11.2.2.

6 Lab- Researching Network threats

Part 1: Exploring the SANS website

Step 1: Locate SANS resources
Internet storm center
Handler's Diary
Tools
Reports
Presentations and Papers

SANS technology institute
Security Lab
Leadership Lab
Security Musings
Student Projects
Presentations
Book Reviews

Securing the human
Presentations
Newsletter
Top Security Terms
Tip of The Day

Step 2: Locate the top 20 Critical controls

Software secutity
Blog
How To Guides
Webcasts

Step 3: Locate the newsletter menu

Current Security Newsletters -
SANS NewsBites - SANS NewsBites is a semiweekly high-level executive summary of the most
important news articles that have been published on computer security during the last week.
@RISK: The Consensus Security Alert - @RISK provides a reliable weekly summary of newly
discovered attack vectors, vulnerabilities with active new exploits, insightful explanations of how recent
attacks worked, and other valuable data.
Ouch! - provides pointers to great resources like the amazing Phishing Self-Test.

Part 2: Identify recent network security threats

Step 1: Locate the @risk: consensus security alert newsletter archive

@RISK: The Consensus Security Vulnerability Alert
Vol. 14, Num. 35

@RISK: The Consensus Security Vulnerability Alert
Vol. 14, Num. 21

@RISK: The Consensus Security Vulnerability Alert
Vol. 14, Num. 05

@RISK: The Consensus Security Vulnerability Alert
Vol. 14, Num. 02

Step 2: Identify site providing recent security threat information

Security Bloggers Network - A huge network of security bloggers covering a wide variety of
topics.

Uncommon Sense Security - Run by security expert Jack Daniel. His postings about trust and
privacy are particularly useful.

Darknet - A blog that focuses on ethical hacking, penetration testing and computer security.

Step 3: Detail a specific Network Security attack

Name of attack : Password based attack
Type of attack : password-based access control
Computer / organization afftected : Older applications do not always protect identity
information as it is passed through the network for validation. This might allow an eavesdropper
to gain access to the network by posing as a valid user.
How it works and what it did : When an attacker finds a valid user account, the attacker has the
same rights as the real user. Therefore, if the user has administrator-level rights, the attacker
also can create accounts for subsequent access at a later time.
After gaining access to your network with a valid account, an attacker can do any of the
following:

Obtain lists of valid user and computer names and network information.
Modify server and network configurations, including access controls and routing tables.
Modify, reroute, or delete your data.

References :
Montoro, Massimiliano (2009). "Brute-Force Password Cracker". Oxid.it. Retrieved 13 August
2013.
2.Jump up ^ Lundin, Leigh (2013-08-11). "PINs and Passwords, Part 2". Passwords. Orlando:
SleuthSayers.
3.Jump up ^ Elcomsoft Wireless Security Auditor, HD5970 GPU, accessed 2011-2-11
4.Jump up ^ oclHashcat-lite advanced password recovery. Hashcat.net. Retrieved on 2013-01-
31.
5.Jump up ^ Alexander, Steven. (June 20, 2012) The Bug Charmer: How long should passwords
be?. Bugcharmer.blogspot.com. Retrieved on 2013-01-31.
6.Jump up ^ Cryptohaze Blog: 154 Billion NTLM/sec on 10 hashes. Blog.cryptohaze.com (2012-
07-15). Retrieved on 2013-01-31.
7.Jump up ^ John the Ripper benchmarks. openwall.info (2010-03-30). Retrieved on 2013-01-31.
8.Jump up ^ "Electronic Authentication Guideline" (PDF). NIST. Retrieved March 27, 2008.
9.Jump up ^ "64-bit key project status". Distributed.net. Retrieved March 27, 2008.
10.Jump up ^ ElcomSoft Password Recovery Speed table, NTLM passwords, Nvidia Tesla S1070
GPU, accessed 2011-2-1

Reflection :
What steps can you take to protect your own computer ?

Update your computer, Use anti virus software, Use a firewall, block spyware.

What are some important steps that organizations can take to protect their resource?

Change default passwords and account names in place when your computer system was
installed.
Use encryption software to protect customers financial information from theft during
transactions.
Update your computer operating systems.