Hacking Hardware Ch 9. Getting in the Door Normal Key Link Ch 920 – (At bottom of my CNIT 124 page)
CNIT 123 Ch 1: Ethical Hacking Overview
Transcript of CNIT 123 Ch 1: Ethical Hacking Overview
![Page 1: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/1.jpg)
Chapter 1Ethical Hacking Overview Last modified 1-11-17
![Page 2: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/2.jpg)
Hands-On Ethical Hacking and Network Defense 2
Describe the role of an ethical hackerDescribe what you can do legally as an ethical hackerDescribe what you cannot do as an ethical hacker
![Page 3: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/3.jpg)
![Page 4: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/4.jpg)
Hands-On Ethical Hacking and Network Defense 4
Ethical hackers▪ Employed by companies to perform penetration testsPenetration test▪ Legal attempt to break into a company’s network to find its
weakest link▪ Tester only reports findings, does not solve problemsSecurity test▪ More than an attempt to break in; also includes analyzing
company’s security policy and procedures ▪ Tester offers solutions to secure or protect the network
![Page 5: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/5.jpg)
Hands-On Ethical Hacking and Network Defense 5
Hackers▪ Access computer system or network without authorization▪ Breaks the law; can go to prisonCrackers▪ Break into systems to steal or destroy data▪ U.S. Department of Justice calls both hackersEthical hacker▪ Performs most of the same activities but with owner’s permission
![Page 6: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/6.jpg)
Hands-On Ethical Hacking and Network Defense 6
Script kiddies or packet monkeys▪ Young inexperienced hackers▪ Copy codes and techniques from knowledgeable hackersExperienced penetration testers write programs or scripts using these languages▪ Practical Extraction and Report Language (Perl), C, C++,
Python, JavaScript, Visual Basic, SQL, and many othersScript▪ Set of instructions that runs in sequence
![Page 7: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/7.jpg)
This class alone won’t make you a hacker, or an expert▪ It might make you a script kiddieIt usually takes years of study and experience to earn respect in the hacker communityIt’s a hobby, a lifestyle, and an attitude▪ A drive to figure out how things work
Hands-On Ethical Hacking and Network Defense 7
![Page 8: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/8.jpg)
Hands-On Ethical Hacking and Network Defense 8
Tiger box▪ Collection of OSs and hacking tools▪ Usually on a laptop▪ Helps penetration testers and security testers
conduct vulnerabilities assessments and attacks
![Page 9: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/9.jpg)
Hands-On Ethical Hacking and Network Defense 9
White box model▪ Tester is told everything about the network topology
and technology▪ Network diagram
▪ Tester is authorized to interview IT personnel and company employees
▪ Makes tester’s job a little easier
![Page 10: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/10.jpg)
Hands-On Ethical Hacking and Network Defense 10
Black box model▪ Company staff does not know about the test▪ Tester is not given details about the network▪ Burden is on the tester to find these details
▪ Tests if security personnel are able to detect an attack
![Page 11: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/11.jpg)
Hands-On Ethical Hacking and Network Defense 11
Gray box model▪ Hybrid of the white and black box models▪ Company gives tester partial information
![Page 12: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/12.jpg)
![Page 13: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/13.jpg)
Hands-On Ethical Hacking and Network Defense 13
Basics: ▪ CompTIA Security+ (CNIT 120)▪ Network+ (CNIT 106 or 201)
![Page 14: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/14.jpg)
14
CNIT 123: Ethical Hacking and Network DefenseCNIT 124: Advanced Ethical Hacking
![Page 15: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/15.jpg)
15
Issued by the International Information Systems Security Certifications Consortium (ISC2)▪ Usually more concerned with
policies and procedures than technical details
CNIT 125: Information Security Professional PracticesWeb site: www.isc2.org
![Page 16: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/16.jpg)
Hands-On Ethical Hacking and Network Defense 16
SysAdmin, Audit, Network, Security (SANS)Offers certifications through Global Information Assurance Certification (GIAC)Top 20 list▪ One of the most popular SANS Institute documents▪ Details the most common network exploits▪ Suggests ways of correcting vulnerabilitiesWeb site▪ www.sans.org (links Ch 1i & Ch 1j)
![Page 17: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/17.jpg)
![Page 18: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/18.jpg)
Hands-On Ethical Hacking and Network Defense 18
Laws involving technology change as rapidly as technology itselfFind what is legal for you locally▪ Laws change from place to place Be aware of what is allowed and what is not allowed
![Page 19: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/19.jpg)
Hands-On Ethical Hacking and Network Defense 19
Tools on your computer might be illegal to possessContact local law enforcement agencies before installing hacking toolsWritten words are open to interpretationGovernments are getting more serious about punishment for cybercrimes
![Page 20: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/20.jpg)
Hands-On Ethical Hacking and Network Defense 20
Some states deem it legalNot always the caseFederal Government does not see it as a violation▪ Allows each state to address it separately Read your ISP’s “Acceptable Use Policy”
IRC “bots” may be forbidden▪ Program that sends automatic responses to users▪ Gives the appearance of a person being present
![Page 21: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/21.jpg)
Hands-On Ethical Hacking and Network Defense 21
www.ccsf.edu/Policy/policy.shtml (link Ch 1k)
![Page 22: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/22.jpg)
Hands-On Ethical Hacking and Network Defense 22
Federal computer crime laws are getting more specific▪ Cover cybercrimes and intellectual property issuesComputer Hacking and Intellectual Property (CHIP)▪ New government branch to address cybercrimes and
intellectual property issues
![Page 23: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/23.jpg)
Hands-On Ethical Hacking and Network Defense 23
![Page 24: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/24.jpg)
Hands-On Ethical Hacking and Network Defense 24
Accessing a computer without permission is illegalOther illegal actions▪ Installing worms or viruses▪ Denial of Service attacks▪ Denying users access to network resourcesBe careful your actions do not prevent customers from doing their jobs
![Page 25: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/25.jpg)
Hands-On Ethical Hacking and Network Defense 25
Using a contract is just good businessContracts may be useful in courtBooks on working as an independent contractor▪ The Computer Consultant’s Guide by Janet Ruhl▪ Getting Started in Computer Consulting by Peter MeyerInternet can also be a useful resourceHave an attorney read over your contract before sending or signing it
![Page 26: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/26.jpg)
Hands-On Ethical Hacking and Network Defense 26
What it takes to be a security tester▪ Knowledge of network and computer technology▪ Ability to communicate with management and IT
personnel▪ Understanding of the laws▪ Ability to use necessary tools
![Page 27: CNIT 123 Ch 1: Ethical Hacking Overview](https://reader033.fdocuments.in/reader033/viewer/2022042723/587eba0b1a28abbb688b69ef/html5/thumbnails/27.jpg)
27