Technical (Bottom-Up) Methodology 103
DoSHelp Network
security
Network security tools, patches, port watchers, firewalls, scanning tools,
decryption tools, and attack reporting information
http://www.doshelp.com
Elf Qrin’s Hacking Lab Tools, essays, stories, forum
http://www.elfqrin.com/hack
Exploit X White papers, computer security news
http://www.exploitx.com
Fight Back Some tips on how to protect yourself from crackers, and how to secure your
data
http://www.antionline.com/fight
Hack In The Box Slashdot-style security site
http://www.hackinthebox.org
hackZone [Russian/
English language]
Articles, news, forum
http://www.hackzone.ru
halcon Australian security site
http://www.halcon.com.au
Hideaway.net Security portal
http://www.hideaway.net
ICSA Security assurance company, information magazine
http://www.icsa.net
Java Applets security FAQs
http://java.sun.com/sfaq
KSA Security Bulletin Security news
http://home13.inet.tele.dk/kruse/
bulletin.htm
musicforhackers.com Online radio with security news and music
http://musicforhackers.com
Networking News
Source — Security
Computer Networking News source and Computer Networking Information
source
http://www.networkingnews.org/
security
Protection/Education Solutions to virus problems, nuke/war protection. education on how and
what to do when online regarding protection and prevention
http://sandpit.caloundra.qld.gov.
au/~lionx/helpers99
Rediff On The NeT —
saving private data
A computer security primer for technology greenhorns http://www.rediff.com/computer/
1999/mar/24secure.htm
Replay Associates Data security and network security archives, cryptography http://www.replay.com
Rewted Network
Security Labs
An information nexus, with a fully interactive technical database and FAQs;
fine tools archive
http://www.rewted.org
SAFER A free monthly newsletter distributed in PDF format, security vulnerabilities
are presented here, sorted by date and operating system
http://safer.siamrelay.com
Safer-Hex Daily news on all subjects related to computer, IT, and online security issues
http://www.jrpamc.com/safer
Secureroot Web directory dedicated to computer security and Internet underground
http://secureroot.m4d.com
Security Associates Information for protection from fraud, computer security
, etc. http://www.security.com.cy
Exhibit 8. Listing of Other Security Web Sites (Continued)
Site Name Description
URL
104 Managing Network Vulnerability Assessment
Security Horizon Updated news on the security world, news, tools and docs
http://www.securityhorizon.com
securitysearch.net Searchable security portal
http://www.securitysearch.net
SecurityWatch.com A security portal site
http://www.securitywatch.com
Seven Tenets of Good
Security
Some rules that may be useful
http://www.avolio.com/
7tenets.html
Student Punkz Information on common school security systems, such as OnGuard, AtEase,
and more
http://www.punkz.com
Exhibit 8. Listing of Other Security Web Sites (Continued)
Site Name Description
URL
Technical (Bottom-Up) Methodology 105
organizations above “hacking back,” but that does not mean it has never
happened.] We are not going to get into an exhaustive discussion about
protecting yourself on the Internet here. After all, this is a book on vulnerability
assessment, not Internet Security basics. Here are a few tips to help put your
mind at ease when contacting a Web site dedicated to hacking:
Run a personal firewall. There are several different types that you can
either download or purchase at a retail outlet. One of the more popular
personal firewalls is Zone Alarm from http://www.zonelabs.com. At the
time of this writing, there was still a free version of this personal firewall
that you can download. A second option is the BlackICE firewall from
http://www.iss.net. While this product has no free version, it is still a very
commonly used personal firewall.
Use a different ISP account. To make it more difficult to have someone
come back into your home system after visiting a hacker Web site, simply
change your ISP. You can use a free service provider like netZero or Juno,
or you may also want to sign up for an account with a provider such as
Earthlink, which offers a 30-day free trial and just cancel your account
before the 30 days expires. If switching your ISP is not for you, then
perhaps an Internet kiosk is a better option. Internet kiosks are becoming
more and more popular, and can be found in major malls, airport, and
restaurants. The downside to the kiosks is price. These services generally
charge either a per-minute or per-15-minute connection charge. Another
option is to use the Internet access at your public library. The major
drawback to the library is similar to that of the Internet kiosk: there is no
easily available storage for the files you download.
Use an antivirus product. While most of the files you download from these
sites are completely safe and legitimate, you may still encounter files that
are infected with Trojan horses or other malicious code. Even if the Web
site that posted the code has scanned the files for viruses, it is better to
protect yourself than to find out the hard way that someone missed a virus.
Use anonymous proxy service. The anonymous proxy services, such as
Anonymizer (available from http://www.anonymizer.com), hide the IP
address that you are coming from. This provides a pretty good layer of
security from anyone who might try to “hack back” into your system. There
are a number of different services on the Internet from which to choose.
Some anonymous access services are free or feature limited, and other
sites simply charge a monthly access fee.
Stop cookies from reaching your machine. There are a number of ways to
stop cookies, which are small pieces of code given to your computer from
a Web site, from reaching your machine. You can go into your Internet
browser and simply turn off the receipt of cookies but this might cause
you to lose functionality with sites such as Hotmail and your online bank.
So, if you need to stop most cookies from reaching your machine but still
want to let through a selective few, then you need a cookie manager tool.
An example of a cookie manager is WebWasher
®
. WebWasher is available
from http://www.webwasher.com, and there is a free version of this
106 Managing Network Vulnerability Assessment
product available for downloading. There are more features to this product
that come in handy when visiting hacking Web sites as well, such as a
webbugs filter and a pop-up window filter. Even if you are running this
product, it is still a good idea to check your system and see the number
of cookies and bugs that have been implanted in your system. To do this
you can use a product such as PestPatrol (from http://www.pestpatrol.com)
or Ad-aware (from http://www.lavasoftusa.com/aaw.html). Both products
search your registry, memory, and hard drive for webbugs, cookies, and
other Internet monitoring programs.
Following the five steps outlined above does not provide bulletproof
security for your home machine. However, it will provide you with a pretty
good layer of defense to protect your system and make it easier to target
another Internet address.
Building the Plan
When building your test plan for the vulnerability assessment, it is great to
have guidelines against which to compare your target network’s security. This
may be an easy task if you have legal regulations that outline minimum security
practices for your organization, such as the forthcoming Health Insurance
Portability Accountability Act (HIPAA). However, if your organization does not
have industry-specific security criteria to follow, ISO 17799 (discussed in
previous chapters) provides a general framework for any organization. There
are also other standards that can be applied, including (1) the Common Criteria
standards, which were formed by an international consortium and adopted
by the U.S. government; or (2) the older TCSEC guidelines developed by the
U.S. Department of Defense. There are also industry de facto standards such
as the Common Body of Knowledge (CBK) from the International Information
Systems Security Certification Consortium (ISC
2
). Finally, if you are not going
to use any of the guidelines listed above — and it is recommended that you
do — the last measure that you can use is your own personal experience.
While the last measure is the least subjective standard, you will often be asked
for your opinion of the security of the target network.
Here are some very basic points to test when performing your technical
NVA. As a bare minimum, your test plan should look for the following:
Do configurations support policies? This is an important point because
network and security administrators often have to “do their best” when it
comes to installation and configuration of security devices without the
advantage of any formal training.
Do configurations, patch levels, service packs, and revision levels protect
against known vulnerabilities? Keep in mind that the applications that run
on top of the network systems that you are analyzing may not work with
the latest service pack. You might have to make the recommendation to
upgrade to the latest service pack only if the applications support it.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.