This chapter is from the book
This chapter is from the book
This chapter is from the book
Test Your Skills
Multiple Choice Questions
Which of the following scanners provides information regarding the target system’s registry?
- Cerberus
- NetCop
- NetBrute
- Active Ports
What is the minimum level of security (using the chapter’s 1–10 scale) that any organizational network should have?
- 1
- 3
- 5
- 7
Which of the following is the most fundamental aspect of security?
- Shutting down unused services
- Implementing an IDS
- Patching the operating system
- Conducting periodic security audits
What is the best device, method, or technique to help you be aware of attacks in progress?
- Server logs
- Firewall logs
- IDS
- NAT
VPNs should be used for what type of communications?
- All external connections to your network
- All external connections that might transmit sensitive data
- All internal communications
- All internal communications that might transmit sensitive data
What is not a primary reason for documenting your security activities and audits?
- To prove due diligence in case of litigation
- To provide information in case of any external or internal audit
- To get new personnel up to speed on the current state of security
- To demonstrate how much work the network administrators actually do
Which of the following is the least necessary security device/software?
- Firewall at the perimeter
- Anti-spyware on all machines
- Antivirus on all machines
- Encryption for all internal transmissions
How should used media be disposed of?
- It should not be. It should be archived.
- It should be disposed of normally after 5 years.
- It should be destroyed thoroughly prior to disposal.
- It should be archived and never destroyed if it contains sensitive data.
Which of the following utilities can reveal shared drives on a system?
- NetCop
- NetBrute
- NetGuard
- NetMaster
Which of the following scanners provides information about the Windows Registry?
- NetCop
- SATAN
- Cerberus
- SAINT
Which of the following scanners is a Unix-only tool popular with hackers?
- NetCop
- SATAN
- Cerberus
- SAINT
What is the most distinctive feature of SAINT?
- Its registry report
- Its prioritization of vulnerabilities
- Its scans for shared drives
- Its capability to map network traffic
What is the most important reason to use NetStat or NetStat Live?
- To detect DoS attempts
- To find registry vulnerabilities
- To check passwords
- To determine normal network traffic
What is the best approach when using scanners?
- Pick any single scanner and use it.
- Use three or four different scanners.
- Find the most thorough scanner and use it.
- Use every scanner type you can find.
What tools, besides port and security scanners, might you wish to use to assess security?
- An IDS
- A firewall
- A virus
- A password cracker
Exercises
Exercise 12.1: Using NetBrute
- Download NetBrute and install it according to the instructions found in the product.
- Scan either a laboratory computer or your own PC for open ports.
- Document what you find. Also note anything that NetBrute provides that NetCop did not.
Exercise 12.2: Using Cerberus
- Download Cerberus and install it according to the instructions found in the product.
- Scan either a laboratory computer or your own PC for open ports.
- Note what you found that neither NetCop nor NetBrute detected.
Exercise 12.3: Using SATAN
Note: This exercise requires a Unix-based operating system
- Download SATAN and install it according to the instructions found in the product.
- Scan either a laboratory computer or your own PC for open ports.
- Document what you find. Particularly note any differences between the results from SATAN and the Windows-based software.
Exercise 12.4: Using Other Port Scanners
- Download any other port scanner and install according to the instructions found.
- Scan either a laboratory computer or your own PC for open ports.
- Document differences between the results from that port scanner and NetCop, NetBrute, and Cerberus.
Exercise 12.5: Patching a System
- Take a lab machine, preferably one that has not been checked for patches in some time.
- Go to www.microsoft.com and run the Windows Update you will find on the left-hand side of the screen.
- Note how many critical and recommended patches the machine has.
Exercise 12.6: Physical Security
Note: This is ideal for a group exercise.
- Consider your educational institution. Examine (as much as possible) the physical security for servers and technology.
- Devise your own plan for improving security.
Your plan might include additions such as
- Biometrics
- Alarms
- Restricting access to keys
- Putting routers under lock and key
Projects
Project 12.1: Using the Security Rating Scale
Using the Security Rating Scale outlined at the beginning of this chapter, rate the security of your campus computer systems and network. Provide clear reasons for each of your ratings on the scale and recommendations for ways to improve the system’s security.
Project 12.2: Assessing Security Policies
Find an organization that will allow you to review their security policies. You can try inquiring at any place you work, asking friends and relatives if you might check with their company’s IT department, or checking with your college/university IT department. Make sure the organization has no objection to your review before you proceed.
The organization you review should have written security policies. Summarize the organization’s policies and make recommendations for changes you feel are needed to improve security there. You can also use resources that define appropriate security policies to compare against the policies of your chosen organization. Some sources for this information include:
- Information Security Policy World, 2004: www.information-security-policies-and-standards.com/
- Sans Institute, 2003: www.sans.org/resources/policies/
- Writing Information Security Policies by Scott Barn, 2001
Project 12.3: Performing a Full Audit
Note: This exercise requires a fully equipped lab (at least 10 machines) and is probably best done in groups.
You and your team should conduct a complete audit of the chosen lab and write a detailed account of what you find. The audit must include a review of lab policies, probing the machines, checking for patches, and all other items mentioned in this chapter.