Hands-On Ethical Hacking and Network Defense Second Edition
description
Transcript of Hands-On Ethical Hacking and Network Defense Second Edition
![Page 1: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/1.jpg)
HANDS-ON ETHICAL HACKING AND NETWORK
DEFENSESECOND EDITION
Chapter 1Ethical Hacking Overview
![Page 2: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/2.jpg)
Who Am I? Kevin Riley Systems / Network Analyst
Orange Coast College Email
[email protected] Phone
714.432.5949 Office Hours
Tues / Thurs 3 – 5 pm OCC IT Bldg 156 Rm 116eHave Fun Finding it!
Hands-On Ethical Hacking and Network Defense, Second Edition
2
![Page 3: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/3.jpg)
Syllubus http://myehclass.blogspot.com/p/eh-
syllabus.html
Hands-On Ethical Hacking and Network Defense, Second Edition
3
![Page 4: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/4.jpg)
Objectives After reading this chapter and
completing the exercises, you will be able to:Describe the role of an ethical hackerDescribe what you can do legally as an
ethical hackerDescribe what you can’t do as an
ethical hacker
Hands-On Ethical Hacking and Network Defense, Second Edition
4
![Page 5: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/5.jpg)
Introduction to Ethical Hacking Ethical hackers
Hired by companies to perform penetration tests
Penetration testAttempt to break into a company’s network
to find the weakest link Security test
More than a break in attempt; includes analyzing company’s security policy and procedures
Vulnerabilities are reported Hands-On Ethical Hacking and Network Defense,
Second Edition5
![Page 6: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/6.jpg)
The Role of Security and Penetration Testers Hackers
Access computer system or network without authorization○ Breaks the law; can go to prison
CrackersBreak into systems to steal or destroy data
○ U.S. Department of Justice calls both hackers Ethical hacker
Performs most of the same activities with owner’s permission
Hands-On Ethical Hacking and Network Defense, Second Edition
6
![Page 7: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/7.jpg)
The Role of Security and Penetration Testers (cont’d.)
Script kiddies or packet monkeysYounger, inexperienced hackers who copy
codes from knowledgeable hackers Programming languages used by
experienced penetration testersPractical Extraction and Report Language
(Perl)C language
ScriptSet of instructions Runs in sequence to perform tasksHands-On Ethical Hacking and Network Defense,
Second Edition7
![Page 8: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/8.jpg)
The Role of Security and Penetration Testers (cont’d.)
Tiger boxCollection of toolsUsed for conducting vulnerability
assessments and attacks
Hands-On Ethical Hacking and Network Defense, Second Edition
8
![Page 9: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/9.jpg)
Penetration-Testing Methodologies White box model
Tester is told about network topology and technology
Tester is permitted to interview IT personnel and company employees○ Makes tester’s job a little easier
Black box modelStaff does not know about the testTester is not given details about technologies used
○ Burden is on tester to find detailsTests security personnel’s ability to detect an
attack
Hands-On Ethical Hacking and Network Defense, Second Edition
9
![Page 10: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/10.jpg)
Hands-On Ethical Hacking and Network Defense, Second Edition
10
Figure 1-1 A sample floor plan
![Page 11: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/11.jpg)
Penetration-Testing Methodologies (cont’d.) Gray box model
Hybrid of the white and black box models
Company gives tester partial information (e.g., OSs are used, but no network diagrams)
Hands-On Ethical Hacking and Network Defense, Second Edition
11
![Page 12: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/12.jpg)
Certification Programs for Network Security Personnel
Certification programs Available in almost every area of
network security Minimum certification
CompTIA Security+ or equivalent knowledge○ Prerequisite for Security+ certification
Hands-On Ethical Hacking and Network Defense, Second Edition
12
![Page 13: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/13.jpg)
Certified Ethical Hacker (CEH) Developed by the International
Council of Electronic Commerce Consultants (EC-Council)Based on 22 domains (subject areas)Web site: www.eccouncil.org
Red teamConducts penetration testsComposed of people with varied skillsUnlikely that one person will perform all
testsHands-On Ethical Hacking and Network Defense,
Second Edition13
![Page 14: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/14.jpg)
OSSTMM Professional Security Tester (OPST) Open Source Security Testing Methodology
Manual (OSSTMM) Professional Security TesterDesignated by the Institute for Security and
Open Methodologies (ISECOM)Based on Open Source Security Testing
Methodology Manual (OSSTMM)○ Written by Peter Herzog
Five main topics (i.e., professional, enumeration, assessments, application, and verification)
Web site: www.isecom.orgHands-On Ethical Hacking and Network Defense,
Second Edition14
![Page 15: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/15.jpg)
Certified Information Systems Security Professional (CISSP) Issued by the International
Information Systems Security Certification Consortium (ISC2)Not geared toward technical IT
professionalsTests security-related managerial skills
○ Usually more concerned with policies and procedures
Consists of ten domainsWeb site: www.isc2.org
Hands-On Ethical Hacking and Network Defense, Second Edition
15
![Page 16: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/16.jpg)
SANS Institute SysAdmin, Audit, Network, Security
(SANS) InstituteOffers training and certifications through
Global Information Assurance Certification (GIAC)
Top 20 listOne of the most popular SANS Institute
documentsDetails most common network exploitsSuggests ways of correcting vulnerabilitiesWeb site: www.sans.org
Hands-On Ethical Hacking and Network Defense, Second Edition
16
![Page 17: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/17.jpg)
Which Certification Is Best? Penetration testers and security testers
Both need technical skills to perform duties effectively○ Good understanding of networks ○ Role of management in an organization○ Skills in writing and verbal communication○ Desire to continue learning
Danger of certification exams Some participants simply memorize
terminology○ Don’t have a good grasp of subject matter
Hands-On Ethical Hacking and Network Defense, Second Edition
17
![Page 18: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/18.jpg)
What You Can Do Legally Laws involving technology change
as rapidly as technology itselfKeep abreast of what’s happening in
your area○ Find out what is legal for you locally
Be aware of what is allowed and what you should not or cannot do○ Laws vary from state to state and
country to country
Hands-On Ethical Hacking and Network Defense, Second Edition
18
![Page 19: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/19.jpg)
Laws of the Land Some hacking tools on your
computer might be illegal Contact local law enforcement
agencies before installing hacking tools Laws are written to protect society
Written words are open to interpretation
Government is getting more serious about cybercrime punishment
Hands-On Ethical Hacking and Network Defense, Second Edition
19
![Page 20: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/20.jpg)
Hands-On Ethical Hacking and Network Defense, Second Edition
20
Table 1-1 An overview of recent hacking cases
![Page 21: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/21.jpg)
Hands-On Ethical Hacking and Network Defense, Second Edition
21
Table 1-1 An overview of recent hacking cases (cont’d.)
![Page 22: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/22.jpg)
Is Port Scanning Legal? Some states deem it legal
Not always the caseBe prudent before using penetration-
testing tools Federal government does not see it
as a violationAllows each state to address it separately
○ Research state laws Read your ISP’s “Acceptable Use
Policy”Hands-On Ethical Hacking and Network Defense,
Second Edition22
![Page 23: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/23.jpg)
Hands-On Ethical Hacking and Network Defense, Second Edition
23
Figure 1-2 An example of an acceptable use policy
![Page 24: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/24.jpg)
Is Port Scanning Legal? (cont’d.) IRC “bot”
Program that sends automatic responses to users
Gives the appearance of a person being present
Hands-On Ethical Hacking and Network Defense, Second Edition
24
![Page 25: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/25.jpg)
Federal Laws Federal computer crime laws are
getting more specificCybercrimes Intellectual property issues
Computer hacking and intellectual property (CHIP)New government branch to address
computer hacking and intellectual property crimes
Hands-On Ethical Hacking and Network Defense, Second Edition
25
![Page 26: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/26.jpg)
Hands-On Ethical Hacking and Network Defense, Second Edition
26
Table 1-2 Federal computer crime laws
![Page 27: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/27.jpg)
Hands-On Ethical Hacking and Network Defense, Second Edition
27
Table 1-2 Federal computer crime laws (cont’d.)
![Page 28: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/28.jpg)
What You Cannot Do Legally Illegal actions:
Accessing a computer without permission
Destroying data without permissionCopying information without
permissionInstalling worms or virusesDenying users access to network
resources Be careful your actions do not
prevent client’s employees from doing their jobs
Hands-On Ethical Hacking and Network Defense, Second Edition
28
![Page 29: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/29.jpg)
Get It in Writing Using a contract is good business
May be useful in court Books on working as an independent
contractorThe Computer Consultant’s Guide by Janet RuhlGetting Started in Computer Consulting by
Peter Meyer Internet can also be a helpful resource
Free modifiable templates Have an attorney read your contract
before signing Hands-On Ethical Hacking and Network Defense,
Second Edition29
![Page 30: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/30.jpg)
Ethical Hacking in a Nutshell Skills needed to be a security tester
Knowledge of network and computer technology
Ability to communicate with management and IT personnel
An understanding of the laws in your location
Ability to use necessary tools
Hands-On Ethical Hacking and Network Defense, Second Edition
30
![Page 31: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/31.jpg)
Summary Companies hire ethical hackers to
perform penetration testsPenetration tests discover vulnerabilities
in a networkSecurity tests are performed by a team
of people with varied skills Penetration test models
White box modelBlack box modelGray box model
Hands-On Ethical Hacking and Network Defense, Second Edition
31
![Page 32: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/32.jpg)
Summary (cont’d.) Security testers can earn
certificationsCEHCISSPOPST
Be aware What you are legally allowed or not
allowed to do ISPs may have an acceptable use
policyMay limit ability to use toolsHands-On Ethical Hacking and Network Defense,
Second Edition32
![Page 33: Hands-On Ethical Hacking and Network Defense Second Edition](https://reader036.fdocuments.net/reader036/viewer/2022081517/56816387550346895dd4725a/html5/thumbnails/33.jpg)
Summary (cont’d.) Laws should be understood before
conducting a security testFederal lawsState laws
Get it in writingUse a contractHave an attorney read the contract
Understand tools available to conduct security testsLearning how to use them should be a
focused and methodical processHands-On Ethical Hacking and Network Defense,
Second Edition33