I need help Discussion 1 - Week 2 Internet Vulnerabilities The Internet relies o

Question

I need help

Discussion 1 - Week 2

Internet Vulnerabilities

The Internet relies on the domain name system (DNS) to translate a domain name to an IP address. This along with the structure and routing of IP packets rely on cooperation among independently managed network components.

Utilize the Walden University Library websites devoted to Internet security and computer emergency readiness, and other resources to locate an article describing a specific IP weakness or vulnerability. The article should be a reliable source and no more than four years old. You might consider packet sniffing, denial of service attacks, spoofing, cache poisoning, or hijacking.

Post to this Discussion, a summary of the article in which you:

Describe the vulnerability

Explain how the IP and DNS structure allows that vulnerability

Describe strategies for identifying that an attack has taken place exploiting that vulnerability

Describe what reasonable steps might be taken to prevent this form of attack

Explanation / Answer

Ans:

vulnerability:

In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerabilities are the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness. In this frame, vulnerability is also known as the attack surface.

Explain how the IP and DNS structure allows that vulnerability:

major vulnerability in the way Mac OS X Server handles turning the names in Web sites and e-mail addresses into the numeric addresses used for connections. The vulnerability is a fundamental flaw in the Domain Name Service (DNS) protocol and affected all but a handful of DNS servers built into operating systems and released as stand-alone server software packages.

If exploited on an Internet service provider (ISP) or company's DNS server, an attacker would be able to redirect any user of that server to a destination of his or her choosing. Thus, while you might select Macworld.com from your bookmarks or type it into a browser's location field, and the browser shows you www.macworld.com in that Location field, you've actually downloaded the home page of a malicious website hosted by a bad guy who has loaded it with malware and phishing attempts.

Although Apple released a fix for all Macs running OS X 10.4.11 and 10.5.4 (Server and desktop, Intel and PowerPC, Leopard and Tiger), the fix only repaired the most vulnerable part of DNS, the server software, even on systems that don't use it. (The server software is installed, but not turned on, in the regular flavor of Mac OS X, and in OS X Server, DNS service has to be configured and activated.)

Client DNS software, used by an operating system to request a DNS lookup from a full-scale DNS server, is still at risk, but at a lower level and under more limited circumstances.

Describe strategies for identifying that an attack has taken place exploiting that vulnerability:

A vulnerability is a weak spot in your network that might be exploited by a security threat. Risks are the potential consequences and impacts of unaddressed vulnerabilities. In other words, failing to do Windows Updates on your Web server is vulnerability. Some of the risks associated with that vulnerability include loss of data, hours or days of site downtime and the staff time needed to rebuild a server after it’s been compromised.

Before you start searching around for weak spots in your network, we suggest you first review our Where and How to Find Vulnerabilities tool.

Key Actions

Describe what reasonable steps might be taken to prevent this form of attack:

Stay up to date with vulnerability news

A key plank in your strategy should be putting a process in place to ensure that every security bulletin is read and acted on in such a way as to mitigate any risks as quickly as possible. It's an obvious step, but one that often gets overlooked. The US Computer Emergency Readiness Team (US-CERT) produces email alerts while products like Secunia's Vulnerability Intelligence Manager can help you keep on top of the latest vulnerabilities for your particular IT infrastructure.

Scan for vulnerabilities

The only way that you can be sure that you have not missed a vulnerability or patched one ineffectively is to test your systems using a vulnerability scanner such as Rapid7 Nexpose or Tenable Nessus. "Every month we come across a customer who gets caught by the Conficker worm that was around five years ago! It's not hard to patch, but some people just don't patch properly, and that's why they get hacked," warned Smith

Be amenable to anything new

You can only patch against vulnerabilities in software that you know is being run in your organization. For that reason, Smith said it is important to embrace change, the cloud and anything else users might find new and interesting. If you are seen as the security person who says "no" to every innovation on security grounds, people will end up not talking to you and doing things behind your back. They'll simply use an iPad to access the cloud service that you ban, Smith said. "You have to make sure that you are in the thick of it. You can have influence as part of the process, but not if you are just the person who says 'no' at the end of the process. Don't block. Detect and monitor."

Train users, and back it up with testing

Finally, Smith pointed out that while automated attack tools try to gain entry onto your network through the "front door," targeted attacks use "back door" techniques such as spear-phishing -- sending "weaponized" emails with links to malware, or with malicious attachments -- to individuals in your organization.

Many organizations attempt to mitigate this risk through user education programs, although their effectiveness is likely to be limited unless they are reinforced and tested using tools like Phishme. These tools generate simulated phishing emails intended to entice users into clicking on an attachment or a malicious link, or supplying confidential information. They then report back on the number of users that would have fallen victim to the phishing attacks if they had been real. Thus, users who fall for the simulated scams can get additional training.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.