– Intrusion detection and prevention system logs may includemalicious activity and inappropriate use.

Security intelligenceReview Techniques:Log Review (2)– Firewall and router logs may include outbound connections thatindicate compromised internal devices (e.g., rootkits, bots, Trojanhorses, spyware).– Firewall logs may include unauthorized connection attempts andinappropriate use.– Application logs may include unauthorized connection attempts,account changes, use of privileges, and application or databaseusage information.– Antivirus logs may include update failures and other indications ofoutdated signatures and software.– Security logs, in particular patch management and some IDS andintrusion Prevention system (IPS) products, may record informationon known vulnerable services and applications.