Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

6

|

Chapter 1: Threat Modeling and Risk Management

Threats

Who might attack your system, network, or data? Cohen et al,

*

in their scheme for

classifying information security threats, provide a list of actors (threats), which illus-

trates the variety of attackers that any networked system faces. These attackers

include the mundane (insiders, vandals, maintenance people, and nature), the sensa-

tional (drug cartels, paramilitary groups, and extortionists), and all points in

between.

As you consider potential attackers, consider two things. First, almost every type of

attacker presents some level of threat to every Internet-connected computer. The

concepts of distance, remoteness, and obscurity are radically different on the Inter-

net than in the physical world, in terms of how they apply to escaping the notice of

random attackers. Having an “uninteresting” or “low-traffic” Internet presence is no

protection at all against attacks from strangers.

For example, the level of threat that drug cartels present to a hobbyist’s basement

web server is probably minimal but shouldn’t be dismissed altogether. Suppose a sys-

tem cracker in the employ of a drug cartel wishes to target FBI systems via inter-

mediary (compromised) hosts to make his attacks harder to trace.

Arguably, this particular scenario ...