Type:
Solution Manual
Computer Security Resource: Fundamentals Edition:
5th Edition
Author(s):
William Chuck Easttom
Instructor’s Manual Materials to Accompany COMPUTER SECURITY FUNDAMENTALS, 5E CHAPTER 1 INTRODUCTION TO COMPUTER SECURITY
CHAPTER 1 OBJECTIVES When students finish reading this chapter, they will be able to: •
Identify the top threats to a network: security breaches, denial of service attacks, and malware
•
Understand essential security concepts
•
Assess the likelihood of an attack on a network
•
Define key terms such as cracker, penetration tester, firewall, and authentication
•
Compare and contrast perimeter and layered approaches to network security
•
Use online resources to secure a network
CHAPTER OVERVIEW This chapter introduces students to the actual threats posed to a network. It also gives a high-level overview of the entire textbook, introduces topics, and references detailed content covered in later chapters. This chapter introduces students to key terms, techniques, and network security resources. The major sections in this chapter are: 1.
How Seriously Should You Take Threats to Network Security? Realistically assesses the risks to your computer network.
2.
Identifying Types of Threats. Covers the common threats to a computer, including malware, security breaches, and denial of service attacks.
3.
Assessing the Likelihood of an Attack on Your Network. Reviews the dangers of attacks on computer networks.
4.
Basic Security Terminology. Presents definitions of the people, devices, activities, and basic paradigms involved in network security.
5.
Concepts and Approaches. Examines concepts and approaches to consider about security.
.
1
6.
How Do Legal Issues Impact Network Security? Covers privacy and security laws and their impact on organizations.
7.
Online Security Resources. Presents some major security organizations with links to their sites.
CHAPTER OUTLINE I.
How Seriously Should You Take Threats to Network Security?
II.
Identifying Types of Threats Malware Compromising System Security DoS Attacks Web Attacks Session Hijacking Insider Threats DNS Poisoning New Attacks
III.
Assessing the Likelihood of an Attack on Your Network
IV.
Basic Security Terminology Hacker Slang Professional Terms
V.
Concepts and Approaches
VI.
How Do Legal Issues Impact Network Security?
VII.
Online Security Resources CERT Microsoft Security Advisor F-Secure SANS Institute
.
2
KEY TERMS Annualized Loss Expectancy (ALE) Single Loss Expectancy (SLE) multiplied by the Annual Rate of Occurrence (ARO). Auditing The process of reviewing logs, records, and procedures to determine if these items meet standards. Authentication The process of determining if the credentials given by a user or another system (such as a username and password) are authorized to access the network resource in question. Black hat hacker Someone who uses hacking skills for malicious and illegal purposes. CERT Computer Emergency Response Team, the first computer incident-response team and one of the most respected, sponsored by Carnegie Mellon University. CIA triangle A common security acronym for confidentiality, integrity, and accessibility. Cookie A small bit of data, often in plain text, that is stored by web browsers. Cracker One who breaks into a system to do something malicious, illegal, or harmful. Synonymous with black hat hacker. Denial of service (DoS) A type of attack that prevents legitimate users from accessing a resource. This is usually done by overloading the target system with more workload than it can handle. DNS poisoning A type of attack that seeks to compromise a DNS server so that users can be redirected to malicious websites, including phishing websites. Doxing The process of finding personal information about an individual and broadcasting it, often via the Internet. Ethical hacker One who hacks into systems to accomplish some goal that he feels is ethically valid. Often called a penetration tester. Firewall A device or software that provides a barrier between your machine or network and the rest of the world. Gray hat hacker A hacker who usually obeys the law but, in some instances, will cross the line into black hat hacking. Hacker One who tries to learn about a system by examining it in detail and reverse engineering. Hacking Any attempt to gain unauthorized access to your system. This includes cracking passwords, elevating privileges, and breaking into a server. Intrusion detection system (IDS) A system for detecting attempted intrusions. Key logger Software that logs keystrokes on a computer. Layered security approach A security approach in which the perimeter is secured as well as individual systems within the network.
.
3
Logic bomb Software that lays dormant until some specific condition is met, such as a date and time. Malware Any software that has a malicious purpose, such as a virus or Trojan horse. Penetration testing Assessing the security of a system by attempting to break into the system. Penetration testing is the activity of most penetration testers. Personal Health Information (PHI) Information about an individual's health conditions and treatments. Personally Identifiable Information (PII) Information that can be used to identify an individual. Phreaking Hacking into telephone systems. Proxy server A device that hides internal IP addresses and presents a single IP address to the outside world. Single Loss Expectancy (SLE) The Asset Value (AV) multiplied by the Exposure Factor (EF). Script kiddy (or kiddie) A slang term for an unskilled person who purports to be a skilled hacker. Social engineering The use of persuasion on human users to gain information required to access a system. Spyware Software that monitors computer use. Trojan horse Software that appears to have a valid and benign purpose but has another nefarious purpose. Virus Software that is self-replicating and spreads like a biological virus. War-dialing Dialing phones waiting for a computer to pick up. War-dialing is usually done via some automated system. War-driving Driving and scanning for wireless networks that can be compromised. White hat hacker A hacker who does not break the law; often synonymous with “ethical hacker.”
TEACHING NOTES I.
How Seriously Should You Take Threats to Network Security? Teaching Tip: Have students assess the risk on their home computers using the formulas on page 6. Lead students in a discussion on how valuable they believe their data is to someone else. Teaching Tip: Have students calculate the SLE and the ALE for an example scenario using the formulas provided.
II.
Identifying Types of Threats Teaching Tip: Lead students in a discussion about why someone would write malware, break into a system, or deny access to another system.
.
4
III.
Assessing the Likelihood of an Attack on Your Network Teaching Tip: Review the common methods of attacks on computer systems, including spyware and unauthorized usage of systems by internal employees. Have the students perform a risk analysis on their own network.
IV.
Basic Security Terminology Teaching Tip: As with any occupation, security personnel need to understand the language used by people in the field. In this case, there are two basic cultures. Some exploit systems and some protect systems; each may use words a little differently. Review some examples for each of these two cultures. Teaching Tip: Ask students: “Who should grant permission for a penetration tester to test the security of a system? Would it be the system administrator, the head of the IT department, or the CEO? How would a penetration tester prove she has the authorization to break in?” Teaching Tip: Not all IT security issues have technological solutions. IT Security is about one-third technology, one-third business, and one-third sociology. Social engineering is by far the tool of choice for most crackers. You can obtain an ID and password faster, easier, and with less risk over the phone than by using a computer. Ask students whether they have overheard a conversation in which someone has revealed a password. Ask them to recall the key rules for personal password security.
V.
Concepts and Approaches Teaching Tip: Good security has different layers of access. Use the example of a bank safety deposit box. What layers of security do you need to go through to get to items stored in your safety deposit box? The doors to the bank building have locks. The lobby may have armed guards. The vault has a big lock on it. Each drawer of a safety deposit box also has two key locks—you have one key, and the bank has the other. How do layers improve security?
VI.
How Do Legal Issues Impact Network Security? Teaching Tip: Help students understand that IT security needs to protect systems not only from hackers but also from untrained users, disgruntled employees, and lawyers. Lawsuits can damage a company faster than the loss of a computer or the temporary loss of data. Lawsuits can even lead to imprisonment of CEOs if their IT department did not perform “due diligence.”
VII.
Online Security Resources Teaching Tip: Review with students some of the available online security resources they will need in the professional world. These include CERT, the Microsoft Security Response Center, F-Secure, and the SANS Institute.
DISCUSSION QUESTIONS AND WEB PROJECTS I.
Discussion Questions A. Discussion Question 1 Is there such a thing as an ethical reason for unauthorized access to a computer system?
.
5
Answer: Students’ answers may vary. There may be a discussion of gray hat hackers, who feel they are acting ethically when they hack into the system of a corporation they feel is unethical. B. Discussion Question 2 Who is legally responsible for leaks of credit card numbers you have used online? Answer: Students’ answers may vary. Facilitate a discussion regarding the legal issues governing companies doing business over the Internet. In addition, mention the consumers’ responsibility to be aware of site security they frequent. II.
Web Projects A. Web Project 1 Have students visit the CERT statistics site at www.cert.org to see how vulnerabilities are growing. Have them chart the number of incident reports for 10 years. This project can further students’ understanding of the increasing threats to network security. Answer: This project explores in-depth information on the increased number of vulnerabilities. B. Web Project 2 Kevin Mitnick is a well-known “hacker” from the 1980s. He used social engineering and technical knowledge to break into many systems. Look up the history of Kevin Mitnick using a search engine to find out first, whether he used technology or social engineering more in order to succeed. Second, determine whether he was caught, convicted, or served time. Third, look at his security company at http://www.mitnicksecurity.com/. After reading his history, would you hire him as a security consultant? Answer: This project can further students’ understanding of the activities of a hacker. Students should find answers to the questions previously asked and formulate an opinion on whether Mitnick would be a good hire as a security consultant. C. Web Project 3 One type of specialty hacking involves breaking into telephone systems. This subspecialty in the 1980s of hacking was referred to as phreaking. Find articles on phone phreaking and look up a device called “the blue box.” What does this device do? Does it still work on today’s phone system? What is the significance of 2600? And who is “Cap'n Crunch?” A good place to start is http://www.telephonetribute.com/phonephreaking.html. Answer: This project can further students’ understanding of phreaking. Students should find answers to the questions previously asked. D. Web Project 4 CERT National Cyber Alert System Cyber Security Alerts provide timely information about current security issues, vulnerabilities, and exploits. At https://www.us-cert.gov/mailing-lists-and-feeds you can subscribe to one of their mailing lists. Answer: This project explores in-depth information on the security resources available online.
.
6