Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance...
Transcript of Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance...
![Page 1: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/1.jpg)
ISA 330 Introduction to Proactive System Security
Philip Robbins – August 31, 2013
Ethical Hacking
Information Security & Assurance ProgramUniversity of Hawai'i West Oahu
Week #1
1
![Page 2: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/2.jpg)
2
Ethical Hacking
Topics• Introductions• Syllabus Review• Fundamentals of Ethical Hacking• Class Discussion• Tools• Security Resources• Review Questions, Q&A
![Page 3: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/3.jpg)
3
IntroductionsWho am I?• Information Systems Authorizing Official Representative
‐ United States Pacific Command (USPACOM)‐ Risk Management Field‐ Assessments to USPACOM Authorizing Official / CIO
• Former Electronics & Environmental Engineer• Bachelor of Science in Electrical Engineering• Master of Science in Information Systems• Ph.D. Student in Communication & Information Sciences• Certified Information Systems Security Professional (CISSP) and Project
Management Professional (PMP)
![Page 4: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/4.jpg)
4
SyllabusClass Textbook
![Page 5: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/5.jpg)
5
Fundamentals
“A locked door keeps an honest man out.”
![Page 6: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/6.jpg)
6
Fundamentals• Introduction to Proactive System Security
What this class IS about:An introductory course in adopting a proactive (v.s. reactive) stance towards systems security.
What this class IS NOT about:An offensive class in hacking.
How does one better understand how to defend against system security attacks?By performing and testing against them.
![Page 7: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/7.jpg)
7
Fundamentals• In the news:
Facebook CEO personal pagehacked by Palestinian white hat.
Chinese suffers largest internetattack in history.
Syrian Electronic Army takesdown the New York Times.
http://www.cnn.com/video/data/2.0/video/world/2013/08/19/worldone‐clancy‐zuckerberg‐facebook‐security‐flaw.cnn.htm
![Page 8: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/8.jpg)
8
Fundamentals• In the news:
Facebook CEO personal pagehacked by Palestinian white hat.
Chinese suffers largest internetattack in history.
Syrian Electronic Army takesdown the New York Times.
http://money.cnn.com/2013/08/26/technology/china‐cyberattacks/index.html
![Page 9: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/9.jpg)
9
Fundamentals• In the news:
Facebook CEO personal pagehacked by Palestinian white hat.
Chinese suffers largest internetattack in history.
Syrian Electronic Army takesdown the New York Times.
http://www.cnn.com/2013/08/30/opinion/lewis‐hackers‐nyt/index.html?iref=allsearch
![Page 10: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/10.jpg)
10
Fundamentals• What is Hacking?
Classical Definition:Seeking to understand computer systems strictly for the love of having that knowledge.
Modern Definition:Illegal access to computer or network systems.
BEFORE
NOW
![Page 11: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/11.jpg)
11
Fundamentals• What is a “Hacker”?
![Page 12: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/12.jpg)
12
![Page 13: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/13.jpg)
13
Fundamentals
Who/what is a “Cracker”?
Term used to describe a hacker with malicious intent.
Crackers (cyber criminals) get into all kinds of mischief, including breaking or "cracking" copy protection on software programs, breaking into systems and causing
harm, changing data, or stealing.
![Page 14: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/14.jpg)
14
Fundamentals• “Hacker” v.s. “Cracker”?‐ Today there’s no real distinction between the two terms.
Hacker = Cracker
However…‐ Some hackers regard crackers as less educated.‐ Some crackers don’t create their own work; simply steal other people's work to cause mischief, or for personal gain.
![Page 15: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/15.jpg)
15
Fundamentals• Who are “Script kiddies”?
‐ Unskilled individuals who use scripts or programs developed by knowledgeable programmers to attack computer systems.
‐ Generally considered “posers” or “kiddies” lacking the ability to write sophisticated scripts or programs on their own.
‐ Usually seeking to gain credit or impress their friends.
![Page 16: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/16.jpg)
16
FundamentalsWhat is an “Ethical Hacker”?• Oxymoron: Honest Criminal
‐ A new breed of network defenders.
‐ Performs the same activities a hacker does but with the owner / company’s permission.
‐ Usually contracted to perform penetration testing.
![Page 17: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/17.jpg)
17
Fundamentals• Penetration Testing‐ Discover vulnerabilities.‐ Perform attack and penetration assessments.‐ Perform discovery and scanning for open ports & services.‐ Apply exploits to gain access and expand access as necessary.‐ Activities involving application penetration testing and application source review.‐ Interact with the client as required.‐ Produce reports documenting discoveries during the engagement.‐ Report your findings with the client at the conclusion of each engagement.
v.s.• Security Testing+ Participate in research and provide recommendations for improvement.+ Participate in knowledge sharing.
![Page 18: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/18.jpg)
18
Fundamentals• Why perform Penetration Tests?
![Page 19: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/19.jpg)
19
Fundamentals• Steps for a Penetration TestStep #1: Planning Phase‐ Scope & Strategy of the assignment is determined.‐ Existing security policies and standards are used for defining the scope.
Step #2: Discovery Phase‐ Collect as much information as possible about the system including data in the system, user names and even passwords (fingerprinting). ‐ Scan and Probe into the ports.‐ Check for vulnerabilities of the system.
Step #3: Attack Phase‐ Find exploits for various vulnerabilities.‐ Obtain necessary security Privileges to exploit the system & exploit.
![Page 20: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/20.jpg)
20
Fundamentals• Steps for a Penetration TestStep #4: Reporting Phase‐ Report must contain detailed findings.‐ Risks of vulnerabilities found and their impact on business‐ Recommendations for solutions, if any (Security Testing).
![Page 21: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/21.jpg)
21
Fundamentals• Penetration Testing Limitations‐ Can’t find all the vulnerabilities on a system.‐ Time for tester‐ Budget‐ Scope‐ Skills of testers‐ Data loss and corruption‐ Downtime for organization‐ Increased costs for organization*
* How could pen testing decrease costs for an organization?
![Page 22: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/22.jpg)
22
Fundamentals• Roles & Responsibilities of the Pen‐Tester
‐ Testers should collect required information from the Organization to enable penetration tests (depending on the type of testing model).
‐ Find flaws that could allow hackers to attack a target machine.
‐ Pen Testers should think & act like real hackers (ethically).
‐Tester should be responsible for any loss in the system or information during the testing.
‐ Tester should keep data and information confidential.
![Page 23: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/23.jpg)
23
Fundamentals• Types of Pen‐Testing Methodologies
White Box Model‐ Tester is given the company network topology, info on technology used, and permission to interview all employees (including IT personnel).
Black Box Model‐ Tester is not given any information.‐ Management doesn’t tell staff about the pen test being conducted.‐ Help determine if company’s security personnel are able to detect attacks.
Gray Box Model‐ Hybrid of the white and black box models.‐ Tester may get partial information.
![Page 24: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/24.jpg)
24
Class Discussion• Which pen‐testing category / model closely mimics that of an insider threat?
• Which type of pen‐testing model is better suited for an organization on a extremely limited budget?
• Which pen‐testing model is most accurate? Which can be considered to have the greatest drawback?
![Page 25: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/25.jpg)
25
Class Discussion
![Page 26: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/26.jpg)
26
Fundamentals• Types of Hats
- White Hats (Ethical / Pen-Testers improving security) - Black Hats (Hackers / Crackers degrading security)- Grey Hats (In-between White and Black)- Red Hat (Enterprise Linux)
![Page 27: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/27.jpg)
27
Fundamentals• What can you do Legally? What about:
‐ Port scanning?‐ Possession of hacking tools?‐ Photographing?‐ ISP Acceptable Use Policy (AUP)?‐ Installing viruses on a computer network denying users?
In Hawaii, the state must prove that the person charged with committing a crime on a computer had the “intent to commit a crime.”
![Page 28: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/28.jpg)
28
Fundamentals• Federal Laws:
‐ Computer Fraud and Abuse Act, Title 18Crime to access classified information with authorization.
‐ Electronic Communication and Abuse ActIllegal to intercept any communication, regardless of how it was transmitted.
‐ Stored Wire and Electronic Communications andTransactional Records ActDefines unauthorized access to computers that store classified information.
![Page 29: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/29.jpg)
29
Class Discussion• What are the advantages of using a written contract when engaged in a computer consulting job?
• Why is it important that your attorney read over the contract before you sign it?
• What is upper management’s role for a penetration test?
![Page 30: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/30.jpg)
30
Class Discussion• Why do you think the government does not define a common law for computer‐related crimes, rather than allowing each state to address these issues?
![Page 31: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/31.jpg)
31
Fundamentals• Ethical Hacking in a Nutshell
‐ Must have a good understanding of networks & computer technology.
‐ Must be able to communicate with management & IT personnel.
‐ Must have an understanding of the laws that apply to your location.
‐ Must be able to apply the necessary tools to perform your tasks.
![Page 32: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/32.jpg)
32
Fundamentals• Professional Certifications
Certified Ethical Hacker (CEH)
Cisco Certified Network Associate (CCNA)
Project Management Professional (PMP)
Certified Information Systems SecurityProfessional (CISSP)
![Page 33: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/33.jpg)
33
Fundamentals• Careers
![Page 34: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/34.jpg)
34
Fundamentals• CEH 22 Domains
![Page 35: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/35.jpg)
35
Fundamentals• CEH: Domain #1
![Page 36: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/36.jpg)
36
Fundamentals• CEH: Domain #2
![Page 37: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/37.jpg)
37
Fundamentals• CEH: Domain #3
![Page 38: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/38.jpg)
38
Fundamentals• CEH: Domain #4
![Page 39: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/39.jpg)
39
Fundamentals• CEH: Domain #5
![Page 40: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/40.jpg)
40
Fundamentals• CEH: Domain #6
![Page 41: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/41.jpg)
41
Fundamentals• CEH: Domain #7
![Page 42: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/42.jpg)
42
Fundamentals• CEH: Domain #8
![Page 43: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/43.jpg)
43
Fundamentals• CEH: Domain #9
![Page 44: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/44.jpg)
44
Fundamentals• CEH: Domain #10
![Page 45: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/45.jpg)
45
Fundamentals• CEH: Domain #11
![Page 46: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/46.jpg)
46
Fundamentals• CEH: Domain #12
![Page 47: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/47.jpg)
47
Fundamentals• CEH: Domain #13
![Page 48: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/48.jpg)
48
Fundamentals• CEH: Domain #14
![Page 49: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/49.jpg)
49
Fundamentals• CEH: Domain #15
![Page 50: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/50.jpg)
50
Fundamentals• CEH: Domain #16
![Page 51: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/51.jpg)
51
Fundamentals• CEH: Domain #17
![Page 52: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/52.jpg)
52
Fundamentals• CEH: Domain #18
![Page 53: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/53.jpg)
53
Fundamentals• CEH: Domain #19
![Page 54: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/54.jpg)
54
Fundamentals• CEH: Domain #20
![Page 55: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/55.jpg)
55
Fundamentals• CEH: Domain #21
![Page 56: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/56.jpg)
56
Fundamentals• CEH: Domain #22
![Page 57: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/57.jpg)
57
ToolsBacktrack 5r3Ubuntu Linux Distribution providing a comprehensive collection of security‐related tools for digital forensics andpen testing use.
http://www.backtrack‐linux.org/downloads/
![Page 58: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/58.jpg)
58
ToolsKali Linux (a.k.a. Backtrack 6)A debian Linux Distribution rewritten from Backtrack. Preinstalled with numerous penetration‐testing programs, including nmap (a port scanner), Wireshark (a packet analyzer), John the Ripper (a password cracker), and Aircrack‐ng (a software suite for penetration‐testing wireless LANs).
http://www.kali.org/downloads
![Page 59: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/59.jpg)
59
ToolsMetasploitable 2.0Intentionally vulnerable Linux virtual machine.
http://www.offensive‐security.com/metasploit‐unleashed/Metasploitablehttp://sourceforge.net/projects/metasploitable/files/Metasploitable2/
![Page 60: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/60.jpg)
60
ToolsDamn Vulnerable Linux (DVL) 1.5 Infectious DiseaseOriginally formed from Slackware with the goal of being an intentionally vulnerable system for practice/teaching purposes in regards to Network and Computer Security. Now considered discontinued.
http://distrowatch.com/table.php?distribution=dvlhttp://download.vulnhub.com/dvl/DVL_1.5_Infectious_Disease.iso
![Page 61: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/61.jpg)
61
General Security Resources• Cyber Hui http://www.cyberhui.org/Cyber Hui is a community of Hawaii Cyber security professionals dedicated to sharing skills and knowledge with high school and college students. Join the Hui; check out their resources and discussion forums.
• SANS Institute http://www.sans.org/Source for information security training and security certification; develops, maintains, and makes available at nocost, a collection of research documents about various aspects of information security. Find whitepapers here that interest you.
• Symantec Connect http://www.securityfocus.com/Technical community for Symantec customers, end‐users, developers, and partners.
• SearchSecurity http://searchsecurity.techtarget.com/Online Information Security Magazine providing immediate access to late breaking industry news, virus alerts, new hacker threats and attacks.
• Internet Storm Center https://isc.sans.edu/forums/Diary+Discussions/Community forums, discussions, and daily podcasts on auditing, forensics, network security, pen testing.
![Page 62: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/62.jpg)
62
General Security Resources• CyberPatriot http://www.uscyberpatriot.org/CP5/Training.aspxAir Force Cyber Defense Competition.
![Page 63: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/63.jpg)
63
General Security Resources• IASE http://iase.disa.mil/policy‐guidance/Most comprehensive compilation of DoD Policies & Guidance documentation for Information Assurance .
![Page 64: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/64.jpg)
64
Review Questions• Question #1
The U.S. Department of Justice defines a hacker as whichof the following?
a. A person who accesses a computer or network without the owner’s permission.
b. A penetration tester.c. A person who uses telephone services without payment.d. A person who accesses a computer or network with the
owner’s permission.
![Page 65: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/65.jpg)
65
Review Questions• Question #1
The U.S. Department of Justice defines a hacker as whichof the following?
a. A person who accesses a computer or network without the owner’s permission.
b. A penetration tester.c. A person who uses telephone services without payment.d. A person who accesses a computer or network with the
owner’s permission.
![Page 66: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/66.jpg)
66
Review Questions• Question #2
A penetration tester is which of the following?
a. A person who accesses a computer or network without permission from the owner.
b. A person who uses telephone services without payment.c. A security professional who’s hired to hack into a network to
discover vulnerabilities.d. A hacker who accesses a system without permission but does
not delete or destroy files.
![Page 67: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/67.jpg)
67
Review Questions• Question #2
A penetration tester is which of the following?
a. A person who accesses a computer or network without permission from the owner.
b. A person who uses telephone services without payment.c. A security professional who’s hired to hack into a network to
discover vulnerabilities.d. A hacker who accesses a system without permission but does
not delete or destroy files.
![Page 68: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/68.jpg)
68
Review Questions• Question #3
Some experienced hackers refer to inexperiencedhackers who copy or use prewritten scripts or programsas which of the following?
a. Script Monkeyb. Packet Kiddies.c. Packet Monkeys.d. Script Kiddies.
![Page 69: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/69.jpg)
69
Review Questions• Question #3
Some experienced hackers refer to inexperiencedhackers who copy or use prewritten scripts or programsas which of the following?
a. Script Monkeyb. Packet Kiddies.c. Packet Monkeys.d. Script Kiddies.
![Page 70: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/70.jpg)
70
Review Questions• Question #4
A team composed of people with varied skills who attempt to penetrate a network is referred to as which of the following?
a. Green Teamb. Blue Teamc. Black Teamd. Red Team
![Page 71: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/71.jpg)
71
Review Questions• Question #4
A team composed of people with varied skills who attempt to penetrate a network is referred to as which of the following?
a. Green Teamb. Blue Teamc. Black Teamd. Red Team
![Page 72: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/72.jpg)
72
Review Questions• Question #5
What portion of your ISP contract might affect your ability to conduct a penetration test over the internet?
a. Scanning Policyb. Port Access Policyc. Acceptable Use Policyd. Warranty Policy
![Page 73: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/73.jpg)
73
Review Questions• Question #5
What portion of your ISP contract might affect your ability to conduct a penetration test over the internet?
a. Scanning Policyb. Port Access Policyc. Acceptable Use Policyd. Warranty Policy
![Page 74: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/74.jpg)
74
Review Questions• Question #6
Which federal law prohibits unauthorized access of classified information?
a. Computer Fraud and Abuse Act, Title 18b. Electronic Communication and Abuse Actc. Stored Wire and Electronic Communications and Transactional
Records Actd. Fourth Amendment
![Page 75: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/75.jpg)
75
Review Questions• Question #6
Which federal law prohibits unauthorized access of classified information?
a. Computer Fraud and Abuse Act, Title 18b. Electronic Communication and Abuse Actc. Stored Wire and Electronic Communications and Transactional
Records Actd. Fourth Amendment
![Page 76: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/76.jpg)
76
Review Questions• Question #7
Which federal law prohibits intercepting any communication, regardless of how it was transmitted?
a. Computer Fraud and Abuse Act, Title 18b. Electronic Communication and Abuse Actc. Stored Wire and Electronic Communications and Transactional
Records Actd. Fourth Amendment
![Page 77: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/77.jpg)
77
Review Questions• Question #7
Which federal law prohibits intercepting any communication, regardless of how it was transmitted?
a. Computer Fraud and Abuse Act, Title 18b. Electronic Communication and Abuse Actc. Stored Wire and Electronic Communications and Transactional
Records Actd. Fourth Amendment
![Page 78: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/78.jpg)
78
Review Questions• Question #8
Which federal law amended Chapter 119 of Title 18, U.S. Code?
a. Computer Fraud and Abuse Act, Title 18b. Electronic Communication and Abuse Actc. Stored Wire and Electronic Communications and Transactional
Records Actd. U.S. Patriot Act, Sec. 217: Interception of Computer Trespasser
Communications
![Page 79: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/79.jpg)
79
Review Questions• Question #8
Which federal law amended Chapter 119 of Title 18, U.S. Code?
a. Computer Fraud and Abuse Act, Title 18b. Electronic Communication and Abuse Actc. Stored Wire and Electronic Communications and Transactional
Records Actd. U.S. Patriot Act, Sec. 217: Interception of Computer
Trespasser Communications
![Page 80: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/80.jpg)
80
Review Questions• Question #9
To determine whether scanning is illegal in your area, you should do which of the following?
a. Refer to the U.S. codeb. Refer to the U.S. Patriot Actc. Refer to the state lawsd. Contact your ISP
![Page 81: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/81.jpg)
81
Review Questions• Question #9
To determine whether scanning is illegal in your area, you should do which of the following?
a. Refer to the U.S. codeb. Refer to the U.S. Patriot Actc. Refer to the state lawsd. Contact your ISP
![Page 82: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/82.jpg)
82
Review Questions• Question #10
As a security tester, what should you do before installing hacking software on your computer?
a. Check with local law enforcement agencies.b. Contact your hardware vendor.c. Contact your software vendor.d. Contact your ISP.
![Page 83: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/83.jpg)
83
Review Questions• Question #10
As a security tester, what should you do before installing hacking software on your computer?
a. Check with local law enforcement agencies.b. Contact your hardware vendor.c. Contact your software vendor.d. Contact your ISP.
![Page 84: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/84.jpg)
84
Review Questions• Question #11
Before using hacking software over the Internet, you should contact which of the following?
a. Your ISP.b. Your vendor.c. Local law enforcement authorities to check for complianced. The FBI
![Page 85: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/85.jpg)
85
Review Questions• Question #11
Before using hacking software over the Internet, you should contact which of the following?
a. Your ISP.b. Your vendor.c. Local law enforcement authorities to check for complianced. The FBI
![Page 86: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/86.jpg)
86
Review Questions• Question #12
Which organization issues the Top 20 list of current network vulnerabilities?
a. SANS Instituteb. ISECOMc. EC‐Councild. OPST
![Page 87: Ethical Hackingprobbins/UHWO.ISA330.FA13/W1...Ethical Hacking Information Security & Assurance Program University of Hawai'i West Oahu Week #1 1 2 Ethical Hacking Topics •Introductions](https://reader036.fdocuments.us/reader036/viewer/2022081623/613f2580a7a58608c268bd9e/html5/thumbnails/87.jpg)
87
Review Questions• Question #12
Which organization issues the Top 20 list of current network vulnerabilities?
a. SANS Instituteb. ISECOMc. EC‐Councild. OPST