Network Security , Report 01

Exercise 0 Attack Types and Security Services Attack

Preventative Service

Interruption

Availability

Interception

Data Confidentiality

Modification

Authentication & Data Integrity

Fabrication

Authentication and Non-Repudiation

Website, link to external from pqmasters for external access.

Exercise 1 High Level Assessment 1. What needs to be protected 1. The machine (portable) from theft. 2. The usability of the machine in the case that it is stolen. 3. The sensitive data and data-access mechanisms on the machine 4. The OS and other applications from attacks allowing outage, data exposure, unauthorised usage, etc. 5. Associated Memory devices (USB, Card, Etc) with varying transient data on them. 6. Other media with backups of data. 2. Who Owns It ? 1. Me 3. Who needs access ? 1. Me 2. My wife may need access if her machine fails or is not at hand. 4. Where is the information stored ? 1. On the machine ➔ data folder ➔ browser cache, cookies, form completion, history, authenticated sessions ➔ temporary folders ➔ os caches ➔ application caches 2. On backup media. 3. On a transient basis on portable memory devices such as Flash / SD / USB etc. 4. On networked devices out of my control (printer spools, mail spools, mail servers, etc) 5. Transiently on the networks themselves, again much may be out of my control but I can take time to ensure secure communications where possible. 5. Risks, Impact of Breach 1. Time Wasted (securing, restoring data from backups, restoring OS, sourcing new hw, etc, changing passwords / access codes / certs / etc) 2. Monetary loss (replacing hw, replacing data, unauthorised / excessive bandwidth usage,

potential legal costs if I have to defend myself if my hw is used in illegal activity, etc) 3. Confidentiality breach. Personal information, potentially sensitive now in the hands of whomever. Whether access to the data locally or on remote machines/services. 4. Access to those services is further a threat as they services may also be used for further attacks on myself [name, reputation, etc] and/or others [spam, defamation, their data, etc]

Specific Threats and Counter Measures 1. Access to the device (re theft and possible hw modification that could compromis security) Mind it ➔ Keep out of sight when leaving in car, house, work ➔ Secure car with alarm ➔ Secure house with alarm, keep friendly with the neighbours. 2. Usability of device if stolen ➔

Trying to lock out usability of the device and access to data may render it so unusable that it's easier to just leave it alone, or to collect a reward as 'finder' when one realises it's useless for all but the most determined. ➔ Installation of a phone-home mechanism at the lowest possible level may help with location and retrieval of the device if it is stolen. ➔ Prevent settings access in BIOS via a system lock (pw) ➔ Secure Hard Drive via a device lock (pw). With my model, apparently this remains with HD if moved to another machine. ➔ Lock ability to Boot Up the machine via a BIOS level system lock (pw). ➔ Try to gauge effectiveness of System/BIOS and HD security mechanisms and act appropriately to findings. 3. Sensitive Data ➔

Sensitive Data on the machine and elsewhere needs to be kept confidential or removed [wipe] at the earliest convenience [backups, secure copies remain elsewhere.] ➔ Need to consider risk associated with the varying data. ➔ Data access mechanisms such as VPN and SSH keys, passwords for e-mail, forums, and other sites/services need to be protected in this consideration. ➔ Use of encrypted FS (virtual or in a partition or on other media ?) for storing sensitive data, passwords/certs/etc, browser cache etc. ➔ Use of encryption where possible for data transfer across networks not under my control [ practically all of them :) ] and paying more attention to the security of services on the networks/web. (email, banks, govt., etc). ➔ Automate clearing of cached information and manually check at intervals for anomalies. 4. The OS and Applications. ➔

➔ ➔ ➔ ➔

Firewall Virus Protection Service Audit with a view to intrusion prevention. [e.g. Lock down open access services such as DB installations, etc] Application research/audit prior to installation. Review application licence

agreements which are too often ignored and may contain agreement to allow exposure of potentially sensitive information. 5. Usage Access Will set up a restricted account if it becomes necessary to allow other persons to use the machine. Will not expose other security such as bios/system/hd access codes. 6. Virus Protection ➔

✔

AVG

7. Spyware ✔

AdWare, Spybot search and destroy

8. Firewall ✔

Zonealarm

9. User Authentication ✔

no unsecured accounts

✔

all accounts have active idle timeout with pw protection (screen saver lock)

✔

further unuse causes power management to kick in, meaning use then requires system startup security circumvention would also be required.

10. OS Auth protecting files 1. No. I have never seen this been shown to work outside of certain narrow cases. 2. FS and/or file encryption are the only potentially workable (imo) situations I have seen, and are still prone to attack in the manner of their de/en-cryption. (memory usage, temporary storage usage, the encryption controller/application and the encryption scheme itself) 11. Up to date-ness ✔

os

✔

firewall

✔

virus

✔

applications, at least the most commonly used ones (openOffice, browser, email)

✔

check interval is satisfactory imo.

✔

Auto-matic-ness of updates is satisfactory imo. 1. :( recent report (ms watch ?) indicates that MS may be applying updates to certain components even when auto-updating is not enabled.

12. Browser security 1. no confidence here. 2. Java and Javascript are enabled. There are plugins including flash enabled. 3. Browsers tend to store lots of info from history to form data, cookies, authed sessions, and even passwords. Even when I set it to clear this info I sometimes find during a browse information I would not have expected to be there. 4. They crash regularily, and chug lots of memory I don't see the need for, hinting imo at lots of resource leaks. One can see from a quick scan of any security alert list that resource usage (buffer overflows for e.g.) is well up there with the top [frequency] mechanisms for intrusion.

13. Unencrypted network services 1. Print to network. I must get a local printer for the top secret document I'm churning out by the dozen. A lot of printers in use nowadays are very conviently PS printers, making conversion of sniffed data to PDF trivial. 2. Email. I have some accounts with no protection. Few with good authentication but they don't have transport encryption for mail/sender/receipiant data (confidentiality). 3. IM. These are so convenient you could send the most sensitive data without realising or giving a second thought. When I looked at these briefly years ago they were by no means secure. The VOIP (V=voice and/or video) capabilitys of todays IM application raise more interesting security considerations here. 4. Browsing. This is always an interesting one. Aside from the HTTP body itself, the poor use of URI query strings (among other issues) can mean sensitive data is exposed in proxies and even in the statistical records of web sites you visit. Consider the simple and seemingly innocuous act of clicking a link in an email through web based interface to that email, you could have your email account details on the target of the link via the referrer information. 14. My Top 5 1. Lots of USB/SD/etc memory device usage. Small, easy to lose, non-encrypted. 2. Browser sync defaulted to include browser stored pw info for sites. 3. Network security at work. 4. Office (physical) security at work. 5. Location and movement of backups during house move. 6. Connecting a machine on a network after a long time off any network, specifically no access to a network with web/internet access. The machine required many updates to the OS and applications by the time it was finally re-joined to “the net”, and during this (long) time to download the updates it was obviously online and thus exposed to vunerabilities discovered during the time it was offline, and for the duration of the update the (now very vunerable) browser was open ! All bad. 7. Blaster worm protection ? 15. Sans Top 20. 1. Still reading this one ! 16. Machine Penetration testing (nmap) [ used on work pc ] 1. MsRpc, MsDs and netbios are open, though I have a personal firewall. I have not set it at full blocking as I need to use certain network services (sharing etc). Still it's interesting to see what is open. MsSql and mysql were found though noted as filtered. This i didn't intend ! 17. Online security Tips (US-CERT) ○

Some interesting points about posting information online, being careful about what you advertise, etc.

○

Understanding the limits of firewall and virus protection packages

○

Power surge recommendations are something not often at the top of ones list. I have some but not, interestingly, one that I bring with me and my portable pc.

○

Cell phone attacks is an interesting one i hadn't considered, but which will probably

become more of an issue as the technology improves in functionality and acceptance. ○