Protecting Information Resources Part 6

95. Briefly discuss how a worm can disrupt a computer or a network. ANSWER: Answers will vary. A worm travels from computer to computer in a network, but it does not usually erase data. Unlike a virus, it is an independent program that can spread itself without having to be attached to a host program. It might corrupt data, but it usually replicates itself into a full-blown version that eats up computing resources, eventually bringing a computer or network to a halt. Wellknown worms include Code Red, Melissa, and Sasser. Conficker, a recent worm, has infected millions of Windows computers. 96. In the context of intentional computer and network threats, describe how blended threats work. ANSWER: Answers will vary. A blended threat is a security threat that combines the characteristics of computer viruses, worms, and other malicious codes with vulnerabilities found on public and private networks. Blended threats search for vulnerabilities in computer networks and then take advantage of these vulnerabilities by embedding malicious codes in the server’s HTML files or by sending unauthorized e-mails from compromised servers with a worm attachment. They may launch a worm through a Trojan horse or launch a denialof-service attack at a targeted IP address. Their goal is not just to start and transmit an attack but to spread it. 97. Briefly discuss dumpster diving and shoulder surfing, two commonly used social-engineering techniques. ANSWER: Answers will vary. Two commonly used social-engineering techniques are called dumpster diving and shoulder surfing. Social engineers often search through dumpsters or trash cans looking for discarded material (such as phone lists and bank statements) that they can use to help break into a network. For example, a social engineer might look up the phone number of a receptionist he or she can call and pretend to be someone else in the organization. Shoulder surfing-that is, looking over someone’s shoulder-is the easiest form of collecting information. Social engineers use this technique to observe an employee entering a password or a person entering a PIN at an ATM, for example. 98. In the context of biometric security measures, briefly describe some biometric devices and measures. ANSWER: Answers will vary. The following list describes some biometric devices and measures: • Facial recognition-Identify users by analyzing the unique shape, pattern, and positioning of facial features. • Fingerprints-Scan users’ fingerprints and verify them against prints stored in a database. • Hand geometry-Compare the length of each finger, the translucence of fingertips, and the webbing between fingers against stored data to verify users’ identities. • Iris analysis-Use a video camera to capture an image of the user’s iris, then use software to compare the data against stored templates. • Palm prints-Use the palm’s unique characteristics to identify users. A palm reader uses near-infrared light to capture a user’s vein pattern, which is unique to each individual. This is compared to a database that contains existing patterns. This method is often used by law enforcement agencies. • Retinal scanning-Scan the retina using a binocular eye camera, then check against data stored in a database. • Signature analysis-Check the user’s signature as well as deviations in pen pressure, speed, and length of time used to sign the name. • Vein analysis-Analyze the pattern of veins in the wrist and back of the hand without making any direct contact with the veins. • Voice recognition-Translate words into digital patterns, which are recorded and examined for tone and pitch. Using voice to verify user identity has one advantage over most other biometric measures: It can work over long distances via ordinary telephones. A well-designed voice-recognition security system can improve the security of financial transactions conducted over the phone. 99. Explain the use of callback modems as a nonbiometric security measure. ANSWER: Answers will vary. A callback modem verifies whether a user’s access is valid by logging the user off (after he or she attempts to connect to the network) and then calling the user back at a predetermined number. This method is useful in organizations with many employees who work off-site and who need to connect to the network from remote locations. 100. List the actions that a firewall can take after examining a packet. ANSWER: Answers will vary. A firewall can examine data passing into or out of a private network and decide whether to allow the transmission based on users’ IDs, the transmission’s origin and destination, and the transmission’s contents. Information being transmitted is stored in what’s called a packet, and after examining a packet, a firewall can take one of the following actions: • Reject the incoming packet. • Send a warning to the network administrator. • Send a message to the packet’s sender that the attempt failed. • Allow the packet to enter (or leave) the private network. 101. Briefly explain how packet-filtering firewalls work. ANSWER: Answers will vary. Packet-filtering firewalls control data traffic by configuring a router to examine packets passing into and out of a network. The router examines the following information in a packet: source IP address and port, destination IP address and port, and protocol used. Based on this information, rules called packet filters determine whether a packet is accepted, rejected, or dropped. For example, a packet filter can be set up to deny packets coming from specific IP addresses. A packet-filtering firewall informs senders if packets are rejected but does nothing if packets are dropped; senders have to wait until their requests time out to learn that the packets they sent were not received. In addition, these firewalls record all incoming connections, and packets that are rejected might be a warning sign of an unauthorized attempt. Packetfiltering firewalls are somewhat inefficient, however, because they have to examine packets one by one, and they might be difficult to install. In addition, they cannot usually record every action taking place at the firewall, so network administrators could have trouble finding out whether and how intruders are trying to break into the network. 102. Discuss the guidelines for improving a firewall’s capabilities. ANSWER: Answers will vary. Guidelines for improving a firewall’s capabilities include the following: a. Identify what data must be secured, and conduct a risk analysis to assess the costs and benefits of a firewall. b. Compare a firewall’s features with the organization’s security needs. For example, if your organization uses e-mail and FTP frequently, you must make sure that the application-filtering firewall you are considering can handle these network applications. c. Compare features of packet-filtering firewalls, application-filtering firewalls, and proxy servers to determine which of these types addresses your network’s security needs the best. d. Examine the costs of firewalls, and remember that the most expensive firewall is not necessarily the best. Some inexpensive firewalls might be capable of handling everything your organization needs. e. Compare the firewall’s security with its ease of use. Some firewalls emphasize accuracy and security rather than ease of use and functionality. Determine what is most important to your organization when considering the trade-offs. f. Check the vendor’s reputation, technical support, and update policies before making a final decision. As the demand for firewalls has increased, so has the number of vendors, and not all vendors are equal. Keep in mind that you might have to pay more for a product from a vendor with a good reputation that offers comprehensive technical support. 103. Briefly explain an intrusion detection system (IDS). ANSWER: Answers will vary. Firewalls protect against external access, but they leave networks unprotected from internal intrusions. An IDS can protect against both external and internal access. It is usually placed in front of a firewall and can identify attack signatures, trace patterns, generate alarms for a network administrator, and cause routers to terminate connections with suspicious sources. These systems can also prevent denial-of-service attacks. An IDS monitors network traffic and uses the “prevent, detect, and react” approach to security. Although it improves security, it requires a great deal of processing power and can affect network performance. It might also need additional configuration to prevent it from generating false positive alarms. 104. Explain how proximity-release door openers are used as a physical security measure to control access to computers and networks. ANSWER: Answers will vary. Physical security measures primarily control access to computers and networks, and they include devices for securing computers and peripherals from theft. Proximity-release door openers are an effective way to control access to a computer room. A small radio transmitter is placed in authorized employees’ ID badges, and when they come within a predetermined distance of the computer room’s door, a radio signal sends a key number to the receiver, which unlocks the door. 105. In the context of access controls, briefly explain the guidelines that need to be followed to increase the effectiveness of passwords. ANSWER: Answers will vary. To increase the effectiveness of passwords, the following guidelines must be followed: • Change passwords frequently. • Passwords should be eight characters or longer. • Passwords should be a combination of uppercase and lowercase letters, numbers, and special symbols, such as @ or $. • Passwords should not be written down. • Passwords should not be common names, such as the user’s first or last name, obvious dates (such as birthdays or anniversaries), or words that can be found in a dictionary. • Passwords should not be increased or decreased sequentially or follow a pattern (for example, 222ABC, 224ABC, 226ABC). • Before employees are terminated, make sure their passwords have been deleted. • Do not use passwords that you have used before. 106. Describe how a virtual private network (VPN) works. ANSWER: Answers will vary. A VPN provides a secure “tunnel” through the Internet for transmitting messages and data via a private network. It is often used so remote users have a secure connection to an organization’s network. VPNs can also be used to provide security for extranets, which are networks set up between an organization and an external entity, such as a supplier. Data is encrypted before it is sent through the tunnel with a protocol, such as Layer Two Tunneling Protocol or Internet Protocol Security. The cost of setting up a VPN is usually low, but transmission speeds can be slow, and lack of standardization can be a problem. Typically, an organization leases the media used for a VPN on an as-needed basis, and network traffic can be sent over the combination of a public network (usually the Internet) and a private network. VPNs are an alternative to private leased lines or dedicated Integrated Services Digital Network (ISDN) lines and T1 lines. 107. Briefly discuss the process of data encryption. ANSWER: Answers will vary. Data encryption transforms data, called plaintext or cleartext, into a scrambled form called ciphertext that cannot be read by others. The rules for encryption, known as the encryption algorithm, determine how simple or complex the transformation process should be. The receiver then unscrambles the data by using a decryption key. A commonly used encryption protocol is Secure Sockets Layer (SSL), which manages transmission security on the Internet. Next time you purchase an item online, notice that the http in the browser address bar changes to https. The https indicates a Secure HTTP connection over SSL. You might also see a padlock icon in the status bar at the bottom to indicate that your information has been encrypted and hackers cannot intercept it. A more recent cryptographic protocol is Transport Layer Security (TLS), which ensures data security and integrity over public networks, such as the Internet. Similar to SSL, TLS encrypts the network segment used for performing transactions. In addition to being encryption protocols, SSL and TLS have authentication functions. 108. In the context of data encryption, briefly describe asymmetric encryption. ANSWER: Answers will vary. Asymmetric encryption uses two keys: a public key known to everyone and a private or secret key known only to the recipient. A message encrypted with a public key can be decrypted only with the same algorithm used by the public key and requires the recipient’s private key, too. Anyone intercepting the message cannot decrypt it, because he or she does not have the private key. This encryption usually works better for public networks, such as the Internet. Each company conducting transactions or sending messages gets a private key and a public key; a company keeps its private key and publishes its public key for others to use. 109. Discuss the functions of the Computer Emergency Response Team (CERT). ANSWER: Answers will vary. The CERT was developed by the Defense Advanced Research Projects Agency (part of the Department of Defense) in response to the 1988 Morris worm attack, which disabled 10 percent of the computers connected to the Internet. Many organizations now follow the CERT model to form teams that can handle network intrusions and attacks quickly and effectively. Currently, CERT focuses on security breaches and denial-of-service (DoS) attacks and offers guidelines on handling and preventing these incidents. CERT also conducts a public awareness campaign and researches Internet security vulnerabilities and ways to improve security systems. Network administrators and e-commerce site managers should check the CERT Coordination Center for updates on protecting network and information resources.