When looking to strengthen our network designs we looked at the typical threats and risks that they pose. Here are some of the attacks we used as of priority to protect ourselves when looking to see what we would be up against:

• DOS/DDOS Attacks

• Man In the Middle Attacks / Spoofing

• Buffer Overflow

• Fragmentation Attacks

• Session Hijacking

• Social Engineering

• SQL Injection / Injection attacks

• Eavesdropping

• Replay Attacks

There are many more attacks possible but these are the attack we focused on. With each threat, we analyzed how these attacks could be used against us and what counter measures would be used to prevent or mitigate such events from happening.

DOS/DDOS Attacks- In general, Denial of Service attacks are used to flood an infrastructure with requests to the point where systems cannot keep up with the volume and crash as a result. As a business that relies on bidding and some public access, this can be troublesome as it would crash the website and stop business at critical times. In order to prevent such attacks, a NIDS or Network Intrusion Detection System can and should be implemented to “weed out” false requests from IP addresses that are flooding the system. For further protection the use of a “Honeypot” or trap for hackers can be used to direct any incoming attacks towards a lesser valuable target.

Man in the Middle attacks- Man in the middle attacks are exactly what they sound like. The danger in these attacks lay with the hacker who lies between the connection of the client and server and either intercepts information between the two, or sometimes poses as the server to grab information from the client like passwords, or other critical information. To protect against these issues an implementation of an Intrusion detection/ prevention program on the network would go a long way of preventing the attacker to establish them “in the middle”. For increased security if possible, a multifactor authentication method should be used whenever possible to better mitigate the risks. A proposed idea of user/id along with bade credentials is one suggestion.

Buffer Overflow – Buffer overflow is usually a direct result of poor programming. This usually is an attack that results when a hacker injects an excess amount of data into a buffer, and if the buffers do not have limit checks, can overflow and pose a threat. Hackers can sometimes use this to put command line coding into the overflow, which the system may run with higher privileges. As stated, limit checks should be implemented by programmers to prevent this type of threats, which can prevent them completely.

Fragmentation Attacks – Fragmentation attacks occur when various sizes of data packets are fragmented or broken up so that they are in compatible sizes to other data packets that are traveling within a network segment. Sometimes these fragments can be maliciously reassembled to cause DOS or to corrupt IDS detection and Firewall filtering. While firewall filtering and IDS should be used (for more than just this purpose)we should be using sender fragmentation. By selecting a “Maximum Transmission Unit” and fragmenting the data before it is sent, we can ensure that fragmentation does not occur while the data is on the way, thus preventing issues from arising.

Session Hijacking – This occurs when a Hacker learns about the connection points between a client and server and uses the information to inject their own crafted packets, thus taking over the stream of data. This is like double Dutch, where the hacker learns how the rope (or data packets) moves and inserts his own packets in anticipation. This often occurs with unencrypted TCP/IP use. TCP/IP should be used with encryption, so that the hacker cannot easily find out the details of the transmissions or future sequence values.

Social Engineering – Social engineering is when attackers use your own employees or in some case customers, against you. They can use many different forms of communication (email, sms, phone calls, etc…) to pose as legitimate positions, and use the individual’s trust to extort information that should not be given. A good example of such is someone calling an employee pretending to be a member of the IT department. The attacker may have just basic information about the individual such as their name and position and use that to establish trust to gather more information, or credentials such as an ID or password. User awareness and training is the best method in mitigation but restricting some forms of communication may help alleviate the risks. We recommend personal email not be used whenever possible, and that work email address be the only source of electronic communication regarding business sensitive information.

Injection attacks – Injection or insertion attacks suck as SQL Injection are attacks that rely on the weaknesses of programs or scripts and confuse the system into granting access to sensitive areas that should not have been granted access to. Since there are many types of insertion/injection attacks we should put priority on IDS injection attacks as a failure in this area could open our network up to further attacks of a different variety. Make sure the IDS implemented has anomaly, behavioral, and heuristic detection so that these types of attack can be prevented. SQL injection should be mitigated by filtering and defensive programming.

Eavesdropping – Snooping and eavesdropping are very important to a network’s security as this can be the first step of action a hacker will try to use to learn not only sensitive data, but to plan for future attacks that could further cripple a system. The key to preventing this is ENCRYPTION, ENCCRYPTION, ENCRYPTION! Data should be encrypted whenever possible when in fear of damage it could do if released.

Replay Attacks – This type of attack is when a Hacker mimics traffic that was sent from a client to a server. By simply capturing data sent and then trying themselves to send this data to the server, they hope to get a desired reaction. This type of attack can be prevented in the first place by the IDS systems and encryption aforementioned, but can also be solved by using authentication methods with transmissions that ensure that the sender is who they say they are.

Summary

As seen, there are a few common themes that should be used when dealing with our network security to prevent a wide variety of attacks. An IDS/IPS should be implemented to not only detect intrusions within the system but to prevent them from causing damage. This should be place within the DMZ as well as within the internal network for maximum security. Firewall filtering should also be used. A policy of DENY should always be used first and should only be opened if absolutely necessary. Unnecessary ports on firewalls should always be closed as to prevent further weaknesses. Encryption is a key point in ensuring attackers cannot easily disseminate information even if they were to somehow penetrate the system.

As always, sensitive data should be quarantined to areas that have the most protection and the least availability if possible, this ensure that if breaches do happen, that it will be less likely that the attackers reach this data. Keeping antivirus software and system/firewall patches up to date are extremely critical as well. One last thing to keep in mind is that when implementing security measures is that they can sometimes conflict and restrict too much. You don’t want this hindering our performance as a company, so make sure that you implement these systems slowly, ensuring that you have a system that is working and functioning fully before implementing more security or making any changes.