Computer Attack Help
Phase 1 - Reconnaissance
Reconnaissance is probably the longest phase, sometimes lasting weeks or months. The black hat uses a variety of sources to learn as much as possible about the target business and how it operates, including * Internet searches * Social engineering * Dumpster diving * Domain name management/search services * Non-intrusive network scanning
The activities in this phase are not easy to defend against. Information about an organization finds its way to the Internet via various routes. Employees are often easily tricked into providing tidbits of information which, over time, act to complete a complete picture of processes, organizational structure, and potential soft-spots. However, there are some things you can do which make it much harder for an attacker, including * Make sure your systems don’t leak information to the Web, including: * Software versions and patch levels * Email addresses * Names and positions of key personnel * Ensure proper disposal of printed information * Provide generic contact information for domain name registration lookups * Prevent perimeter LAN/WAN devices from responding to scanning attempts
Phase 2 - Scanning
Once the attacker has enough information to understand how the business works and what information of value might be available, he or she begins the process of scanning perimeter and internal network devices looking for weaknesses, including * Open ports * Open services * Vulnerable applications, including operating systems * Weak protection of data in transit * Make and model of each piece of LAN/WAN equipment
Scans of perimeter and internal devices can often be detected with intrusion detection (IDS) or prevention (IPS) solutions, but not always. Veteran black hats know ways around these controls. In any case, some steps you can take to thwart scans include * Shutting down all unneeded ports and services * Allow critical devices, or
Reconnaissance is probably the longest phase, sometimes lasting weeks or months. The black hat uses a variety of sources to learn as much as possible about the target business and how it operates, including * Internet searches * Social engineering * Dumpster diving * Domain name management/search services * Non-intrusive network scanning
The activities in this phase are not easy to defend against. Information about an organization finds its way to the Internet via various routes. Employees are often easily tricked into providing tidbits of information which, over time, act to complete a complete picture of processes, organizational structure, and potential soft-spots. However, there are some things you can do which make it much harder for an attacker, including * Make sure your systems don’t leak information to the Web, including: * Software versions and patch levels * Email addresses * Names and positions of key personnel * Ensure proper disposal of printed information * Provide generic contact information for domain name registration lookups * Prevent perimeter LAN/WAN devices from responding to scanning attempts
Phase 2 - Scanning
Once the attacker has enough information to understand how the business works and what information of value might be available, he or she begins the process of scanning perimeter and internal network devices looking for weaknesses, including * Open ports * Open services * Vulnerable applications, including operating systems * Weak protection of data in transit * Make and model of each piece of LAN/WAN equipment
Scans of perimeter and internal devices can often be detected with intrusion detection (IDS) or prevention (IPS) solutions, but not always. Veteran black hats know ways around these controls. In any case, some steps you can take to thwart scans include * Shutting down all unneeded ports and services * Allow critical devices, or