Notes From Security School
Do you want to look inside the world of hackers and learn some lessons about how to thwart their attacks on your network? The SANS Institute's professional training courses may be the best place to start.
Computerworld - The underground world of the computer hacker may seem like a place where chaos rules, but the reality is there's a method to the hacker's perceived madness. And understanding that method is critical to knowing how best to respond to a skilled attacker.
Last fall, the SANS Institute offered three training courses that presented a step-by-step look at how criminal hackers operate and how organizations should respond.
While the bad news is that the hacker underground remains as cunning and capable as ever, the good news is that the security community continues to gain an understanding of how hackers operate.
I attended the SANS training and will pass along some of the crucial information provided. My notes from the sessions offer a look at how criminal hackers work. These lessons can give you the knowledge necessary to begin hardening your network against attacks.
Although no two hacker exploits are the same, most follow a series of predictable steps that are designed to increase the hacker's chances of success, says Ed Skoudis, founder and senior security consultant at Intelguardians LLC, a Washington-based information security consulting firm and the primary SANS instructor in hacker techniques, exploits and incident handling.
There are basic steps that "represent the flow of an attack," says Skoudis. They include conducting reconnaissance, scanning, exploiting systems and keeping access. And knowing what hackers do during each of these steps is critical to understanding how to defend your enterprise.
When a hacker conducts reconnaissance on a target, he is basically "casing the joint," says Skoudis. But it doesn't take much work because most organizations give away a lot more information than they realize. And that's why a hacker's recon operation almost always begins with publicly available information.
Ed Skoudis, founder and senior security consultant at Intelguardians LLC
A Web-based recon of public information may also reveal disgruntled users or employees, as well as data about help desk requests. Likewise, it's possible to download a site's HTML code using a crawler, such as the one found on SamSpade.org. That would enable a hacker to search HTML and hidden fields and possibly uncover vulnerable scripts, Skoudis says.
The most common online method of reconnaissance, however, is conducting a "whois" search to gain domain registration data. Detailed searches can provide an attacker with the IP address of the organization's Domain Name System server. The attacker can then begin mapping the enterprise network in order to harvest additional IP addresses.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!