Network and Data Security for Non-Engineers

Network and Data Security for Non-Engineers

by Frank M. Groom, Kevin Groom, Stephan S. Jones
Released August 2016
Publisher(s): Auerbach Publications
ISBN: 9781315350219

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

Learn network and data security by analyzing the Anthem breach and step-by-step how hackers gain entry, place hidden software, download information, and hide the evidence of their entry. Understand the tools, establishing persistent presence, use of sites as testbeds to determine successful variations of software that elude detection, and reaching out across trusted connections to the entire healthcare system of the nation. Examine the components of technology being diverted, starting with application code and how to protect it with isolation approaches. Dissect forms of infections including viruses, worms, bots, and Trojans; and encryption with RSA algorithm as the working example.

Table of contents

  1. Cover
  2. Half Title
  3. Title Page
  4. Copyright Page
  5. Table of Contents
  6. Preface
  7. Authors
  8. 1 Introduction to Security Threats
  9. 2 The 2014–2015 Anthem Blue Cross and Blue Shield Break-In Case Study
    1. Step 1: Reconnaissance
    2. Step 2: Picking the Right Target and Spear Phishing Them
      1. Spear Phishing
      2. Waterholes
    3. Step 3: Initial System Entry
    4. Next Steps to Establish an Undetectable Anonymous Persistent Presence
    5. Password Decryption Process and Equipment
    6. Testbed
    7. Final Steps
    8. Tools Used by Hackers to Acquire Valid Entry Credentials and Tools Used by Security Personnel to Detect Activity and Malware and Protect the Stored Data
      1. Tool 1: Initial Spear-Phishing Entry Leading to the ScanBox Keystroke Logger
      2. Tool 2: Setting Up an Anonymous Path Using Tor
      3. Tool 3: CrowdStrike Identified Hacker Clusters, China Chopper Web-Shell Controller
        1. CrowdStrike’s Identified Hacking Clusters
        2. China Chopper Web Shell Controller
        3. Types of Common Monitoring Software Employed
        4. Looking for Derusbi Parsing Software
        5. RSA’s ECAT Scanning Software
        6. Yara’s Operation
  10. 3 Anonymous Persistent Threats
    1. Rivest–Shamir–Adleman (RSA) Identified Shell Crew
    2. Kaspersky Lab Has Identified a Recent Attack Group That Identifies Its Tools as Careto: The Mask
    3. Dark Web
  11. 4 Creating Secure Code
    1. First Principle of Code Protection: Code Isolation and Confinement
    2. Code Isolation Techniques
    3. Implementation of the Four Code-Confinement Methods
      1. Reference Monitors
      2. OS Chroots
      3. OS Jail Routines
      4. FreeBSD Jail
      5. Linux’s Ptrace Monitor and Systrace Routines
      6. Employing Applications Such as Ostia or NACI
    4. Isolation of Virtual Machines
      1. Computer Virtualization
    5. Threats to Computer Virtualization
      1. Subverting VM Isolation
      2. VM-Based Malware
      3. Software Fault Isolation
  12. 5 Providing a Secure Architecture
    1. Providing a Secure Architecture
      1. Isolation and Least Privilege
      2. Access Control Concepts
      3. Operating Systems
      4. Browser Isolation and Least Privilege
    2. Hacking Attacks
    3. Spear Phishing and Behavioral Attacks
    4. Spoofing, Digital Misrepresentation, and Mobile Security
  13. 6 The Hacker Strategy: Expanded
    1. Lab Analysis and Learning Vulnerabilities
      1. Hacker Strategies
        1. Reconnaissance
        2. Attracting the Victim
        3. Gain Control
        4. Exfiltrate Data and Conscript
        5. Overall: Cloak the Source
        6. Antivirus Protection
        7. Crack Passwords
        8. The Key
      2. Zero-Days
    2. Basic Control of Hijacking Attacks
    3. Platform Defenses
      1. Run-Time Defenses
      2. Advanced Hijacking Attacks: Heap Spraying
    4. The Final Solution to Hacking Attacks
  14. 7 Malware, Viruses, Worms, Bugs, and Botnets
    1. Introduction
    2. Botnets: Process and Components and History
    3. Viruses and Worms
    4. A More Detailed Examination of Malware, Viruses, Trojans, and Bots/Botnets
      1. Worms
      2. Some Examples of Historical Worm Attacks
        1. Morris Worm
        2. Code Red I and Code Red II Worms
        3. Nimda Worm
        4. SQL Slammer
        5. Conficker Worm
        6. E-Mail Worms
        7. Love Bug Worm
        8. MyDoom Worm
        9. Storm Worm and Storm Botnet
      3. Viruses
        1. Virus Propagation
    5. Payload
    6. Detecting a Virus
      1. Polymorphic Code
      2. Metamorphic Code
      3. When Malware Is Detected
      4. Botnets
        1. Star-Structured Botnets
        2. Hierarchical Botnets
        3. Defending from Botnets
    7. Anonymity and Sneakiness
    8. Sneakiness and Side-Channel Attacks
      1. Covert Channels
      2. Security
      3. Side Channels
      4. Side Channels in Web Surfing
      5. Exploiting Side Channels for Stealth Scanning
      6. UI Side-Channel Snooping
    9. Bugs
    10. Detecting Attacks and Removal Systems
      1. Intrusion Detection Systems
      2. Host-Based and Network-Based Intrusion Detection Systems
        1. Network-Based Intrusion Detection Systems
        2. Host-Based Intrusion Detection Systems
    11. Honeypot Traps out in the Network
    12. Passive and Reactive Systems
    13. Statistical Anomaly and Signature-Based IDSs
    14. Comparison with Firewalls
    15. Detection Evasion Techniques
    16. Forensics
    17. Detecting Attacks and Attackers with Examples
      1. Symmetric Cryptography
      2. The Problem of Detecting Attacks
      3. Directory Traversal
      4. What Is Another Method to Detect This Attack?
      5. An Alternate Paradigm
      6. Detection Accuracy
      7. Detecting Successful Attacks
    18. Detection versus Blocking
      1. Styles of Detection
        1. Signature Based
      2. Vulnerability Signatures
      3. Anomaly Based
      4. Specification-Based Detection
      5. Behavioral Detection
    19. The Problem of Evasion
  15. 8 Cryptography and the RSA Algorithm
    1. Data Encryption Standard and Advanced Encryption Standard
    2. Public Keys
    3. Modern Approaches for Breaking Encryption
    4. Current Cryptography Concepts
    5. More Cryptography, Private-Key, Public-Key Encryption, RSA Algorithm Details
  16. 9 Browser Security and Cross-Site Scripting
    1. Three Web Threat Models
    2. Web-Page Content
    3. Code Isolation
    4. Browser Security Model
    5. Hypertext Transfer Protocol
    6. Rendering Content
    7. Isolation
    8. Security User Interface
    9. Cookies
    10. Frame Busting
    11. Browser Code Isolation
      1. Web Worker
      2. Sandbox
      3. Cross-Origin Resource Sharing
      4. Content Security Policy
  17. 10 Banking Security, Zeus, and SpyEye
    1. Fraud Process
    2. Risk Management Process for Banks
    3. Zeus and SpyEye Attacks
    4. Online Fraud and the Impacts of Zeus and SpyEye Attacks
  18. 11 Web Application Security
    1. Basics of SQL Injections
    2. More Examples of Injection-Based Attacks
      1. A Review of the ScanBox Software
  19. 12 Session Management, User Authentication, and Web Application Security
    1. Session Management and User Authentication
      1. Session Management
      2. HTTP Cookies
      3. Session ID
      4. Storing Session IDs
    2. Web Application Security
      1. Structured Query Language Injection
        1. An SQL Injection Example: The CardSystems Solutions Attack
      2. Cross-Site Request Forgery
      3. Cross-Site Scripting
        1. Example of an XSS Attack on PayPal
        2. Session Management and User Authentication Conclusion
  20. 13 Web Security, DNS Security, and the Internet
  21. 14 Network Security and Defenses
    1. Network Security: Recap
      1. Protocols
      2. Address Resolution Protocol
      3. Internet Protocol
      4. Packet Sniffing
      5. User Datagram Protocol (UDP)
      6. Blind TCP Session Hijacking
      7. Stopping Services
      8. Exhausting Resources
      9. SYN Flooding
      10. Smurf DoS Attacks
      11. Internet Control Message Protocol
      12. Distributed Denial-of-Service Attacks
    2. Cryptographic Network Protection
      1. Internet Protocol Security
    3. Network Attacks
    4. Physical/Link-Layer Threats: Eavesdropping
    5. Physical/Link-Layer Threats: Spoofing
    6. Layer 3 Threats
    7. Layer 4 TCP and UDP Threats
      1. DHCP Threats
      2. Domain Name System Threats
    8. Concluding Highlights
  22. 15 Network Security Protocols and Defensive Mechanisms
    1. Network Security Protocols
      1. IP Security (IPSec) Protocol
        1. Phase 1
        2. Phase 2
    2. Layer 2: Link-Layer Connectivity of Wireless
      1. TCP/IP Basic Layer 2–3 Security Problems
      2. Defense Mechanisms That Can Be Employed
        1. Virtual Private Network
        2. Several Different Protocols Then Apply to These Modes
        3. Basic Packet Formats
    3. Filtering Network Traffic at the IP Level
      1. Basic Packet Filtering
      2. Firewall Stateful Packet Filtering
    4. Other Protocols of Concern
    5. IP Fragmentation
    6. Transport Layer Security
    7. Proxy Firewall
    8. Web Traffic Scanning
    9. Intrusion Detection Systems
    10. Two Critical Infrastructure Protocols: BGP and DNS
    11. Infrastructure Protocols for DNS and DNSSEC
    12. Network Control Firewalls
    13. Security Principle Reference Monitors
  23. 16 Denial-of-Service Attacks
  24. 17 Mobile Platform Security
    1. Comparison of Mobile Platforms
      1. Apple iOS Operating System
      2. Core OS Layer
      3. Core Services Layer
      4. Media Layer
      5. Cocoa Touch Layer
    2. Development of iOS Applications
      1. Apple iOS Security
    3. Android Mobile Smartphone
    4. Android Security Model
    5. Security Features
    6. App Development Concepts
      1. Exploit Prevention
      2. Layers of Security
    7. Java Sandbox
    8. Apple iOS versus Android Operating System Comparisons
    9. Windows Mobile Models 7 and 8 Devices
      1. Windows Phone OS 7.0 Security Model
    10. .NET Code Access Security That Can Be Exploited on Windows Phones
      1. Mobile Platform Security
    11. Mobile Platform Security
    12. Attack Vectors for Mobile Devices
  25. 18 Cellular Access Security: 4G LTE, Mobile WiMAX, 5G, and MIMOs
    1. First-Generation Cellular Network
      1. Security Issues and Drawbacks
    2. Second-Generation Cellular Network
      1. Security Issues and Drawbacks
    3. Third-Generation Cellular Network
      1. Security Issues and Drawbacks
    4. Information Security
    5. Security Analysis
      1. Goals and Objectives in Security
      2. Boundaries and Limitations in Security
      3. Types of Security Issues
      4. Types of Security Attacks
      5. Architecture of Security
      6. 4G Security (LTE and WiMAX)
    6. WiMAX Introduction
    7. History of WiMAX
    8. Evolution of Mobile WiMAX
    9. Mobile WiMAX Architecture
    10. WiMAX Security, Threats, and Solutions
    11. 4G LTE Introduction
    12. History of 4G LTE
    13. 4G LTE Architecture
    14. 4G LTE Security, Threats, and Solutions
    15. A 5G Future
    16. 5G Security
      1. HetNets
      2. Massive MIMO
      3. Millimeter Wave
    17. Conclusion
  26. 19 Wireless LAN Security
    1. Regulatory WLAN Security Standards
      1. 802.11a
      2. 802.11b
      3. 802.11g
      4. 802.11n
      5. 802.11ac
      6. 802.11af
      7. 802.11i
    2. Wire Lined to Wireless Transition
      1. WNIC
    3. Corporate Background of Wireless Networks
    4. Wireless Network Security Methods
    5. CIA Triangle of Confidentiality, Integrity, and Availability
      1. Smart Cards
      2. Security Tokens and Software Tokens
    6. Wireless Security History, Standards, and Developments
      1. Wired Equivalent Privacy
      2. Wi-Fi Protected Access
      3. Temporal Key Integrity Protocol (TKIP)
      4. Extensible Authentication Protocol (EAP)
      5. Lightweight Extensible Authentication Protocol (LEAP)
      6. Protected Extensible Authentication Protocol (PEAP)
      7. Wireless Transport Layer Security (WTLS)
      8. Wi-Fi Protected Setup (WPS)
        1. WPA2
    7. Other Security Considerations
    8. Threats of Wireless Networks
      1. Confidentiality Attacks
      2. Access Control Attacks
    9. Conclusion
  27. 20 The Stuxnet Worm and the Vulnerability of the U.S. Electric Power Grid
    1. More Details of the Stuxnet Worm Used for Cyber Warfare
      1. Attack Process
        1. Path 1: Via WinCC
        2. Path 2: Via Network Shares
        3. Path 3: Via the MS10-061 Print Spooler 0-Day Vulnerability
        4. Path 4: Via the MS08-067 SMB Vulnerability
        5. Path 5: Via Step7 Projects
    2. Stuxnet Damage
    3. Cyber Terrorism after Stuxnet
    4. Stuxnet Attack Summary
    5. Response and Industrial Control Security
    6. The Vulnerable U.S. Electronic Power Grid
    7. Components and Operating Elements of the U.S. Electric Power Grid
    8. Irreplaceable Large Power Transformers and Our Smart Grid Risk
    9. Smart Meters
    10. Programmable Logic Controllers
    11. Advantages of PLCs
    12. Distribution Transformers and Controllers
    13. Local PLC Inner-Loop Controller
    14. A SCADA System
    15. Conclusion
  28. 21 Cyber Warfare
    1. Weapons of Cyber War
    2. Cyber Crime as a Service
    3. Hacktivists
  29. 22 Conclusion
  30. Bibliography
  31. Appendix
  32. Index

Product information

  • Title: Network and Data Security for Non-Engineers
  • Author(s): Frank M. Groom, Kevin Groom, Stephan S. Jones
  • Release date: August 2016
  • Publisher(s): Auerbach Publications
  • ISBN: 9781315350219