Illeana Morales-Frazier
1/19/13
SEC 572:Week 2: You Decide

Information security threat and the steps we have taken to mitigate the risks associated with these threats.

External cyber-attacks are on the rise and have become a real challenge for network administrators as well as network design planners to ensure their respective networks are protected from external attacks resulting in loss of website availability, confidential data, and internal processes critical to mission objectives. Cyber-attacks can cost companies large sums of unrecoverable revenue associated with site downtime and possible compromise of sensitive confidential data. It is imperative today’s corporate network is configured and prepared to protect itself from external cyber-attacks. Since there is no 100% method to stop external cyber-attacks, attention to detail must be made in regards to proper configuration of the network to include state of the art hardware and software. To include current security patches for both software and hardware respectively. Additionally, hardware and software measures will be limited in their effectiveness without network policies and techniques to protect against external cyber-attacks such as Denial of Service, Distributed Denial of Service, Masquerading and IP Spoofing, Smurf Attacks, Land c Attacks, and Man-in-the-Middle attacks. In close coordination with our IS team engineers and IT network director an approved plan has been incorporated to minimize risk of an effective cyber-attack on our network. Specifically this plan covers a comprehensive review of current network design and interdependencies, Standard Operating Procedures, Emergency Operating Procedures, detailed analysis of every program, service, host, router, switch to include interaction between these services and resources. Testing current system and policies by a certified third party security consultant on a not to interfere basis will provide invaluable insight on our network.
A distributed denial-of-service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users. For all known DoS attacks, there are software fixes that system administrators can install to limit the damage caused by the attacks. There are five things, among others, that you can do to help prevent IP spoofing and its related attacks from affecting your network: 1. Use authentication based on key exchange between the machines on your network; something like IPsec will significantly cut down on the risk of spoofing. 2. Use an access control list to deny private IP addresses on your downstream interface. 3. Implement filtering of both inbound and outbound traffic. 4. Configure your routers and switches if they support such configuration, to reject packets originating from outside your local network that claim to originate from within. 5. Enable encryption sessions on your router so that trusted hosts that are outside your network can securely communicate with your local hosts.

To prevent your network from being abused as an amplifier network in a SMURF attack, you should turn off the forwarding of directed broadcast on all router ports or take other measures to assure your network cannot be abused in this manner. Another component which is important in this type of attack is that the attacker has to be able to inject packets into the network with forged IP source addresses. It is possible to enable functions in routers which will prevent the trivial forgery of IP source addresses, and doing so for a local network will prevent SMURF attacks from being launched locally. (Do however note that access lists can have a performance impact,
Man-in-the-middle attacks are perhaps one of the more complex and sophisticated forms of security breaching approaches. Man-in-middle attacks have increased considerable since the introduction of wireless networking. Now there is no need for the rogue to connect to a wire, instead the data can simply be intercepted from anywhere within range of the wireless signal (such as in the parking lot outside an office or the road in front of a house). The best way to avoid such attacks is to use encryption and secure protocols in all communications.

References 1. http://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attack 2. http://www.computerworld.com/s/article/9001021/The_top_five_ways_to_prevent_IP_spoofing?taxonomyId=142&pageNumber=2

3. http://www.techotopia.com/index.php/An_Overview_of_IT_Security_Threats_and_Attacks