Scanning

Scanning is a set of procedures for identifying live hosts, ports, and services, discovering Operating system and architecture of target system, Identifying vulnerabilities and threats in the network. Network scanning is used to create a profile of the target organization.

Security scanning, or vulnerability scanning, can be simply described as scanning the security of a website, web-based program, network, or file system for either vulnerabilities or unwanted file changes. 

Server security scanning is a type of preventative maintenance that needs to be conducted on a regular basis. As a result of network security issues, servers are very often put at risk. Examples of server types that need to be monitored are exchange servers, proxy servers, web servers, file servers, print servers, application servers, and many more.

Network scans work by running vulnerability tests on network components. The tests look for faulty settings in the machines connected to the network, the router, and the servers themselves. The tests look for misconfigured internet protocols, server settings, weak passwords, and much more.

Incident Response

Incident response (IR) is a set of information security policies and procedures that can be used  to identify, contain, and eliminate cyberattacks. The goal of incident response is to enable an organization to quickly detect and halt attacks, minimizing damage and preventing future attacks of the same type.

Incident Response Steps: 6 Phases of the Incident Response Lifecycle

Preparation: 

This step includes developing of policies and procedures to follow in the event of a cyber breach. This includes determining the exact composition of the response team and the triggers to alert internal partners. Key to this process is effective training to respond to a breach and documentation to record actions taken for later review.

Identification: 

This step is the process of detecting a breach and enabling a quick, focused response. IT security teams identify breaches using various threat intelligence streams, intrusion detection systems, and firewalls.

During this phase, after an incident is confirmed, communication plans are also typically initiated. These plans inform security members, stakeholders, authorities, legal counsel, and eventually users of the incident and what steps need to be taken.

Containment: 

One of the first steps after identification is to contain the damage and prevent further penetration. This can be accomplished by taking specific sub-networks offline and relying on system backups to maintain operations.

Containment is often accomplished in sub-phases:

• Short term containment—immediate threats are isolated in place. For example, the area of your network that an attacker is currently in may be segmented off. Or, a server that is infected may be taken offline and traffic redirected to a failover.
• Long term containment—additional access controls are applied to unaffected systems. Meanwhile, clean, patched versions of systems and resources are created and prepared for the recovery phase.

Eradication: 

This stage involves neutralizing the threat and restoring internal systems to as close to their previous state as possible. This can involve secondary monitoring to ensure that affected systems are no longer vulnerable to subsequent attack.

Once teams are aware of all affected systems and resources, they can begin ejecting attackers and eliminating malware from systems. This phase continues until all traces of the attack are removed. In some cases, this may require taking systems off-line so assets can be replaced with clean versions in recovery.

Recovery: 

Security teams need to validate that all affected systems are no longer compromised and can be returned to working condition. This also requires setting timelines to fully restore operations and continued monitoring for any abnormal network activity. At this stage, it becomes possible to calculate the cost of the breach and subsequent damage.

Lessons Learned: 

One of the most important and often overlooked stages. During this stage, the incident response team and partners meet to determine how to improve future efforts. This can involve evaluating current policies and procedures, as well specific decisions the team made during the incident. Final analysis should be condensed into a report and used for future training.

·         Incident Response Team

An incident response team is a team responsible for enacting your IRP(Incident Response Plan). This team is sometimes also referred to as a computer security incident response team (CSIRT), cyber incident response team (CIRT), or a computer emergency response team (CERT).

The key duties of your CSIRT are to prevent, manage, and respond to security incidents. This can involve researching threats, developing policies and procedures, and training end users in cybersecurity best practices.

An IRP(Incident Response Plan) is a set of documented procedures detailing the steps that should be taken in each phase of incident response. It should include guidelines for roles and responsibilities, communication plans, and standardized response protocols.

Intrusion detection system (IDS)

An intrusion detection system (IDS) is a system that monitors network traffic for suspicious activity and alerts when such activity is discovered. It is a software application that scans a network or a system for the harmful activity or policy breaching. 

Intrusion prevention systems monitor network packets inbound the system to check the malicious activities involved in it and at once send the warning notifications.

While anomaly detection and reporting are the primary functions of an IDS, some intrusion detection systems are capable of taking actions when malicious activity or anomalous traffic is detected, including blocking traffic sent from suspicious Internet Protocol (IP) addresses.

Different types of intrusion detection systems: 

Network intrusion detection system (NIDS) 

A network intrusion detection system (NIDS) is deployed at a strategic point or points within the network, where it can monitor inbound and outbound traffic to and from all the devices on the network.

Host intrusion detection system (HIDS)

A host intrusion detection system (HIDS) runs on all computers or devices in the network with direct access to both the internet and the enterprise's internal network. A HIDS has an advantage over an NIDS in that it may be able to detect anomalous network packets that originate from inside the organization or malicious traffic that an NIDS has failed to detect.

A HIDS may also be able to identify malicious traffic that originates from the host itself, such as when the host has been infected with malware and is attempting to spread to other systems.

Protocol-based Intrusion Detection System (PIDS)

Organizations set up a Protocol-based Intrusion Detection System at the front end of the server. It interprets the protocols between the server and the user. PIDS monitors the HTTPS server regularly to secure the web. Similarly, it allows the HTTP server which is related to the protocol.

Application Protocol-based IDS (APIDS)

APIDS is set up within a group of servers. It interprets communication with the applications within the server to detect the intrusion. It identifies the intrusions by monitoring and interpreting the communication on application-specific protocols.

Hybrid Intrusion Detection System

Hybrid Intrusion Detection system is a mixture of two different IDS. Hybrid System develops a network system by combining host agents with network information. In conclusion, Hybrid System is more responsive and effective as compared to other IDS.

Types of Intrusion Detection Systems Methods

There are two main Intrusion Detection methods to identify malicious attacks or intrusion.

1. Signature-based Intrusion Detection Method

The IDS developed the Signature-based intrusion detection method to examine the network traffic and to detect attack patterns.

Signature-based IDS detects the attacks on the basis of the specific patterns such as number of bytes or number of 1’s or number of 0’s in the network traffic. It also detects on the basis of the already known malicious instruction sequence that is used by the malware. The detected patterns in the IDS are known as signatures.

Signature-based IDS can easily detect the attacks whose pattern (signature) already exists in system but it is quite difficult to detect the new malware attacks as their pattern (signature) is not known.

2. Anomaly-based Intrusion Detection Method

Organizations use the anomaly-based intrusion detection method to identify new and unknown suspicious attacks and policy breaching which the Signature-based detection method cannot identify easily.

In anomaly-based IDS there is use of machine learning to create a trustful activity model and anything coming is compared with that model and it is declared suspicious if it is not found in model.

3. Hybrid Detection Method

A Hybrid method uses both Signature and Anomaly-based intrusion detection methods together. However, the main reason behind the development of a hybrid detection system is to identify more potential attacks with fewer errors

Benefits of intrusion detection systems

Intrusion detection systems offer organizations several benefits, starting with the ability to identify security incidents.

An IDS can be used to help analyze the quantity and types of attacks. Organizations can use this information to change their security systems or implement more effective controls.

An intrusion detection system can also help companies identify bugs or problems with their network device configurations. These metrics can then be used to assess future risks.

Ethical Hacking

Ethical Hacking is an authorized practice of bypassing system security to identify potential data breaches and threats in a network. 

Ethical hacking is a subpart of cyber security. It involves finding vulnerabilities and reporting them to the system’s owner.

Ethical hackers hack into the system to find the flaws in the system and keep it safe.

Ethical hackers aim to investigate the system or network for weak points that malicious hackers can exploit or destroy. They collect and analyze the information to figure out ways to strengthen the security of the system/network/applications.

Type of Hackers

i. “White Hat” hacking – practice of ethical hacking

ii. “Black Hat” hacking describes practices involving security violations. The Black Hat hackers use illegal techniques to compromise the system or destroy information.

iii. “Grey Hat” hacking - “Grey Hat” hackers don’t ask for permission before getting into your system. But Grey Hats are also different from Black Hats because they don’t perform hacking for any personal or third-party benefit. These hackers do not have any malicious intention and hack systems for fun or various other reasons, usually informing the owner about any threats they find. Grey Hat and Black Hat hacking are both illegal as they both constitute an unauthorized system breach, even though the intentions of both types of hackers differ.

Ethical Hacker Roles and Responsibilities

Ethical Hackers must follow certain guidelines in order to perform hacking legally.

The most important rules of Ethical Hacking:

• An ethical hacker must seek authorization from the organization that owns the system. Hackers should obtain complete approval before performing any security assessment on the system or network.
• Determine the scope of their assessment and make known their plan to the organization.
• Report any security breaches and vulnerabilities found in the system or network.
• Keep their discoveries confidential. As their purpose is to secure the system or network, ethical hackers should agree to and respect their non-disclosure agreement.
• Erase all traces of the hack after checking the system for any vulnerability. It prevents malicious hackers from entering the system through the identified loopholes.

Phases of Ethical Hacking

The five phases of ethical hacking (not necessarily a hacker has to follow these 5 steps in a sequential manner) are:

Phase 1: Reconnaissance 

This phase is also called as Footprinting and information gathering Phase, and int this phase hacker gathers information about a target before launching an attack.  It is during this phase that the hacker finds valuable information such as old passwords, names of important employees.

Footprinting is a method that used for collecting data from target system. These data include important areas such as:

1. Finding out specific IP addresses
2. TCP and UDP services
3. Identifies vulnerabilities

There are also other ways to do footprinting, including impersonating a website by mirroring it, using search engines to find information about the organization, and even using the information of current employees for impersonation. 

Phase 2: Scanning 

In this phase, hackers are probably seeking any information that can help them perpetrate attack such as computer names, IP addresses, and user accounts. In fact, hacker identifies a quick way to gain access to the network and look for information. This phase includes usage of tools like dialers, port scanners, network mappers, sweepers, and vulnerability scanners to scan data.

Basically, at this stage, four types of scans are used:

1. Pre-attack: Hacker scans the network for specific information based on the information gathered during reconnaissance.
2. Port scanning/sniffing: This method includes the use of dialers, port scanners, and other data-gathering equipment.
3. Vulnerability Scanning: Scanning the target for weaknesses/vulnerabilities.
4. Information extraction: In this step, hacker collects information about ports, live machines and OS details, topology of network, routers, firewalls, and servers.

Phase 3: Gaining Access

At this point, the hacker has all the information to attack. The hacker gains access to the system, applications, and network, and escalates their user privileges to control the systems connected to it.

Phase 4: Maintaining Access 

Once a hacker has gained access to the system, they keep that access for future exploitation and attacks. The hacker secures access to the organization’s Rootkits and Trojans and uses it to launch additional attacks on the network.

The hacker from this point creates a new administrator account for themselves based on the naming structure and tries to blend in. 

Phase 5: Clearing Tracks

An intelligent hacker always clears all evidence so that in the later point of time, no one will find any traces leading to hacker.

A hacker clears his traces by

1. Clearing the cache and cookies
2. Modifying registry values
3. Modifying/corrupting/deleting the values of Logs
4. Clearing out Sent emails
5. Closing all the open ports
6. Uninstalling all applications that he/she be used

Denial-of-service (DoS)

A denial-of-service (DoS) attack is a security threat that occurs when an attacker makes it impossible for legitimate users to access computer systems, network, services or other information technology (IT) resources.

Attackers in these types of attacks typically flood web servers, systems or networks with traffic and makes it difficult or impossible for anyone else to access them.

DoS attacks do not typically result in the theft or loss of significant information or other assets, they can cost the victim a great deal of time and money to handle.

The general methods of DoS attacks are known as flooding services or crashing services.

Flood attacks occur when the system receives too much traffic for the server to buffer, causing them to slow down and eventually stop. Some of flood attacks are:

Buffer overflow attacks – the most common DoS attack. The concept is to send more traffic to a network address than the programmers have built the system to handle.

ICMP (Internet Control Message Protocol) flood – leverages misconfigured network devices by sending spoofed packets that ping every computer on the targeted network, instead of just one specific machine. The network is then triggered to amplify the traffic. This attack is also known as the smurf attack or ping of death.

SYN flood – sends a request to connect to a server, but never completes the handshake. Continues until all open ports are saturated with requests and none are available for legitimate users to connect to.

Other DoS attacks simply exploit vulnerabilities that cause the target system or service to crash. In these attacks, input is sent that takes advantage of bugs in the target that subsequently crash or severely destabilize the system, so that it can’t be accessed or used.

Steps to overcome DoS

 There is no way to completely avoid becoming a target of a DoS but there are proactive steps administrators can take to reduce the effects of an attack on their network.

• Enroll in a DoS protection service that detects abnormal traffic flows and redirects traffic away from your network. The DoS traffic is filtered out, and clean traffic is passed on to your network.
• Create a disaster recovery plan to ensure successful and efficient communication, mitigation, and recovery in the event of an attack.

It is also important to take steps to strengthen the security posture of all of your internet-connected devices in order to prevent them from being compromised.

• Install and maintain antivirus software.
• Install a firewall and configure it to restrict traffic coming into and leaving your computer.
• Evaluate security settings and follow good security practices in order to minimize the access other people have to your information, as well as manage unwanted traffic

Detecting a DoS attack

The best way to detect and identify a DoS attack would be via network traffic monitoring and analysis. Network traffic can be monitored via a firewall or intrusion detection system. An administrator may even set up rules that create an alert upon the detection of an anomalous traffic load and identify the source of the traffic or drops network packets that meet a certain criteria.

The following symptoms could indicate a DoS attack:

• Unusually slow network performance (opening files or accessing websites),
• Unavailability of a particular website, or
• An inability to access any website.

Deception

Cyber security deception is a defense practice that aims to deceive attackers by distributing a collection of traps and decoys across system’s infrastructure to imitate genuine assets.

Aim of deception is to prevent a cyber criminal that has managed to infiltrate a network from doing significant damage.

Deception technology is a simple but effective approach to build security defenses that detect threats early with minimal performance impact on the network.

Decoys are realistic but fake assets (domains, databases, servers, apps ,files, credentials etc)

Decoys are deployed along legitimate assets. If an attacker breached the network, there is no way to differentiate the fake from real. The moment attacker interacts with a decoy, a silent alarm is raised and systems collect information on the attacker’s actions and intent.

Advantages of Deception Technology

The advantages of deception technology are:

1. Improved Threat Detection

‘periscope events’ — a behavior that, when detected, clearly indicates that an attacker is in the network. Deception’s periscope events highly accurate, but with broad threat coverage.

2. Business Risk Awareness

Deception is aligned with the current business threat perception. For example, a company can create deception around that product launch, aligning security controls tightly to areas where the organization perceives risk.

3. Greater Coverage

Deception can be applied across the enterprise, including environments that are often neglected blind spots.

Deception can detect threats at the perimeter, the endpoint, the network, Active Directory, and application layers, as well as offer coverage to more neglected environments such as IoT, and cloud.

Deception also covers the entire kill-chain; from pre-attack reconnaissance to exploitation, privilege escalation, lateral movement, and data-theft / destruction.

4. Extremely Low False Positives

False positives cripple security team productivity. Deception has an intrinsic low false-positive property.

Most behavior-based systems try to establish a normal baseline and then classify any activity above the baseline as anomalous; this leads to a number of false positives. Deception establishes a zero-activity normal baseline, where any activity at all is worthy of investigation.

5. Orchestrated Response

Orchestrated / automated response is most useful only when the trigger event is 100% certain. Plenty of orchestration tooling is being built, not many real-world transformational orchestration use cases exist because there are very few alerts that are 100% certain.

In terms of containment / response use cases, deception alerts can integrate with:

• Network Access Control to Quarantine a compromised asset 
• Web gateways to disable the compromised asset’s Internet access, block phishing sites identified by email decoys.
• Endpoint protection to kill a suspicious process or quarantine the endpoint 
• Directory Services / Identity and Access Management to disable the user’s account, change a password, and enable/enforce two-factor authentication
• Firewalls  to dynamically deny access to network segments

Deception technology provides security teams with a number of tactics and resulting benefits to help:

• Decrease attacker dwell time on their network
• Expedite the average time to detect and remediate threats
• Reduce alert fatigue 
• Produce metrics surrounding indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs).

Biometrics

Biometrics allows a person to be identified and authenticated based on recognizable and verifiable data, unique and specific. 

Biometrics is the most suitable means of identifying and authenticating individuals in a reliable and fast way through unique biological characteristics.

Biometrics are biological measurements — or physical characteristics — that can be used to identify individuals. For example, fingerprint mapping, facial recognition, and retina scans are all forms of biometrics.

Types of biometrics

The two main types of biometric identifiers are either physiological characteristics or behavioral characteristics.

Physiological identifiers relate to the composition of the user being authenticated and include the following:

• facial recognition
• fingerprints
• finger geometry (the size and position of fingers)
• iris recognition
• retina scanning
• voice recognition
• DNA (deoxyribonucleic acid) matching

 

Behavioral identifiers include the unique ways in which individuals act, including recognition of typing patterns, mouse and finger movements, website and social media engagement patterns, walking gait and other gestures.

Advantages and disadvantages of biometrics

Biometrics are beneficial for the following reasons:

• hard to fake or steal, unlike passwords;
• easy and convenient to use;
• generally, the same over the course of a user's life;
• nontransferable; and
• Efficient because templates take up less storage.

Disadvantages, however, include the following:

• It is costly to get a biometric system up and running.
• If the system fails to capture all of the biometric data, it can lead to failure in identifying a user.
• Databases holding biometric data can still be hacked.
• Errors such as false rejects and false accepts can still happen.
• If a user gets injured, then a biometric authentication system may not work -- for example, if a user burns their hand, then a fingerprint scanner may not be able to identify them.