Customer
database
High
•
Confidentiality
• Integrity
• Availability
This database contains all customers’ records,
including address and credit card information.
VP of
Marketing
CIO
Web server High
•
Confidentiality
• Integrity
• Availability
This is used by our customers to place orders. It is
very important that it would be available 24/7.
CIO
Mail server Medium
•
Confidentiality
• Integrity
• Availability
This is used by employees for internal
communication. It is very important that no one
intercepts this communication as sensitive
information is shared via email.
CIO
Financial
records
High
•
Confidentiality
• Integrity
• Availability
These records are used by the C-level executives
and also by the VP of operations. It is imperative
that nobody else but the C-team be able to access
this mission information.
CFO
Employees’
computers
Low
•
Confidentiality
• Integrity
• Availability
Each employee is assigned to a cubical that has a
desktop computer in it. Employees provide
customer service and support for our website
using these computers.
Division
directors
FIGURE 11-3 Sample inventory of assets for a Web-based bookstore
FIGURE 11-4 Likelihood of a threat
The actual probability of a threat to your organization depends on your business. A bank, for example, is
more likely to be a target of phishing than a family-owned store. The most frequent targets are healthcare
providers, financial services firms, and government agencies, likely because they have the most valuable
data.
The next step is to create threat scenarios. A threat scenario describes how an asset can be


compromised by one specific threat. An asset can be compromised by more than one threat, so it is
common to have more than one threat scenario for each asset. For example, the confidentiality, integrity,
and/or availability of the client data database in Figure 11-3 can be compromised by an attacker stealing
information (confidentiality), an attacker changing information (integrity), or a natural disaster
destroying information or the hardware on which it is stored (availability).
When preparing a threat scenario, we name the asset, describe the threat, explain the consequence
(violation of confidentiality, integrity, or availability), and estimate the likelihood of this threat happening
(high, medium, or low).
Figure 11-5 provides an example of a threat scenario for one asset (the customer database) of a Web-based
bookstore. The top half of the threat scenario describes the risk associated with the asset from the threat,
while the bottom half (shaded in color) describes the existing controls that have been implemented to
protect the asset from this threat. This step focuses on the top half of the threat scenario, whereas the next
step (Section 11.2.4) describes the bottom half.
A threat scenario begins with the name of the asset and the threat being considered. The threat is
described and the likelihood of its occurrence is assessed as high, medium, or low. Then the potential
impact is identified, whether this is confidentiality, integrity, or availability. Some threats could have
multiple impacts.
Next, the consequences of the threat are assessed, using the impact areas identified in step 1 and their
priority (e.g., reputation, financial, productivity, safety, and legal). We identify the impact that each
scenario could have on each priority area, high, medium, or low, using the risk measurement criteria


defined in step 1. We calculate an impact score by multiplying the priority of each area by the impact the
threat would have, using a 1 for a low value, a 2 for a medium value, and a 3 for a high value, and
summing all the results to produce an impact score.
Finally, we can calculate the relative risk score by multiplying the impact score by the likelihood (using 1
for low likelihood, 2 for medium likelihood, and 3 for high likelihood).
Figure 11-5 shows that the risk score for information theft from the customer database is 50. The absolute
number does not really tell us anything. Instead, we compare the risk scores among all the different threat
scenarios to help us identify the most important risks we face.
Figure 11-6 shows the threat scenario for a tornado strike against our customer database. Take a moment
and compare the two threat scenarios. You can see that the tornado risk score is 14, which shows that
information theft is a greater risk than a tornado.
In these examples, we have used only three values (high, medium, and low) to assess likelihood, priority,
and impact. Some organizations use more complex scoring systems. And nothing says that likelihood,
priority, and impact have to use the same scales. Some organizations use 5-point scales for priority, 7-
point scales for impact, and 100-point scales for likelihood.
11.2.4 Document Existing Controls
Once the specific assets, threat scenarios, and their risk scores have been identified, you can begin to work
on the risk control strategy, which is the way an organization intends to address a risk. In general, an
organization can accept the risk, mitigate it, share it, or defer it. If an organization decides to accept a


risk, it means the organization will be taking no action to address it and accept the stated consequences.
In general, these risks have very low impact on the organization.
Risk mitigation involves implementation of some type of a control to counter the threat or to minimize
the impact. An organization can implement several types of controls, such as using antivirus software,
implementing state-of-the-art firewalls, or providing security training for employees.
An organization can decide to share the risk. In this case, it purchases insurance against the risk. For
example, you share a risk for getting into a car accident. It is quite unlikely that you will be in a car
accident, but if it were to happen, you want to make sure that the insurance company can step in and pay
for all the damages. Similarly, an organization may decide to purchase insurance against information theft
or damage from a tornado. Sharing and mitigation can be done simultaneously.
Finally, the organization can defer the risk. This usually happens when there is a need to collect additional


information about the threat and the risk. These risks are usually not imminent and, if they were to occur,
would not significantly impact the organization.


FIGURE 11-5 Threat scenario for theft of customer information


FIGURE 11-6 Threat scenario for destruction of customer information by a tornado
For each threat scenario, the risk control strategy needs to be specified. If the organization decides to
mitigate and/or share the risk, specific controls need to be listed. The next two sections in this chapter
describe numerous controls that can be used to mitigate the security risks organizations face.
Once the existing controls have been documented, an overall assessment of their adequacy is done. This
assessment produces a value that is relative to the risk, such as high adequacy (meaning the controls are
expected to strongly control the risks in the threat scenario), medium adequacy (meaning some


improvements are possible), or low adequacy (meaning improvements are needed to effectively mitigate
or share the risk). Once again, some organizations use more complex scales such as a letter grade (A, A−,
A+, B, etc.) or 100-point scales.
The bottom sections of the threat scenarios in Figures 11-5 and 11-6 show the strategy, controls, and their
adequacy for both threat scenarios. For the theft of information, the Web-based bookstore has already
implemented several risk mitigation strategies: encryption, a firewall, personnel policies, training, and
automatic screen lock. For the tornado, the company implemented a database backup and a disaster
recovery plan. Both have been assessed as medium adequacy.
At this point, you may or may not understand the controls described in these figures. However, after you
read the rest of the chapter, you will understand what each control is and how it works to mitigate the risk
from the threat.
11.2.5 Identify Improvements
The final step in risk assessment—and its ultimate goal—is to identify what improvements are needed.
Most organizations face so many threats that they cannot afford to mitigate all of them to the highest
level. They need to focus first on the highest risks; the threat scenarios with the highest risk scores are
carefully examined to ensure that there is at least a medium level of control adequacy. Besides, the most
important assets’ security requirements (labeled as high in Figure 11-3) are adequately protected.
Additional controls that could be implemented to improve the risk mitigation are considered, as are ways
to share the risk. As mentioned earlier, Sections 11.3 and 11.4 describe many different controls that can be
implemented to mitigate the risks associated with the loss of business continuity and unauthorized access.


implemented to mitigate the risks associated with the loss of business continuity and unauthorized access.
The second focus is on threat scenarios whose mitigation controls have low adequacy. Ideally, these will
all be low-risk threats, but they are examined to ensure the level of expenditure matches the level of risk.
11.3 ENSURING BUSINESS CONTINUITY
Business continuity means that the organization’s data and applications will continue to operate even in
the face of disruption, destruction, or disaster. A business continuity plan has two major parts: the
development of controls that will prevent these events from having a major impact on the organization,
and a disaster recovery plan that will enable the organization to recover if a disaster occurs. In this
section, we discuss controls designed to prevent, detect, and correct these threats. We focus on the major
threats to business continuity: viruses, theft, denial of service attacks, device failure, and disasters.
Business continuity planning is sometimes overlooked because intrusion is more often the subject of news
reports.
11.3.1 Virus Protection
Special attention must be paid to preventing malware such as computer viruses and ransomware.
Some are harmless and just cause nuisance messages, but others are serious, such as those that destroy
data if you don’t pay the ransom. In most cases, disruptions or the destruction of data are local and affect
only a small number of computers. Such disruptions are usually fairly easy to deal with; the virus is
removed and the network continues to operate. Ransomware can cause widespread destruction.
Most malware attaches itself to other programs or USB drives. As those files execute or the USB is
accessed, the malware spreads. Macro viruses, viruses that are contained in documents, emails, or
spreadsheet files, can spread when an infected file is simply opened. Some viruses change their
appearances as they spread, making detection more difficult.


appearances as they spread, making detection more difficult.
A worm is a special type of virus that spreads itself without human intervention. Many viruses attach
themselves to a file and require a person to copy the file, but a worm copies itself from computer to
computer. Worms spread when they install themselves on a computer and then send copies of themselves
to other computers, sometimes by emails, sometimes via security holes in software. (Security holes are
described later in this chapter.)
The best way to prevent the spread of viruses is to install antivirus software such as that by Symantec.
Most organizations automatically install antivirus software on their computers, but many people fail to


install them on their home computers. Antivirus software is only as good as its last update, so it is critical
that the software is updated regularly. Be sure to set your software to update automatically.
MANAGEMENT FOCUS 11-2
Auditors Are Your Friend
Security is now a major business issue, not just a technical one. Since bad security can have a major
impact on a firm’s financial performance, cybersecurity is now a key part of most financial audits.
Most technical people focus on the technology first, and documentation second. How much attention
did you spend on documenting your code in your programming class?
In contrast, auditors focus first on documentation and repeatable business processes. It is not
documented, it never happened.
While this may sound like oil and water that never mix—with the resulting problems—it can be a
very positive situation if managed properly. Auditors require the technical staff to double-check and
prove that important security controls are in place. And the documentation they require can help
when technical staff leave and are replaced with new people.
Auditors have also prompted some important improvements in security. Software vendors now
provide software that not only ensures security but also provides documentation on what controls
are in place, which is useful for auditors and the technical security team. Interestingly, some
software now starts with the documentation for auditors and then once the desired system has been
documented, it implements it throughout the firm (this is desktop management software as
described in the next chapter).
Malware is often spread by downloading files from the Internet, so do not copy or download files of
unknown origin (e.g., music, videos, screen savers), or at least check every file you do download. Always
check all files for malware before using them (even those from friends!). Researchers estimate that 10 new


viruses are developed every day, so it is important to frequently update the virus information files that are
provided by the antivirus software.
11.3.2 Denial-of-Service Protection
With a denial-of-service (DoS) attack (also called a distributed denial-of-service (DDoS)
attack), an attacker attempts to disrupt the target by flooding it with messages so that it cannot process
messages from normal users. The simplest approach is to flood a Web server, DNS server, mail server, and
so on, with incoming messages. The server attempts to respond to these, but there are so many messages
that it cannot.
One might expect that it would be possible to filter messages from one source IP so that if one user floods
the network, the messages from this person can be filtered out before they reach the Web server being
targeted. This could work, but most attackers use tools that enable them to put false source IP addresses
on the incoming messages so that it is difficult to recognize a message as a real message or a DoS message.
With a DDoS attack, the attacker breaks into and takes control of thousands computers or smart devices
(e.g., TVs) and plants software on them called a DDoS agent (or sometimes a zombie or a bot). The
attacker then uses software called a DDoS handler (sometimes called a botnet) to control the agents.
The handler issues instructions to the computers under the attacker’s control, which simultaneously begin
sending messages to the target site (see Figure 11-7). Some DDoS attacks have sent more than one billion
packets per second at the target.
There are several approaches to preventing DoS and DDoS attacks from affecting the network. The first is
to configure the main router that connects your network to the Internet (or the firewall, which will be


discussed later in this chapter) to verify that the source address of all incoming messages is in a valid
address range for that connection (called traffic filtering). For example, if an incoming message has a
source address from inside your network, then it is obviously a false address. This ensures that only


messages with valid addresses are permitted into the network, although it requires more processing in the
router and thus slows incoming traffic.
A second approach is to configure the main router (or firewall) to limit the number of incoming packets
that could be DoS/DDoS attack packets that it allows to enter the network, regardless of their source
(called traffic limiting). Technical Focus 11-2 describes some of the types of DoS/DDoS attacks and the
packets used. Such packets have the same content as legitimate packets that should be permitted into the
network. It is a flood of such packets that indicates a DoS/DDoS attack, so by discarding packets over a
certain number that arrive each second, one can reduce the impact of the attack. The disadvantage is that
during an attack, some valid packets from regular customers will be discarded, so they will be unable to
reach your network. Thus, the network will continue to operate, but some customer packets (e.g., Web
requests, emails) will be lost.
FIGURE 11-7 A distributed denial-of-service attack
FIGURE 11-8 Traffic analysis reduces the impact of denial-of-service attacks
A third and more sophisticated approach is to use a special-purpose security device, called a traffic


anomaly detector, that is installed in front of the main router (or firewall) to perform traffic analysis.
This device monitors normal traffic patterns and learns what normal traffic looks like. Most DoS/DDoS
attacks target a specific server or device so when the anomaly detector recognizes a sudden burst of
abnormally high traffic destined for a specific server or device, it quarantines those incoming packets but
allows normal traffic to flow through into the network. This results in minimal impact on the network as a
whole. The anomaly detector reroutes the quarantined packets to a traffic anomaly analyzer (see
Figure 11-8). The anomaly analyzer examines the quarantined traffic, attempts to recognize valid source
addresses and “normal” traffic, and selects which of the quarantined packets to release into the network.
The detector can also inform the router owned by the ISP that is sending the traffic into the organization’s
network to reroute the suspect traffic to the anomaly analyzer, thus avoiding the main circuit leading into
the organization. This process is never perfect, but it is significantly better than the other approaches.
MANAGEMENT FOCUS 11-3
DDoS Attacks for Hire?
Although the idea of DDoS is not new, they have increased by 1,000% since 2010, partially because
you can now hire a hacker who will attack anyone you like for a fee. On hacker forums, hackers
advertise their ability to take websites down. All you need to do is to reach them via a message on
this forum and negotiate the fee.
DDoS attacks are also used as a test for hackers wanting to join these hacker groups. The leader of a
hacker group will give a target website to an aspiring member, and the hacker has to prove that he or
she can bring the website down. The target websites are selected based on the security measures they


she can bring the website down. The target websites are selected based on the security measures they
have to protect themselves against attacks, so this task can be simple or quite complex based on the
test target selected.
DDoS attacks are here to stay because they are no longer a hobby but a source of income for
cybercriminals. Attackers are now able to bombard a target at more than 300 Gbps.
Source: Adapted from “The New Normal: 200–400 Gbps DDoS Attacks,” Krebs on Security (krebsonsecurity.com).
TECHNICAL FOCUS 11-2
Inside a DoS Attack
A DoS attack typically involves the misuse of standard TCP/IP protocols or connection processes so
that the target for the DoS attack responds in a way designed to create maximum trouble. Five
common types of attacks include the following:
ICMP Attacks The network is flooded with ICMP echo requests (i.e., pings) that have a
broadcast destination address and a faked source address of the intended target. Because it is a
broadcast message, every computer on the network responds to the faked source address so that
the target is overwhelmed by responses. Because there are often dozens of computers in the
same broadcast domain, each message generates dozens of messages at the target.
UDP Attacks This attack is similar to an ICMP attack, except that it uses UDP echo requests
instead of ICMP echo requests.
TCP SYN Floods The target is swamped with repeated SYN requests to establish a TCP
connection, but when the target responds (usually to a faked source address), there is no
response. The target continues to allocate TCP control blocks, expects each of the requests to be
completed, and gradually runs out of memory.
UNIX Process Table Attacks This is similar to a TCP SYN flood, but instead of TCP SYN


UNIX Process Table Attacks This is similar to a TCP SYN flood, but instead of TCP SYN
packets, the target is swamped by UNIX open connection requests that are never completed.
The target allocates open connections and gradually runs out of memory.


Finger of Death Attacks This is similar to the TCP SYN flood, but instead, the target is
swamped by finger requests that are never disconnected.
DNS Recursion Attacks The attacker sends DNS requests to DNS servers (often within the
target’s network) but spoofs the from address so the requests appear to come from the target
computer that is overwhelmed by DNS responses. DNS responses are larger packets than ICMP,
UDP, or SYN responses, so the effects can be stronger.
Source: Adapted from “Web Site Security and Denial of Service Protection,” www.nwfusion.com.
Another possibility under discussion by the Internet community as a whole is to require Internet service
providers (ISPs) to verify that all incoming messages they receive from their customers have valid source
IP addresses. This would prevent the use of fake IP addresses and enable users to easily filter out DDoS
messages from a given address and make it much harder for a DDoS attack to succeed. Because small- to
medium-sized businesses often have poor security and are the unwilling accomplices in DDoS attacks,
many ISPs are beginning to impose security restrictions on them, such as requiring firewalls to prevent
unauthorized access (firewalls are discussed later in this chapter).
11.3.3 Theft Protection
One often overlooked security risk is theft. Computers and network equipment are commonplace items
that have a good resale value. Several industry sources estimate that more than $1 billion is lost to
computer theft each year, with many of the stolen items ending up on Internet auction sites (e.g., eBay).
Physical security is a key component of theft protection. Most organizations require anyone entering
their offices to go through some level of physical security. For example, most offices have security guards
and require all visitors to be authorized by an organization employee. Universities are one of the few


and require all visitors to be authorized by an organization employee. Universities are one of the few
organizations that permit anyone to enter their facilities without verification. Therefore, you’ll see most
computer equipment and network devices protected by locked doors or security cables so that someone
cannot easily steal them (see Figure 11-9).
One of the most common targets for theft is laptop computers. More laptop computers are stolen from
employees’ homes, cars, and hotel rooms than any other device. Airports are another common place for
laptop theft. It is hard to provide physical security for traveling employees, but most organizations provide
regular reminders to their employees to take special care when traveling with laptops. Nonetheless, they
are still the most commonly stolen device.


FIGURE 11-9 Security cables protecting computers
11.3.4 Device Failure Protection
Eventually, every computer network device, cable, or leased circuit will fail. It’s just a matter of time.
Some computers, devices, cables, and circuits are more reliable than others, but every network manager
has to be prepared for failure.
The best way to prevent a failure from impacting business continuity is to build redundancy into the
network. For any network component that would have a major impact on business continuity, the network
designer provides a second, redundant component. For example, if the Internet connection is important
to the organization, the network designer ensures that there are at least two connections into the Internet
—each provided by a different common carrier so that if one common carrier’s network goes down, the
organization can still reach the Internet via the other common carrier’s network. This means, of course,
that the organization now requires two routers to connect to the Internet, because there is little use in
having two Internet connections if they both run through the same router; if that one router goes down,
having a second Internet connection provides no value.
This same design principle applies to the organization’s internal networks. If the core backbone is
important (and it usually is), then the organization must have two core backbones, each served by
different devices. Each distribution backbone that connects to the core backbone (e.g., a building
backbone that connects to a campus backbone) must also have two connections (and two routers) into the
core backbone.
The next logical step is to ensure that each access layer LAN also has two connections into the distribution
backbone. Redundancy can be expensive, so at some point, most organizations decide that not all parts of
the network need to be protected. Most organizations build redundancy into their core backbone and their


the network need to be protected. Most organizations build redundancy into their core backbone and their
Internet connections but are very careful in choosing which distribution backbones (i.e., building
backbones) and access layer LANs will have redundancy.
Only those building backbones and access LANs that are truly important will have redundancy. This is
why a risk assessment is important because it is too expensive to protect the entire network. Most
organizations only provide redundancy in mission-critical backbones and LANs (e.g., those that lead to
servers).


Redundancy also applies to servers. Most organizations use a server farm, rather than a single server so
that if one server fails, the other servers in the server farm continue to operate and there is little impact.
Some organizations use fault-tolerant servers that contain many redundant components so that if one
of its components fails, it will continue to operate.
Redundant array of independent disks (RAID) is a storage technology that, as the name suggests,
is made of many separate disk drives. When a file is written to a RAID device, it is written across several
separate, redundant disks.
There are several types of RAID. RAID 0 uses multiple disk drives and therefore is faster than traditional
storage, because the data can be written or read in parallel across several disks, rather than sequentially
on the same disk. RAID 1 writes duplicate copies of all data on at least two different disks; this means that
if one disk in the RAID array fails, there is no data loss because there is a second copy of the data stored
on a different disk. This is sometimes called disk mirroring because the data on one disk is copied (or
mirrored) onto another. RAID 2 provides error checking to ensure no errors have occurred during the
reading or writing process. RAID 3 provides a better and faster error checking process than RAID 2. RAID
4 provides slightly faster read access than RAID 3 because of the way it allocates the data to different disk
drives. RAID 5 provides slightly faster read and write access because of the way it allocates the error
checking data to different disk drives. RAID 6 can survive the failure of two drives with no data loss.
Power outages are one of the most common causes of network failures. An uninterruptible power
supply (UPS) is a device that detects power failures and permits the devices attached to it to operate as


long as its battery lasts. UPS for home use are inexpensive and often provide power for up to 15 minutes—
long enough for you to save your work and shut down your computer. UPS for large organizations often
have batteries that last for an hour and permit mission-critical servers, switches, and routers to operate
until the organization’s backup generator can be activated.
11.3.5 Disaster Protection
A disaster is an event that destroys a large part of the network and computing infrastructure in one part of
the organization. Disasters are usually caused by natural forces (e.g., hurricanes, floods, earthquakes,
fires), but some can be human-made (e.g., arson, bombs, terrorism).
Avoiding Disaster
Ideally, you want to avoid a disaster, which can be difficult. For example, how do you avoid an
earthquake? There are, however, some commonsense steps you can take to avoid the full impact of a
disaster from affecting your network. The most fundamental is again redundancy; store critical data in at
least two very different places, so if a disaster hits one place, your data are still safe.
Other steps depend on the disaster to be avoided. For example, to avoid the impact of a flood, key network
components and data should never be located near rivers or in the basement of a building. To avoid the
impact of a tornado, key network components and data should be located underground. To reduce the
impact of fire, a fire suppression system should be installed in all key data centers. To reduce the impact
of terrorist activities, the location of key network components and data should be kept a secret and should
be protected by security guards.
Disaster Recovery
A critical element in correcting problems from a disaster is the disaster recovery plan, which should
address various levels of response to a number of possible disasters and should provide for partial or


address various levels of response to a number of possible disasters and should provide for partial or
complete recovery of all data, application software, network components, and physical facilities. A
complete disaster recovery plan covering all these areas is beyond the scope of this text. Figure 11-10
provides a summary of many key issues. A good example of a disaster recovery plan is MIT’s business
continuity plan at web.mit.edu/security/www/pubplan.htm. Some firms prefer the term business
continuity plan.
A good disaster recovery plan should include the following:
The name of the decision-making manager who is in charge of the disaster recovery operation. A


second manager should be indicated in case the first manager is unavailable.
Staff assignments and responsibilities during the disaster.
A preestablished list of priorities that states what is to be fixed first.
Location of alternative facilities operated by the company or a professional disaster recovery
firm and procedures for switching operations to those facilities using backups of data and
software.
Recovery procedures for the data communication facilities (backbone network, metropolitan
area network, wide area network, and local area network), servers, and application systems.
This includes information on the location of circuits and devices, whom to contact for
information, and the support that can be expected from vendors, along with the name and
telephone number of the person at each vendor to contact.
Action to be taken in case of partial damage or threats such as bomb threats, fire, water or
electrical damage, sabotage, civil disorders, and vendor failures.
Manual processes to be used until the network is functional.
Procedures to ensure adequate updating and testing of the disaster recovery plan.
Storage of the data, software, and the disaster recovery plan itself in a safe area where they
cannot be destroyed by a catastrophe. This area must be accessible, however, to those who need
to use the plan.
FIGURE 11-10 Elements of a disaster recovery plan
The most important elements of the disaster recovery plan are backup and recovery controls that
enable the organization to recover its data and restart its application software should some portion of the
network fail. The simplest approach is to make backup copies of all organizational data and software
routinely and to store these backup copies off-site. Most organizations make daily backups of all critical
information, with less important information (e.g., email files) backed up weekly. Backups used to be
done on tapes that were physically shipped to an off-site location, but more and more, companies are


using their WAN connections to transfer data to remote locations (it’s faster and cheaper than moving
tapes). Backups should always be encrypted (encryption is discussed later in the chapter) to ensure that
no unauthorized users can access them.
Continuous data protection (CDP) is another option that firms are using in addition to or instead of
regular backups. With CDP, copies of all data and transactions on selected servers are written to CDP
servers as the transaction occurs. CDP is more flexible than traditional backups that take snapshots of
data at specific times or than disk mirroring, which duplicates the contents of a disk from second to
second. CDP enables data to be stored miles from the originating server and time-stamps all transactions
to enable organizations to restore data to any specific point in time. For example, suppose a virus brings
down a server at 2:45 p.m. The network manager can restore the server to the state it was in at 2:30 p.m.
and simply resume operations as though the virus had not hit.
Backups and CDP ensure that important data are safe, but they do not guarantee the data can be used.
The disaster recovery plan should include a documented and tested approach to recovery. The recovery
plan should have specific goals for different types of disasters. For example, if the main database server
was destroyed, how long should it take the organization to have the software and data back in operation
by using the backups? Conversely, if the main data center was completely destroyed, how long should it
take? The answers to these questions have very different implications for costs. Having a spare network
server or a server with extra capacity that can be used in the event of the loss of the primary server is one
thing. Having a spare data center ready to operate within 12 hours (for example) is an entirely different
proposition.


proposition.
Many organizations have a disaster recovery plan, but only a few test their plans. A disaster recovery
drill is much like a fire drill in that it tests the disaster recovery plan and provides staff the opportunity to
practice little-used skills to see what works and what doesn’t work before a disaster happens and the staff
must use the plan for real. Without regular disaster recovery drills, the only time a plan is tested is when it
must be used. For example, when an island-wide blackout shut down all power in Bermuda, the backup


generator in the British Caymanian Insurance office automatically took over and kept the company
operating. However, the key-card security system, which was not on the generator, shut down, locking out
all employees and forcing them to spend the day at the beach. No one had thought about the security
system and the plan had not been tested.
Organizations are usually much better at backing up important data than are individual users. When did
you last back up the data on your computer? What would you do if your computer was stolen or
destroyed? There is an inexpensive alternative to CDP for home users. Online backup services such as
mozy.com enable you to back up the data on your computer to their server on the Internet. You download
and install client software that enables you to select what folders to back up. After you back up the data for
the first time, which takes a while, the software will run every few hours and automatically back up all
changes to the server, so you never have to think about backups again. If you need to recover some or all
of your data, you can go to their website and download it.
MANAGEMENT FOCUS 11-4
Disaster Recovery Hits Home
“The building is on fire” were the first words she said as I answered the phone. It was just before
noon and one of my students had called me from her office on the top floor of the business school at
the University of Georgia. The roofing contractor had just started what would turn out to be the
worst fire in the region in more than 20 years, although we didn’t know it then. I had enough time to
gather up the really important things from my office on the ground floor (memorabilia, awards, and
pictures from 10 years in academia) when the fire alarm went off. I didn’t bother with the computer;


all the files were backed up off-site.
Ten hours, 100 firefighters, and 1.5 million gallons of water later, the fire was out. Then our work
began. The fire had completely destroyed the top floor of the building, including my 20-computer
networking lab. Water had severely damaged the rest of the building, including my office, which, I
learned later, had been flooded by almost 2 feet of water at the height of the fire. My computer and
virtually all the computers in the building were damaged by the water and unusable.
My personal files were unaffected by the loss of the computer in my office; I simply used the backups
and continued working—after making new backups and giving them to a friend to store at his house.
The Web server I managed had been backed up to another server on the opposite side of campus 2
days before (on its usual weekly backup cycle), so we had lost only 2 days’ worth of changes. In less
than 24 hours, our website was operational; I had our server’s files mounted on the university
library’s Web server and redirected the university’s DNS server to route traffic from our old server
address to our new temporary home.
Unfortunately, the rest of our network did not fare as well. The Business School’s primary Web
server had been backed up to tape the night before, and though the tapes were stored off-site, the
tape drive was not; the tape drive was destroyed and no one else on campus had one that could read
the tapes; it took 5 days to get a replacement and reestablish the website. Within 30 days we were
operating from temporary offices with a new network, and 90% of the office computers and their
data had been successfully recovered.


data had been successfully recovered.
Living through a fire changes a person. I’m more careful now about backing up my files, and I move
much more quickly when a fire alarm sounds.
Source: Alan Dennis.
Disaster Recovery Outsourcing
Most large organizations have a two-level disaster recovery plan. When they build networks, they build
enough capacity and have enough spare equipment to recover from a minor disaster such as loss of a
major server or a portion of the network (if any such disaster can truly be called minor). This is the first
level. Building a network that has sufficient capacity to quickly recover from a major disaster such as the


loss of an entire data center is beyond the resources of most firms. Therefore, most large organizations
rely on professional disaster recovery firms to provide this second-level support for major disasters.
Many large firms outsource their disaster recovery efforts by hiring disaster recovery firms that
provide a wide range of services. At the simplest, disaster recovery firms provide secure storage for
backups. Full services include a complete networked data center that clients can use when they experience
a disaster. Once a company declares a disaster, the disaster recovery firm immediately begins recovery
operations using the backups stored on-site and can have the organization’s entire data network back in
operation on the disaster recovery firm’s computer systems within hours. Full services are not cheap, but
compared to the potential millions of dollars that can be lost per day from the inability to access critical
data and application systems, these systems quickly pay for themselves in time of disaster.
11.4 INTRUSION PREVENTION
Intrusion is the second main type of security problem and the one that tends to receive the most attention.
No one wants an intruder breaking into his or her network.
Four types of intruders may attempt to gain unauthorized access to computer networks. The first are
casual intruders who have only a limited knowledge of computer security. They simply cruise along the
Internet trying to access any computer they come across. Their unsophisticated techniques are the
equivalent of trying doorknobs, and, until recently, only those networks that left their front doors
unlocked were at risk. Unfortunately, a variety of hacking tools are now available on the Internet that
enable even novices to launch sophisticated intrusion attempts. Novice attackers who use such tools are
sometimes called script kiddies.
The second type of intruders are experts in security, but their motivation is the thrill of the hunt. They


break into computer networks because they enjoy the challenge and enjoy showing off for friends or
embarrassing the network owners. These intruders are called hackers and often have a strong
philosophy against ownership of data and software. Most cause little damage and make little attempt to
profit from their exploits, but those who do can cause major problems. Hackers who cause damage are
often called crackers.
The third type of intruder is the most dangerous. They are professional hackers who break into corporate
or government computers for specific purposes, such as espionage, fraud, or intentional destruction. The
U.S. Department of Defense (DoD), which routinely monitors attacks against U.S. military targets, has
until recently concluded that most attacks are individuals or small groups of hackers in the first two
categories. While some of their attacks have been embarrassing (e.g., defacement of some military and
intelligence websites), there have been no serious security risks. However, in the late 1990s, the DoD
noticed a small but growing set of intentional attacks that they classify as exercises, exploratory attacks
designed to test the effectiveness of certain software attack weapons. Therefore, they established an
information warfare program and a new organization responsible for coordinating the defense of
military networks under the U.S. Space Command.
The fourth type of intruder is also very dangerous. These are organization employees who have legitimate
access to the network but who gain access to information they are not authorized to use. This information
could be used for their own personal gain, sold to competitors, or fraudulently changed to give the
employee extra income. Many security break-ins are caused by this type of intruder.
The key principle in preventing intrusion is to be proactive. This means routinely testing your security
systems before an intruder does. Many steps can be taken to prevent intrusion and unauthorized access to


systems before an intruder does. Many steps can be taken to prevent intrusion and unauthorized access to
organizational data and networks, but no network is completely safe. The best rule for high security is to
do what the military does: Do not keep extremely sensitive data online. Data that need special security are
stored in computers isolated from other networks. In the following sections, we discuss the most
important security controls for preventing intrusion and for recovering from intrusion when it occurs.
11.4.1 Security Policy
In the same way that a disaster recovery plan is critical to controlling risks due to disruption, destruction,
and disaster, a security policy is critical to controlling risk due to intrusion. The security policy should
clearly define the important assets to be safeguarded and the important controls needed to do that. It


should have a section devoted to what employees should and should not do. Also, it should contain a clear
plan for routinely training employees—particularly end-users with little computer expertise—on key
security rules and a clear plan for routinely testing and improving the security controls in place (Figure 11-
11). A good set of examples and templates is available at www.sans.org/resources/policies.
11.4.2 Perimeter Security and Firewalls
Ideally, you want to stop external intruders at the perimeter of your network so that they cannot reach the
servers inside. There are three basic access points into most networks: the Internet, LANs, and WLANs.
Recent surveys suggest that the most common access point for intrusion is the Internet connection (70%
of organizations experienced an attack from the Internet), followed by LANs and WLANs (30%). External
intruders are most likely to use the Internet connection, whereas internal intruders are most likely to use
the LAN or WLAN. Because the Internet is the most common source of intrusions, the focus of perimeter
security is usually on the Internet connection, although physical security is also important.
A good security policy should include the following:
The name of the decision-making manager who is in charge of security
An incident reporting system and a rapid-response team to respond to security breaches in
progress
A risk assessment with priorities as to which assets are most important
Effective controls placed at all major access points into the network to prevent or deter access by
external agents
Effective controls placed within the network to ensure that internal users cannot exceed their
authorized access
Use of minimum number of controls possible to reduce management time and to provide the
least inconvenience to users
An acceptable use policy that explains to users what they can and cannot do, including
guidelines for accessing others’ accounts, password security, email rules, and so on


guidelines for accessing others’ accounts, password security, email rules, and so on
A procedure for monitoring changes to important network components (e.g., routers, DNS
servers)
A plan to routinely train users regarding security policies and build awareness of security risks
A plan to routinely test and update all security controls that includes monitoring of popular
press and vendor reports of security holes
An annual audit and review of the security practices
FIGURE 11-11 Elements of a security policy
FIGURE 11-12 Using a firewall to protect networks
A firewall is commonly used to secure an organization’s Internet connection. A firewall is a router or
special-purpose device that examines packets flowing into and out of a network and restricts access to the
organization’s network. The network is designed so that a firewall is placed on every network connection
between the organization and the Internet (Figure 11-12). No access is permitted except through the
firewall. Some firewalls can detect and prevent denial-of-service attacks as well as unauthorized access


attempts. Three commonly used types of firewalls are packet-level firewalls, application-level firewalls,
and network address translation (NAT) firewalls.
Packet-Level Firewalls
A packet-level firewall examines the source and destination address of every network packet that
passes through it. It only allows packets into or out of the organization’s networks that have acceptable
source and destination addresses. In general, the addresses are examined only at the transport layer (TCP
port ID) and the network layer (IP address). Each packet is examined individually, so the firewall does not
know what packets came before. It simply chooses to permit entry or exit based on the contents of the
packet itself. This type of firewall is the simplest and least secure because it does not monitor the contents
of the packets or why they are being transmitted and typically does not log the packets for later analysis.
The network manager writes a set of rules (called an access control list [ACL]) for the packet-level
firewall so it knows what packets to permit into the network and what packets to deny entry. Remember
that the IP packet contains the source IP address and the destination address and that the TCP segment
has the destination port number that identifies the application-layer software to which the packet is going.
Most application layer software on servers uses standard TCP port numbers. The Web (HTTP) uses port
80, whereas email (SMTP) uses port 25.
Suppose that the organization had a public Web server with an IP address of 128.192.44.44 and an email
server with an address of 128.192.44.45 (see Figure 11-13). The network manager wants to make sure that
no one outside of the organization can change the contents of the Web server (e.g., by using telnet or
FTP). The ACL could be written to include a rule that permits the Web server to receive HTTP packets


from the Internet (but other types of packets would be discarded). For example, the rule would say if the
source address is anything, the destination IP address is 128.192.44.44, and the destination TCP port is
80, then permit the packet into the network; see the ACL on the firewall in Figure 11-13. Likewise, we
could add a rule to the ACL that would permit SMTP packets to reach the email server: If the source
address is anything, the destination is 128.192.44.45 and the destination TCP port is 25, then permit the
packet through (see Figure 11-13). The last line in the ACL is usually a rule that says to deny entry to all
other packets that have not been specifically permitted (some firewalls come automatically configured to
deny all packets other than those explicitly permitted, so this command would not be needed). With this
ACL, if an external intruder attempted to use telnet (port 23) to reach the Web server, the firewall would
deny entry to the packet and simply discard it.
Although source IP addresses can be used in the ACL, they often are not used. Most hackers have software
that can change the source IP address on the packets they send (called IP spoofing), so using the source
IP address in security rules is not usually worth the effort. Some network managers do routinely include a
rule in the ACL that denies entry to all packets coming from the Internet that have a source IP address of a
subnet inside the organization because any such packets must have a spoofed address and therefore
obviously are an intrusion attempt.


FIGURE 11-13 How packet-level firewalls work
Application-Level Firewalls
An application-level firewall is more expensive and more complicated to install and manage than a
packet-level firewall because it examines the contents of the application-level packet and searches for
known attacks (see Security Holes later in this chapter). Application-layer firewalls have rules for each
application they can process. For example, most application-level firewalls can check Web packets
(HTTP), email packets (SMTP), and other common protocols. In some cases, special rules must be written
by the organization to permit the use of application software it has developed.
Remember from Chapter 5 that TCP uses connection-oriented messaging in which a client first establishes
a connection with a server before beginning to exchange data. Application-level firewalls can use stateful
inspection, which means that they monitor and record the status of each connection and can use this
information in making decisions about what packets to discard as security threats.
Many application-level firewalls prohibit external users from uploading executable files. In this way,
intruders (or authorized users) cannot modify any software unless they have physical access to the
firewall. Some refuse changes to their software unless it is done by the vendor. Others also actively
monitor their own software and automatically disable outside connections if they detect any changes.
Network Address Translation Firewalls
Network address translation (NAT) is the process of converting between one set of public IP
addresses that are viewable from the Internet and a second set of private IP addresses that are hidden
from people outside of the organization. NAT is transparent, in that no computer knows it is happening.
Although NAT can be done for several reasons, the most common reasons are IPv4 address conservation
and security. If external intruders on the Internet can’t see the private IP addresses inside your
organization, they can’t attack your computers. Most routers and firewalls today have NAT built into


organization, they can’t attack your computers. Most routers and firewalls today have NAT built into
them, even inexpensive routers designed for home use.
The NAT firewall uses an address table to translate the private IP addresses used inside the organization
into proxy IP addresses used on the Internet. When a computer inside the organization accesses a
computer on the Internet, the firewall changes the source IP address in the outgoing IP packet to its own
address. It also sets the source port number in the TCP segment to a unique number that it uses as an
index into its address table to find the IP address of the actual sending computer in the organization’s
internal network. When the external computer responds to the request, it addresses the message to the
firewall’s IP address. The firewall receives the incoming message, and after ensuring the packet should be
permitted inside, changes the destination IP address to the private IP address of the internal computer


and changes the TCP port number to the correct port number before transmitting it on the internal
network.
This way systems outside the organization never see the actual internal IP addresses, and thus they think
there is only one computer on the internal network. Most organizations also increase security by using
private internal addresses. For example, if the organization has been assigned the Internet 128.192.55.X
address domain, the NAT firewall would be assigned an address such as 128.192.55.1. Internal computers,
however, would not be assigned addresses in the 128.192.55.X subnet. Instead, they would be assigned
unauthorized Internet addresses such as 10.3.3.55 (addresses in the 10.X.X.X domain are not assigned to
organizations but instead are reserved for use by private intranets). Because these internal addresses are
never used on the Internet but are always converted by the firewall, this poses no problems for the users.
Even if attackers discover the actual internal IP address, it would be impossible for them to reach the
internal address from the Internet because the addresses could not be used to reach the organization’s
computers.
Firewall Architecture
Many organizations use layers of NAT, packet-level, and application-level firewalls (Figure 11-14). Packet-
level firewalls are used as an initial screen from the Internet into a network devoted solely to servers
intended to provide public access (e.g., Web servers, public DNS servers). This network is sometimes
called the DMZ (demilitarized zone). DMZ is a physical or logical subnetwork that exposes an
organization’s external-facing servers (such as Web Server, DNS Server, Mail Server) to the Internet. The
primary purpose of the DMZ is to provide another layer of security to the LAN. Therefore, the packet-level


firewall in front of the DMZ will permit Web requests and similar access to the DMZ network servers but
will deny FTP access, for example, to these servers from the Internet because no one except internal users
should have the right to modify the servers. Each major portion of the organization’s internal networks
has its own NAT firewall to grant (or deny) access based on rules established by that part of the
organization.
This figure also shows how a packet sent by a client computer inside one of the internal networks
protected by a NAT firewall would flow through the network. The packet created by the client has the
client’s source address and the source port number of the process on the client that generated the packet
(an HTTP packet going to a Web server, as you can tell from the destination port address of 80). When the
packet reaches the firewall, the firewall changes the source address on the IP packet to its own address
and changes the source port number to an index it will use to identify the client computer’s address and
port number. The destination address and port number are unchanged. The firewall then sends the packet
on its way to the destination. When the destination Web server responds to this packet, it will respond
using the firewall’s address and port number. When the firewall receives the incoming packets, it will use
the destination port number to identify what IP address and port number to use inside the internal
network, change the inbound packet’s destination and port number, and send it into the internal network
so it reaches the client computer.
Physical Security
One important element to prevent unauthorized users from accessing an internal LAN is physical
security: preventing outsiders from gaining access into the organization’s offices, server room, or network
equipment facilities. Both main and remote physical facilities should be secured adequately and have the
proper controls. Good security requires implementing the proper access controls so that only authorized


proper controls. Good security requires implementing the proper access controls so that only authorized
personnel can enter closed areas where servers and network equipment are located or access the network.
The network components themselves also have a level of physical security. Computers can have locks on
their power switches or passwords that disable the screen and keyboard.


FIGURE 11-14 A typical network design using firewalls
In the previous section, we discussed the importance of locating backups and servers at separate (off-site)
locations. Some companies have also argued that by having many servers in different locations, you can
reduce your risk and improve business continuity. Does having many servers disperse risk, or does it
increase the points of vulnerability? A clear disaster recovery plan with an off-site backup and server
facility can disperse risk, like distributed server systems. Distributed servers offer many more physical
vulnerabilities to an attacker: more machines to guard, upgrade, patch, and defend. Many times these
dispersed machines are all part of the same logical domain, which means that breaking into one of them
often can give the attacker access to the resources of the others. It is our feeling that a well-backed-up,
centralized data center can be made inherently more secure than a proliferated base of servers.
Proper security education, background checks, and the implementation of error and fraud controls are
also very important. In many cases, the simplest means to gain access is to become employed as a janitor
and access the network at night. In some ways this is easier than the previous methods because the
intruder only has to insert a listening device or computer into the organization’s network to record
messages. Three areas are vulnerable to this type of unauthorized access: wireless LANs, network cabling,
and network devices.
Wireless LANs are the easiest target for eavesdropping because they often reach beyond the physical
walls of the organization. Chapter 7 discussed the techniques of WLAN security, so we do not repeat them
here.
Network cables are the next easiest target for eavesdropping because they often run long distances and
usually are not regularly checked for tampering. The cables owned by the organization and installed


within its facility are usually the first choice for eavesdropping. It is 100 times easier to tap a local cable
than it is to tap an interexchange channel because it is extremely difficult to identify the specific circuits
belonging to any one organization in a highly multiplexed switched interexchange circuit operated by a
common carrier. Local cables should be secured behind walls and above ceilings, and telephone
equipment and switching rooms (wiring closets) should be locked and their doors equipped with alarms.
The primary goal is to control physical access by employees or vendors to the connector cables and
modems. This includes restricting their access to the wiring closets in which all the communication wires
and cables are connected.
TECHNICAL FOCUS 11-3
Data Security Requires Physical Security
The general consensus is that if someone can physically get to your server for some period of time,
then all of your information on the computer (except perhaps strongly encrypted data) is available to
the attacker.
With a Windows server, the attacker simply boots the computer from the CD drive with a Knoppix
version of Linux. (Knoppix is Linux on a CD.) If the computer won’t boot from the CD, the attacker
simply changes the BIOS to make it boot from the CD. Knoppix finds all the drivers for the specific
computer and gives you a Linux desktop that can fully read all of the NTFS or FAT32 files.
But what about Windows password access? Nothing to it. Knoppix completely bypasses it. The
attacker can then read, copy, or transmit any of the files on the Windows machine. Similar attacks
are also possible on a Linux or Unix server, but they are slightly more difficult.
Certain types of cable can impair or increase security by making eavesdropping easier or more difficult.


Obviously, any wireless network is at extreme risk for eavesdropping because anyone in the area of the
transmission can easily install devices to monitor the radio or infrared signals. Conversely, fiber-optic
cables are harder to tap, thus increasing security. Some companies offer armored cable that is virtually
impossible to cut without special tools. Other cables have built-in alarm systems. The U.S. Air Force, for
example, uses pressurized cables that are filled with gas. If the cable is cut, the gas escapes, pressure
drops, and an alarm is sounded.
Network devices such as switches and routers should be secured in a locked wiring closet. As discussed in
Chapter 7, all messages within a given local area network are actually received by all computers on the
WLAN, although they only process those messages addressed to them. It is rather simple to install a
sniffer program that records all messages received for later (unauthorized) analysis. A computer with a
sniffer program could then be plugged into an unattended switch to eavesdrop on all message traffic. A
secure switch makes this type of eavesdropping more difficult by requiring a special authorization code
to be entered before new computers can be added.
11.4.3 Server and Client Protection
Security Holes
Even with physical security and firewalls, the servers and client computers on a network may not be safe
because of security holes. A security hole is simply a bug that permits unauthorized access. Many
commonly used operating systems have major security holes well known to potential intruders. Many
security holes have been documented and “patches” are available from vendors to fix them, but network
managers may be unaware of all the holes or simply forget to update their systems with new patches
regularly.
A complete discussion of security holes is beyond the scope of this book. Many security holes are highly


A complete discussion of security holes is beyond the scope of this book. Many security holes are highly
technical; for example, sending a message designed to overflow a memory buffer, thereby placing a short
command into a very specific memory area that performs some function. Others are rather simple, but not
obvious. For example, the attacker sends a message that lists the server’s address as both the sender and


the destination, so the server repeatedly sends messages to itself until it crashes.
MANAGEMENT FOCUS 11-5
Fake Antivirus?
The world of computer viruses is constantly evolving and becoming more and more advanced. At the
beginning of Internet, viruses were designed to do funny things (such as turn text on your screen
upside down), but today they are designed to get your money and private information. Once a virus
is installed on a computer, it will interact with a remote computer and transfer sensitive data to that
computer. Antivirus software was developed to prevent viruses from being installed on computers.
However, not all antivirus software is made equal.
There are many antivirus software companies that offer to scan your computer for free. Yes, for free!
An old saying relates that if something sounds too good to be true, it probably is. Free antivirus
software is not an exception. Chester Wisniewky, at SophosLabs, explains that once you have
downloaded a free antivirus on to your computer, you have actually downloaded malware. Once you
launch this software on your computer, it looks and behaves like a legitimate antivirus. Many of
these free antivirus software packages are fully multilingual. The software has a very user-friendly
GUI (graphical user interface) that looks and behaves like a legitimate antivirus. However, once you
start scanning your computer, it will mark legitimate files on your computer as worms and Trojans
and will give you a warning that your computer is infected. A regular user gets scared at this point
and allows the software to remove the infected files. What is really happening is that malware is
installed on your computer that will scan for any sensitive information and send this information to
a host.
Rather than trying to get a free antivirus, spend money on a legitimate product such as Sophos,


Symantec, or McAfee. Popular news magazines, such as PC Magazine, provide annual reviews of
legitimate antivirus software and also the free antivirus. Your best protection against exploits of this
kind is education.
Sources: “Which Antivirus Is the Best” (www. pcantivirusreviews.com); “Fake Antivirus: What Are They and How Do You Avoid
Them?” by Cassie Bodnar (blog.kaspersky.com).
Once a security hole is discovered, it is quickly circulated through the Internet. The race begins between
hackers and security teams; hackers share their discovery with other hackers and security teams share the
discovery with other security teams. CERT is the central clearinghouse for major Internet-related security
holes, so the CERT team quickly responds to reports of new security problems and posts alerts and
advisories on the Web and emails them to those who subscribe to its service. The developer of the
software with the security hole usually works quickly to fix the security hole and produces a patch that
corrects the hole. This patch is then shared with customers so they can download and apply it to their
systems to prevent hackers from exploiting the hole to break in. Attacks that take advantage of a newly
discovered security hole before a patch is developed are called zero-day attacks. One problem is that
many network managers do not routinely respond to such security threats and immediately download and
install the patch. Often it takes many months for patches to be distributed to most sites. Do you regularly
install all the Windows or Mac updates on your computer?
Other security holes are not really holes but simply policies adopted by computer vendors that open the
door for security problems, such as computer systems that come with a variety of preinstalled user
accounts. These accounts and their initial passwords are well documented and known to all potential
attackers. Network managers sometimes forget to change the passwords on these well-known accounts,


attackers. Network managers sometimes forget to change the passwords on these well-known accounts,
thus enabling an attacker to slip in.
Operating Systems
The American government requires certain levels of security in the operating systems and network
operating systems it uses for certain applications. The minimum level of security is C2. Most major
operating systems (e.g., Windows) provide at least C2. Most widely used systems are striving to meet the


requirements of much higher security levels such as B2. Very few systems meet the highest levels of
security (A1 and A2).
There has been a long running debate about whether the Windows operating system is less secure than
other operating systems such as Linux. Every new attack on Windows systems ignites the debate;
Windows detractors repeat “I told you so” while Windows defenders state that this happens mostly
because Windows is the obvious system to attack since it is the most commonly used operating system
and because of the hostility of the Windows detractors themselves.
There is a critical difference in what applications can do in Windows and in Linux. Linux (and its ancestor
Unix) was first written as a multiuser operating system in which different users had different rights. Only
some users were system administrators and had the rights to access and make changes to the critical parts
of the operating system. All other users were barred from doing so.
TECHNICAL FOCUS 11-4
Exploiting a Security Hole
To exploit a security hole, the hacker has to know it’s there. So how does a hacker find out? It’s
simple in the era of automated tools.
First, the hacker has to find the servers on a network. The hacker could start by using network
scanning software to systematically probe every IP address on a network to find all the servers on the
network. At this point, the hacker has narrowed the potential targets to a few servers.
Second, the hacker needs to learn what services are available on each server. To do this, he or she
could use port scanning software to systematically probe every TCP/IP port on a given server. This
would reveal which ports are in use and thus what services the server offers. For example, if the
server has software that responds to port 80, it is a Web server, while if it responds to port 25, it is a


mail server.
Third, the hacker would begin to seek out the exact software and version number of the server
software providing each service. For example, suppose the hacker decides to target mail servers.
There are a variety of tools that can probe the mail server software, and based on how the server
software responds to certain messages, determine which manufacturer and version number of
software is being used.
Finally, once the hacker knows which package and version number the server is using, the hacker
uses tools designed to exploit the known security holes in the software. For example, some older mail
server software packages do not require users to authenticate themselves (e.g., by a user id and
password) before accepting SMTP packets for the mail server to forward. In this case, the hacker
could create SMTP packets with fake source addresses and use the server to flood the Internet with
spam (i.e., junk mail). In another case, a certain version of a well-known e-commerce package
enabled users to pass operating system commands to the server simply by including a UNIX pipe
symbol (|) and the command to the name of a file name to be uploaded; when the system opened the
uploaded file, it also executed the command attached to it.
In contrast, Windows (and its ancestor DOS) was first written as an operating system for a single personal
computer, an environment in which the user was in complete control of the computer and could do
anything he or she liked. As a result, Windows applications regularly access and make changes to critical
parts of the operating system. There are advantages to this. Windows applications can do many powerful
things without the user needing to understand them. These applications can be very rich in features, and,
more important, they can appear to the user to be very friendly and easy to use. Everything appears to run


“out-of-the-box” without modification. Windows has built these features into the core of their systems.
Any major rewrite of Windows to prevent this would most likely cause significant incompatibilities with
all applications designed to run under previous versions of Windows. To many, this would be a high price
to pay for some unseen benefits called “security.”


But there is a price for this friendliness. Hostile applications can easily take over the computer and
literally do whatever they want without the user knowing. Simply put, there is a trade-off between ease of
use and security. Increasing needs for security demand more checks and restrictions, which translates
into less friendliness and fewer features. It may very well be that there is an inherent and permanent
contradiction between the ease of use of a system and its security.
Trojan Horses
One important tool in gaining unauthorized access is a Trojan horse. Trojans are remote access
management consoles (sometimes called rootkits) that enable users to access a computer and manage it
from afar. If you see free software that will enable you to control your computer from anywhere, be
careful; the software may also permit an attacker to control your computer from anywhere! Trojans are
more often concealed in other software that unsuspecting users download over the Internet (their name
alludes to the original Trojan horse). Music and video files shared on Internet music sites are common
carriers of Trojans. When the user downloads and plays a music file, it plays normally and the attached
Trojan software silently installs a small program that enables the attacker to take complete control of the
user’s computer, so the user is unaware that anything bad has happened. The attacker then simply
connects to the user’s computer and has the same access and controls as the user. Many Trojans are
completely undetectable by the very best antivirus software.
One of the first major Trojans was Back Orifice, which aggressively attacked Windows servers. Back
Orifice gave the attacker the same functions as the administrator of the infected server, and then some:
complete file and network control, device and registry access, with packet and application redirection. It
was every administrator’s worst nightmare, and every attacker’s dream.


was every administrator’s worst nightmare, and every attacker’s dream.
More recently, Trojans have morphed into tools such as MoSucker and Optix Pro. These attack consoles
now have one-button clicks to disable firewalls, antivirus software, and any other defensive process that
might be running on the victim’s computer. The attacker can choose what port the Trojan runs on, what it
is named, and when it runs. They can listen in to a computer’s microphone or look through an attached
camera—even if the device appears to be off. Figure 11-15 shows a menu from one Trojan that illustrates
some of the “fun stuff” that an attacker can do, such as opening and closing the CD tray, beeping the
speaker, or reversing the mouse buttons so that clicking on the left button actually sends a right click.
Not only have these tools become powerful, but they are also very easy to use—much easier to use than the
necessary defensive countermeasures to protect oneself from them. And what does the near future hold
for Trojans? We can easily envision Trojans that schedule themselves to run at, say 2:00 a.m., choosing a
random port, emailing the attacker that the machine is now “open for business” at port # NNNNN. The
attackers can then step in, do whatever they want to do, run a script to erase most of their tracks, and then
sign out and shut off the Trojan. Once the job is done, the Trojan could even erase itself from storage.
Scary? Yes. And the future does not look better.


FIGURE 11-15 One menu on the control console for the Optix Pro Trojan
Spyware, adware, and DDoS agents are three types of Trojans. DDoS agents were discussed in the
previous section. As the name suggests, spyware monitors what happens on the target computer. Spyware
can record keystrokes that appear to be userids and passwords so the intruder can gain access to the user’s
account (e.g., bank accounts). Adware monitors a user’s actions and displays pop-up advertisements on
the user’s screen. For example, suppose you clicked on the website for an online retailer. Adware might
pop-up a window for a competitor, or, worse still, redirect your browser to the competitor’s website. Many
antivirus software packages now routinely search for and remove spyware, adware, and other Trojans and
special-purpose antispyware software is available (e.g., Spybot). Some firewall vendors are now adding
anti-Trojan logic to their devices to block any transmissions from infected computers from entering or
leaving their networks.
11.4.4 Encryption
One of the best ways to prevent intrusion is encryption, which is a means of disguising information by
the use of mathematical rules known as algorithms. Actually, cryptography is the more general and
proper term. Encryption is the process of disguising information, whereas decryption is the process of
restoring it to readable form. When information is in readable form, it is called plaintext; when in
encrypted form, it is called ciphertext.
Encryption can be used to encrypt files stored on a computer or to encrypt data in transit between
computers. Many firms use both because encrypting files is done using a simple setting on the operating
system. For example, if you use Windows, you can encrypt your data to protect it if your laptop is stolen.


Likewise, most websites use encryption on data in transit either by using VPNs (see Chapter 10) or using
encrypted Web protocols such as HTTPS.
There are two fundamentally different types of encryption: symmetric and asymmetric. With symmetric


encryption, the key used to encrypt a message is the same as the one used to decrypt it. With
asymmetric encryption, the key used to decrypt a message is different from the key used to encrypt it.
MANAGEMENT FOCUS 11-6
Ransomware Becomes Profitable
Ransomware is a special type of malware that takes a victim’s data hostage and demands a ransom
to release it. It usually begins when a user downloads a file containing the ransomware or runs a
script on a website. The ransomware encrypts all the files on the victim’s computer with a key
unknown to the victim, so he or she cannot access the files. The attacker then demands a ransom
that must be paid within a day or two or all the files will be deleted.
The ransom is usually a modest amount (e.g., $750) so that the victim is more likely to pay it than
attempt to try to fix the problem. The ransom is often paid in bitcoins to the attacker in a country
that does not prosecute computer criminals.
Most victims are individual users, because they are less sophisticated than companies and it is easier
to extort money from an individual than a company. Nonetheless, ransomware attackers have
targeted servers owned by a variety of small- and medium-sized businesses and demanded higher
ransom amounts. Professional service firms such as doctors, dentists, and lawyers have been
increasingly targeted, presumably because they have more to lose and can afford to pay higher
ransoms.
The FBI estimates that U.S. firms suffer losses of about $1 billion per year, once you factor in the cost
to re-create data and recover from the damage done, including lost business. Most ransomware
attacks are not reported to the FBI, and the FBI only considers attacks on U.S. firms, so this is only
the tip of the iceberg.
Single-Key Encryption


the tip of the iceberg.
Single-Key Encryption
Symmetric encryption (also called single-key encryption) has two parts: the algorithm and the key,
which personalizes the algorithm by making the transformation of data unique. Two pieces of identical
information encrypted with the same algorithm but with different keys produce completely different
ciphertexts. With symmetric encryption, the communicating parties must share the one key. If the
algorithm is adequate and the key is kept secret, acquisition of the ciphertext by unauthorized personnel is
of no consequence to the communicating parties.
Good encryption systems do not depend on keeping the algorithm secret. Only the keys need to be kept
secret. The key is a relatively small numeric value (in terms of the number of bits). The larger the key, the
more secure the encryption because large “key space” protects the ciphertext against those who try to
break it by brute-force attacks—which simply means trying every possible key.
There should be a large enough number of possible keys that an exhaustive brute-force attack would take
inordinately long or would cost more than the value of the encrypted information. Because the same key is
used to encrypt and decrypt, symmetric encryption can cause problems with key management; keys
must be shared among the senders and receivers very carefully. Before two computers in a network can
communicate using encryption, both must have the same key. This means that both computers can then
send and read any messages that use that key. Companies often do not want one company to be able to
read messages they send to another company, so this means that there must be a separate key used for
communication with each company. These keys must be recorded but kept secure so that they cannot be
stolen. Because the algorithm is known publicly, the disclosure of the key means the total compromise of
encrypted messages. Managing this system of keys can be challenging.


encrypted messages. Managing this system of keys can be challenging.
One commonly used symmetric encryption technique is the Data Encryption Standard (DES), which
was developed in the mid-1970s by the U.S. government in conjunction with IBM. DES is standardized by
the National Institute of Standards and Technology (NIST). The most common form of DES uses a 56-bit
key, which experts can break in less than a day (i.e., experts with the right tools can figure out what a


message encrypted using DES says without knowing the key in less than 24 hours). DES is no longer
recommended for data needing high security, although some companies continue to use it for less
important data.
Triple DES (3DES) is a newer standard that is harder to break. As the name suggests, it involves using
DES three times, usually with three different keys to produce the encrypted text, which produces a
stronger level of security because it has a total of 168 bits as the key (i.e., 3 times 56 bits).
The NIST’s new standard, called Advanced Encryption Standard (AES), has replaced DES. AES has
key sizes of 128, 192, and 256 bits. NIST estimates that using the most advanced computers and
techniques available today, it will require about 150 trillion years to crack AES by brute force. As
computers and techniques improve, the time requirement will drop, but AES seems secure for the
foreseeable future; the original DES lasted 20 years, so AES may have a similar life span.
Another commonly used symmetric encryption algorithm is RC4, developed by Ron Rivest of RSA Data
Security, Inc. RC4 can use a key up to 256 bits long but most commonly uses a 40-bit key. It is faster to
use than DES but suffers from the same problems from brute-force attacks: Its 40-bit key can be broken
by a determined attacker in a day or two.
Today, the U.S. government considers encryption to be a weapon and regulates its export in the same way
it regulates the export of machine guns or bombs. Present rules prohibit the export of encryption
techniques with keys longer than 64 bits without permission, although exports to Canada and the
European Union are permitted, and American banks and Fortune 100 companies are now permitted to


European Union are permitted, and American banks and Fortune 100 companies are now permitted to
use more powerful encryption techniques in their foreign offices. This policy made sense when only
American companies had the expertise to develop powerful encryption software. Today, however, many
non-American companies are developing encryption software that is more powerful than American
software that is limited only by these rules. Therefore, the American software industry is lobbying the
government to change the rules so that they can successfully compete overseas.
Public Key Encryption
The most popular form of asymmetric encryption (also called public key encryption) is RSA, which
was invented at MIT in 1977 by Rivest, Shamir, and Adleman, who founded RSA Data Security in 1982.
The patent expired in 2000, so many new companies entered the market and public key software dropped
in price. The RSA technique forms the basis for today’s public key infrastructure (PKI).
Public key encryption is inherently different from symmetric single-key systems like DES. Because public
key encryption is asymmetric, there are two keys. One key (called the public key) is used to encrypt the
message and a second, very different private key is used to decrypt the message. Keys are often 512 bits,
1,024 bits, or 2,048 bits in length.
Public key systems are based on one-way functions. Even though you originally know both the contents of
your message and the public encryption key, once it is encrypted by the one-way function, the message
cannot be decrypted without the private key. One-way functions, which are relatively easy to calculate in
one direction, are impossible to “uncalculate” in the reverse direction. Public key encryption is one of the
most secure encryption techniques available, excluding special encryption techniques developed by
national security agencies.
Public key encryption greatly reduces the key management problem. Each user has its public key that is


Public key encryption greatly reduces the key management problem. Each user has its public key that is
used to encrypt messages sent to it. These public keys are widely publicized (e.g., listed in a telephone-
book-style directory)—that’s why they’re called “public” keys. In addition, each user has a private key that
decrypts only the messages that were encrypted by its public key. This private key is kept secret (that’s
why it’s called the “private” key). The net result is that if two parties wish to communicate with each other,
there is no need to exchange keys beforehand. Each knows the other’s public key from the listing in a
public directory and can communicate encrypted information immediately. The key management problem
is reduced to the on-site protection of the private key.


FIGURE 11-16 Secure transmission with public key encryption
Figure 11-16 illustrates how this process works. All public keys are published in a directory. When
Organization A wants to send an encrypted message to Organization B, it looks through the directory to
find its public key. It then encrypts the message using B’s public key. This encrypted message is then sent
through the network to Organization B, which decrypts the message using its private key.
Authentication
Public key encryption also permits the use of digital signatures through a process of authentication.
When one user sends a message to another, it is difficult to legally prove who actually sent the message.
Legal proof is important in many communications, such as bank transfers and buy/sell orders in currency
and stock trading, which normally require legal signatures. Public key encryption algorithms are
invertible, meaning that text encrypted with either key can be decrypted by the other. Normally, we
encrypt with the public key and decrypt with the private key. However, it is possible to do the inverse:
encrypt with the private key and decrypt with the public key. Because the private key is secret, only the
real user could use it to encrypt a message. Thus, a digital signature or authentication sequence is used as
a legal signature on many financial transactions. This signature is usually the name of the signing party
plus other key-contents such as unique information from the message (e.g., date, time, or dollar amount).
This signature and the other key-contents are encrypted by the sender using the private key. The receiver
uses the sender’s public key to decrypt the signature block and compares the result to the name and other
key contents in the rest of the message to ensure a match.


FIGURE 11-17 Authenticated and secure transmission with public key encryption
Figure 11-17 illustrates how authentication can be combined with public encryption to provide a secure
and authenticated transmission with a digital signature. The plaintext message is first encrypted using
Organization A’s private key and then encrypted using the Organization’s B public key. It is then


transmitted to B. Organization B first decrypts the message using its private key. It sees that part of the
message (the key-contents) is still in ciphertext, indicating it is an authenticated message. B then decrypts
the key-contents part of the message using A’s public key to produce the plaintext message. Since only A
has the private key that matches A’s public key, B can safely assume that A sent the message.
The only problem with this approach lies in ensuring that the person or organization who sent the
document with the correct private key is actually the person or organization it claims to be. Anyone can
post a public key on the Internet, so there is no way of knowing for sure who they actually are. For
example, it would be possible for someone to create a website and claim to be “Organization A” when in
fact the person is really someone else.
This is where the Internet’s PKI becomes important. The PKI is a set of hardware, software, organizations,
and polices designed to make public key encryption work on the Internet. PKI begins with a certificate
authority (CA), which is a trusted organization that can vouch for the authenticity of the person or
organization using authentication (e.g., VeriSign). A person wanting to use a CA registers with the CA and
must provide some proof of identity. There are several levels of certification, ranging from a simple
confirmation from a valid email address to a complete police-style background check with an in-person
interview. The CA issues a digital certificate that is the requestor’s public key encrypted using the CA’s
private key as proof of identity. This certificate is then attached to the user’s email or Web transactions, in
addition to the authentication information. The receiver then verifies the certificate by decrypting it with


addition to the authentication information. The receiver then verifies the certificate by decrypting it with
the CA’s public key—and must also contact the CA to ensure that the user’s certificate has not been
revoked by the CA.
For higher security certifications, the CA requires that a unique “fingerprint” be issued by the CA for each
message sent by the user. The user submits the message to the CA, who creates the unique fingerprint by
combining the CA’s private key with the message’s authentication key contents. Because the user must
obtain a unique fingerprint for each message, this ensures that the CA has not revoked the certificate
between the time it was issued and the time the message was sent by the user.
Encryption Software
Pretty Good Privacy (PGP) is a freeware public key encryption package developed by Philip
Zimmermann that is often used to encrypt email. Users post their public key on Web pages, for example,
and anyone wishing to send them an encrypted message simply cuts and pastes the key off the Web page
into the PGP software, which encrypts and sends the message.
Secure Sockets Layer (SSL) is an encryption protocol widely used on the Web. It operates between the
application-layer software and the transport layer (in what the OSI model calls the presentation layer).
SSL encrypts outbound packets coming out of the application layer before they reach the transport layer
and decrypts inbound packets coming out of the transport layer before they reach the application layer.
With SSL, the client and the server start with a handshake for PKI authentication and for the server to
provide its public key and preferred encryption technique to the client (usually RC4, DES, 3DES, or AES).
The client then generates a key for this encryption technique, which is sent to the server encrypted with
the server’s public key. The rest of the communication then uses this encryption technique and key.


the server’s public key. The rest of the communication then uses this encryption technique and key.
IP Security Protocol (IPSec) is another widely used encryption protocol. IPSec differs from SSL in
that SSL is focused on Web applications, whereas IPSec can be used with a much wider variety of
application layer protocols. IPSec sits between IP at the network layer and TCP/UDP at the transport
layer. IPSec can use a wide variety of encryption techniques, so the first step is for the sender and receiver
to establish the technique and key to be used. This is done using the Internet Key Exchange (IKE).
Both parties generate a random key and send it to the other using an encrypted authenticated PKI
process, and then put these two numbers together to produce the key. The encryption technique is also
negotiated between the two, often being 3DES. Once the keys and techniques have been established, IPSec
can begin transmitting data.
IP Security Protocol can operate in either transport mode or tunnel mode for VPNs. In IPSec transport
mode, IPSec encrypts just the IP payload, leaving the IP packet header unchanged so it can be easily
routed through the Internet. In this case, IPSec adds an additional packet (either an Authentication
Header [AH] or an Encapsulating Security Payload [ESP]) at the start of the IP packet that provides
encryption information for the receiver.


In IPSec tunnel mode, IPSec encrypts the entire IP packet and must, therefore, add an entirely new IP
packet that contains the encrypted packet as well as the IPSec AH or ESP packets. In tunnel mode, the
newly added IP packet just identifies the IPSec encryption agent at the next destination, not the final
destination; once the IPSec packet arrives at the encryption agent, the encrypted packet is VPN decrypted
and sent on its way. In tunnel mode, attackers can only learn the endpoints of the VPN tunnel, not the
ultimate source and destination of the packets.
11.4.5 User Authentication
Once the network perimeter and the network interior have been secured, the next step is to ensure that
only authorized users are permitted into the network and into specific resources in the interior of the
network. This is called user authentication.
The basis of user authentication is the user profile for each user’s account that is assigned by the
network manager. Each user’s profile specifies what data and network resources he or she can access and
the type of access (read-only, write, create, delete).
User profiles can limit the allowable log-in days, time of day, physical locations, and the allowable number
of incorrect log-in attempts. Some will also automatically log a user out if that person has not performed
any network activity for a certain length of time (e.g., the user has gone to lunch and has forgotten to log
off the network). Regular security checks throughout the day when the user is logged in can determine
whether a user is still permitted access to the network. For example, the network manager might have
disabled the user’s profile while the user is logged in, or the user’s account may have run out of funds.
Creating accounts and profiles is simple. When a new staff member joins an organization, that person is


Creating accounts and profiles is simple. When a new staff member joins an organization, that person is
assigned a user account and profile. One security problem is the removal of user accounts when someone
leaves an organization. Often, network managers are not informed of the departure and accounts remain
in the system. For example, an examination of the user accounts at the University of Georgia found 30%
belonged to staff members no longer employed by the university. If the staff member’s departure was not
friendly, there is a risk that he or she may attempt to access data and resources and use them for personal
gain, or destroy them to get back at the organization. Many systems permit the network manager to assign
expiration dates to user accounts to ensure that unused profiles are automatically deleted or deactivated,
but these actions do not replace the need to notify network managers about an employee’s departure as
part of the standard human resources procedures.
TECHNICAL FOCUS 11-5
Cracking a Password
To crack Windows passwords, you just need to get a copy of the security account manager (SAM) file
in the WINNT directory, which contains all the Windows passwords in an encrypted format. If you
have physical access to the computer, that’s sufficient. If not, you might be able to hack in over the
network. Then, you just need to use a Windows-based cracking tool such as L0phtCrack. Depending
on the difficulty of the password, the time needed to crack the password via brute force could take
minutes or up to a day.
Or that’s the way it used to be. Recently the Cryptography and Security Lab in Switzerland
developed a new password-cracking tool that relies on very large amounts of RAM. It then does
indexed searches of possible passwords that are already in memory. This tool can cut cracking times


indexed searches of possible passwords that are already in memory. This tool can cut cracking times
to less than 1/10 of the time of previous tools. Keep adding RAM and mHertz and you could reduce
the crack times to 1/100 that of the older cracking tools. This means that if you can get your hands
on the Windows-encrypted password file, then the game is over. It can literally crack complex
passwords in Windows in seconds.
It’s different for Linux, Unix, or Apple computers. These systems insert a 12-bit random “salt” to the
password, which means that cracking their passwords will take 4,096 (2^12) times longer to do. That
margin is probably sufficient for now, until the next generation of cracking tools comes along.
Maybe.


So what can we say from all of this? That you are 4,096 times safer with Linux? Well, not necessarily.
But what we may be able to say is that strong password protection, by itself, is an oxymoron. We
must combine it with other methods of security to have reasonable confidence in the system.
MANAGEMENT FOCUS 11-7
Making Strong Passwords
The keys to users’ accounts are passwords—we all know this. But most people are more worried
about forgetting a password than about having someone break-in to their computer account because
the risk of forgetting is more real—we’ve all forgotten a password. The risk of a break-in is less real
because most people haven’t had someone break-in. As a result, most people choose passwords that
are easy to remember, rather than secure passwords.
Research shows that the most commonly used passwords are as follows:
The word “password”
Keyboard patterns such as “qwerty” and “12345678”
Sports such as “football” and “baseball”
Names from movies such as “gandolf” and “leia”
Other common passwords are related to the individual, such as names of the person’s spouse,
children or pets, important numbers such as birthdays or phone numbers, or place names such as
cities. We often reuse the same password at different websites.
The stronger the password, the more secure your account. But what does it mean to have a “strong”
password? Some organizations impose rules for passwords, such as requiring uppercase letters,
numbers, and special characters. Does this make for stronger passwords?
It turns out that making strong passwords is simple. Strong passwords are long passwords. Length
matters and everything else is really not that important. The strongest password is actually a
passphrase that contains at least 20 characters. You can increase the strength by adding a few