NETWORK SECURITY
The easiest way to protect a network from an outside
attack is to close it off completely from the outside world. A closed network
provides connectivity only to trusted known parties and sites; a closed network
does not allow a connection to public networks.
There is a estimates that 60 to 80 percent of network misuse
comes from inside the enterprise where the misuse has taken place.
With the development of large open networks, security
threats have increased significantly in the past 20 years. Hackers have discovered
more network vulnerabilities, and because you can now download applications
that require little or no hacking knowledge to implement, applications intended
for troubleshooting and maintaining and optimizing networks can, in the wrong
hands, be used maliciously and pose severe threats.
Types of attack:
Classes of attack might include passive monitoring of
communications, active network attacks, close-in attacks, exploitation by
insiders, and attacks through the service provider. Information systems and
networks offer attractive targets and should be resistant to attack from the
full range of threat agents, from hackers to nation-states. A system must be
able to limit damage and recover rapidly when attacks occur.
There are five types of attack:
Passive Attack
A passive attack monitors unencrypted
traffic and looks for clear-text passwords and sensitive information that can
be used in other types of attacks. Passive attacks include
traffic analysis, monitoring of unprotected communications, decrypting weakly
encrypted traffic, and capturing authentication information such as passwords.
Passive interception of network operations enables adversaries to see upcoming
actions. Passive attacks result in the disclosure of information or data files
to an attacker without the consent or knowledge of the user
.
Active Attack
In an active attack, the attacker tries to
bypass or break into secured systems. This can be done through stealth,
viruses, worms, or Trojan horses. Active attacks include attempts to circumvent
or break protection features, to introduce malicious code, and to steal or
modify information. These attacks are mounted against a network backbone,
exploit information in transit, electronically penetrate an enclave, or attack
an authorized remote user during an attempt to connect to an enclave. Active
attacks result in the disclosure or dissemination of data files, DoS, or
modification of data.
Distributed Attack
A distributed attack requires that the
adversary introduce code, such as a Trojan horse or back-door program, to a
“trusted” component or software that will later be distributed to many other
companies and users Distribution attacks focus on the malicious modification of
hardware or software at the factory or during distribution. These attacks
introduce malicious code such as a back door to a product to gain unauthorized
access to information or to a system function at a later date.
Insider Attack
An insider attack involves someone from the
inside, such as a disgruntled employee, attacking the network Insider attacks
can be malicious or no malicious. Malicious insiders intentionally eavesdrop,
steal, or damage information; use information in a fraudulent manner; or deny
access to other authorized users. No malicious attacks typically result from
carelessness, lack of knowledge, or intentional circumvention of security for
such reasons as performing a task
NETWORK SECURITY RECONNAISSANCE ATTACK
A reconnaissance attack occurs when an adversary tries to
learn information about your network
Reconnaissance is the unauthorized discovery and mapping of
systems, services, or vulnerabilities.
Reconnaissance is also known as information gathering and, in most
cases, precedes an actual access or DoS attack. First, the malicious intruder
typically conducts a ping sweep of the target network to determine which IP
addresses are alive. Then the intruder determines which services or ports are
active on the live IP addresses. From this information, the intruder queries
the ports to determine the type and version of the application and operating
system running on the target host.
Reconnaissance is somewhat analogous to a thief
investigating a neighborhood for vulnerable homes, such as an unoccupied
residence or a house with an easy-to-open door or window. In many cases,
intruders look for vulnerable services that they can exploit later when less
likelihood that anyone is looking exists.
