Unit 0: Pre-introduction
Unit 0: Pre-introduction
2. IDS
3. Encryption
4. Forensic Computing
5. Software Security
6. Network Threats 1. Network Security
Advanced Security and Mobile
Networks:
Learning Outcomes:
• To be able to analyse security systems and critically evaluate their performance.
• To be able to design and implement an efficient security model for given network security policies.
• To be evaluate mobile and ad-hoc networks, in terms of infrastructure, topology, routing,
computation, security and their associated communications.
• To critically evaluate current research in the area of security and mobile networks, and assess current technological boundaries in the implementation of these technologies.
Unit 0: Pre-introduction
8. Ad-hoc 9. GSM/3G
Advanced Security and Mobile
Networks:
Module Assessment
1. Coursework 1. Security Analysis [50%] 2. Coursework 2. Mobile Networks [50%] WWW site
http://www.dcs.napier.ac.uk/~bill/asmn.html http://buchananweb.co.uk/asmn.html
Recommended Software Snort 2.0
WinPCap Ethereal 7. Mobile Networks
Unit 0: Pre-introduction
2. IDS
3. Encryption
4. Forensic Computing
5. Software Security
6. Network Threats 1. Network Security
Unit 1: Network Security.
• Firewalls. • NAT.
• PIX firewall. • VPN’s.
• Transport Layer (SSL, PCT). • Application Layer (HTTPS). • Defence-in-depth.
• IPSec.
Unit 0: Pre-introduction
2. IDS
3. Encryption
Computing
5. Software Security
6. Network Threats 1. Network Security
Unit 2: Intrusion Detection Systems
.
• Techniques.• Snort. • IDS Rules. • Tripwire. • Audit Logs. • Profiling.
Unit 0: Pre-introduction
2. IDS
3. Encryption
4. Forensic Computing
5. Software Security
6. Network Threats 1. Network Security
Unit 3: Encryption
.
• Techniques.• Public-key. • Secure Sockets. • RSA.
• 3DES. • MD5.
• Authentication,
• Email security (PGP/S/MIME).
Unit 0: Pre-introduction
2. IDS
3. Encryption
Computing
5. Software Security
6. Network Threats 1. Network Security
Unit 4: Forensic Computing
.
• Data hiding.• Covert Channel Analysis. • Stenography.
• Information Assurance. • Legal Aspects.
• Ethical issues. • Forensic Tools.
• CPAR (Collection, Preservation, Analysis and Reporting).
Unit 0: Pre-introduction
2. IDS
3. Encryption
4. Forensic Computing
5. Software Security
6. Network Threats 1. Network Security
Unit 5 Software Security
• Security Goals. • Weaknesses. • Buffer Overflows. • Java Security. • CGI/API.
• Database Security. • Client-wide security. • Server-side Security.
Unit 0: Pre-introduction
2. IDS
3. Encryption
Computing
5. Software Security
6. Network Threats 1. Network Security
Unit 6: Network Threats
.
• Secure Models.• Email floods. • DoS.
• Vulnerability Threats. • Policies.
Unit 0: Pre-introduction
Unit 7: Mobile Networks.
• Wireless. • Security. • Mobile IP. • Mobile Agents. • Spread spectrum.
• Military/Emergency Networks 8. Ad-hoc
9. GSM/3G
7. Mobile Networks
Unit 0: Pre-introduction
Unit 8: Ad-hoc Networks.
• Ad-hoc routing. • On-demand routing. • Techniques.
• MANET. • Applications.
8. Ad-hoc 9. GSM/3G
7. Mobile Networks
Unit 0: Pre-introduction
Unit 9: GMS/3G networks.
• Operation.
• Location-finding techniques. • Location-based services. • GSM Security.
• Mobile Phone Network Design. • Spread-spectrum.
8. Ad-hoc 9. GSM/3G
7. Mobile Networks
Unit 0: Pre-introduction
External
intruders
Data
Users
Systems
Internal
intruders
Network intrusions (Internal and External)
Internal
External
Unit 0: Pre-introduction
Increasing difficulty to deal with
Budget: £1000s
£100,000s
£10 millions
£100M
£100billions
Large-scale military
Government activities
Industrial espionage
Professional
data mining
Home
user
Unit 0: Pre-introduction
Physical
Physical
Data Link
Data Link
Network
Network
Transport
Transport
Session
Session
Presentation
Presentation
Physical protection of equipment,
padlocks, fiber cables, and so on.
VLANs, WEP key for wireless
Networks.
Firewalls, NAT translation,
Interior routing protocols.
SSL (Secure Socket Layer),
Proxy servers.
S-HTTP (WWW), S-FTP
RSA, DES, PGP encryption
Data
Data
Data
Data
Physical
Physical
Data Link
Data Link
Network
Network
Transport
Transport
Session
Session
Presentation
Presentation
Unit 0: Pre-introduction
Physical
Physical
Data Link
Data Link
Network
Network
Transport
Transport
Session
Session
Presentation
Presentation
Physical
Physical
Data Link
Data Link
Network
Network
Transport
Transport
Session
Session
Presentation
Presentation
Data
Data
Data
Data
The earlier that
security is applied,
the better for overall
security.
Unit 0: Pre-introduction
1. Data protection. This is typically where sensitive or commercially important information is kept. It might include information databases, design files or source code files. One method of reducing this risk is to encrypt important files with a password and/or some form of data encryption.
2. Software protection. This involves protecting all the software packages from damage or from being misconfigured. A misconfigured software package can cause as much damage as a physical attack on a system, because it can take a long time to find the problem.
3. Physical system protection. This involves protecting systems from intruders who might physically attack the systems. Normally, important systems are locked in rooms and then within locked rack-mounted cabinets.
4. Transmission protection. This involves a hacker tampering with a transmission connection. It might involve tapping into a network connection or total disconnection. Tapping can be avoided by many methods, including using optical fibres which are almost impossible to tap into (as it would typically involve sawing through a cable with hundreds of fibre cables, which would each have to be connected back as they were connected initially). Underground cables can avoid total disconnection, or its damage can be reduced by having redundant paths (such as different connections to the Internet).
“… the physical
protection is the
most important
protection for a
network…
without it you
don’t have a
system … ”
Unit 0: Pre-introduction
• IP spoofing. Involves a hacker stealing an authorized IP address, and using it.
• Packet-sniffing. Listens from TCP/IP.
• Password attack. Hacker runs programs which determine the password of a user. Once into the system the hacker can then move onto other, more trusted, users.
• Sequence number prediction attacks. In TCP communications an initial TCP sequence number is used to start the communications (based on the sender’s clock). The hacker can then predict the sequence numbers that would follow the initial connection.
• Session hi-jacking attacks. Hacker taps into a conversation between two computers. A remote trusted user could start the conversation, but the hacker could continue it.
• Shared library attacks.
• Social engineering attacks. Typically a hacker uses social methods to determine a user’s password.
• Technological vulnerability attack. The hacker attacks a vulnerable part of the system, such as rebooting the computer, spreading viruses, etc.
• Trust-access attacks. Hacker adds their system to one of the trusted systems. The hacker can then get full administrator privileges.
“… as
professionals, it is
our aim to
overcome
external and
internal
hacking … and we
must protect
users, data and
systems …”
Unit 0: Pre-introduction
information about the systems, such as DNS and IP information
Information, such as subnet layout, and network devices.
Outside reconnaissance
Outside
reconnaissance
Inside
reconnaissance
Inside
reconnaissance
Exploit
Exploit
Profit
Profit
Foothold
Foothold
From code yellow
to code red
Intruder finds a weakness,
such as cracking a password,
breaching a
firewall, and so on. Data stealing, system damage,
user abuse, and so on.
Once into the system, the Intruder can then advance up levels.
