Notes From Security School
Do you want to look inside the world of hackers and learn some lessons about how to thwart their attacks on your network? The SANS Institute's professional training courses may be the best place to start.
Computerworld - The underground world of the computer hacker may seem like a place where chaos rules, but the reality is there's a method to the hacker's perceived madness. And understanding that method is critical to knowing how best to respond to a skilled attacker.
Last fall, the SANS Institute offered three training courses that presented a step-by-step look at how criminal hackers operate and how organizations should respond.
While the bad news is that the hacker underground remains as cunning and capable as ever, the good news is that the security community continues to gain an understanding of how hackers operate.
I attended the SANS training and will pass along some of the crucial information provided. My notes from the sessions offer a look at how criminal hackers work. These lessons can give you the knowledge necessary to begin hardening your network against attacks.
Although no two hacker exploits are the same, most follow a series of predictable steps that are designed to increase the hacker's chances of success, says Ed Skoudis, founder and senior security consultant at Intelguardians LLC, a Washington-based information security consulting firm and the primary SANS instructor in hacker techniques, exploits and incident handling.
There are basic steps that "represent the flow of an attack," says Skoudis. They include conducting reconnaissance, scanning, exploiting systems and keeping access. And knowing what hackers do during each of these steps is critical to understanding how to defend your enterprise.
When a hacker conducts reconnaissance on a target, he is basically "casing the joint," says Skoudis. But it doesn't take much work because most organizations give away a lot more information than they realize. And that's why a hacker's recon operation almost always begins with publicly available information.
Ed Skoudis, founder and senior security consultant at Intelguardians LLC
A Web-based recon of public information may also reveal disgruntled users or employees, as well as data about help desk requests. Likewise, it's possible to download a site's HTML code using a crawler, such as the one found on SamSpade.org. That would enable a hacker to search HTML and hidden fields and possibly uncover vulnerable scripts, Skoudis says.
The most common online method of reconnaissance, however, is conducting a "whois" search to gain domain registration data. Detailed searches can provide an attacker with the IP address of the organization's Domain Name System server. The attacker can then begin mapping the enterprise network in order to harvest additional IP addresses.
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!