Cybersecurity

Thomas J. Mowbray, PhD, holds gold-level certification from the SANS Institute in network penetration and ethical hacking. Dr. Mowbray, who has earned a doctorate in computer science, has co-authored five other professional books, including Wiley's bestseller Antipatterns: Refactoring Software, Architectures, and Projects in Crisis. After founding the Northrup Grumman Cyber Warfare Community of Practice, Dr. Mowbray joined the Certification and Accreditation Team (an elite cybersecurity test group) as their network administrator, security tools customizer, and hands-on penetration tester. At the time of writing, Dr. Mowbray is the Chief Enterprise Architect of The Ohio State University.

• Introduction xixPart I Cyber Network Security Concepts 1Chapter 1 Executive Summary 3Why Start with Antipatterns? 4Security Architecture 5Antipattern: Signature-Based Malware Detection versus Polymorphic Threats 6Refactored Solution: Reputational-, Behavioral-, and Entropy-Based Malware Detection 6Antipattern: Document-Driven Certification and Accreditation 7Antipattern: Proliferating IA Standards with No Proven Benefits 8Antipattern: Policy-Driven Security Certifications Do Not Address the Threat 10Refactored Solution: Security Training Roadmap 10Summary 13Assignments 14Chapter 2 The Problems: Cyber Antipatterns 15Antipatterns Concept 16Forces in Cyber Antipatterns 16Cyber Antipattern Templates 18Micro-Antipattern Templates 18Full Cyber Antipattern Template 19Cybersecurity Antipattern Catalog 20Can’t Patch Dumb 21Unpatched Applications 23Never Read the Logs 25Networks Always Play by the Rules 26Hard on the Outside, Gooey in the Middle 28Webify Everything 30No Time for Security 32Summary 34Assignments 35Chapter 3 Enterprise Security Using the Zachman Framework 37What Is Architecture? Why Do We Need It? 37Enterprises Are Complex and Changing 38The Zachman Framework for Enterprise Architecture 38Primitive Models versus Composite Models 40How Does the Zachman Framework Help with Cybersecurity? 40Everyone Has Their Own Specifications 41The Goldmine Is in Row 2 42Frameworks for Row 3 42Architectural Problem Solving Patterns 43Business Question Analysis 44Document Mining 45Hierarchy Formation 46Enterprise Workshop 52Matrix Mining 53Nominal Group Technique 54Minipatterns for Problem Solving Meetings 55Summary 56Assignments 57Part II Cyber Network Security Hands-On 59Chapter 4 Network Administration for Security Professionals 61Managing Administrator and Root Accounts 62Windows 63Linux and Unix 64VMware 64Installing Hardware 64Re-Imaging Operating Systems 67Windows 67Linux 68VMware 69Other OSes 69Burning and Copying CDs and DVDs 69Windows 70Linux 70VMware 71Installing System Protection/Anti-Malware 71Windows 74Linux 74VMware 75Setting Up Networks 75Windows 76Linux 77VMware 78Other OSes 79Installing Applications and Archiving 80Windows 80Linux 81VMware 82Other OSes 82Customizing System Management Controls and Settings 82Windows 82Linux 83VMware 83Other OSes 83Managing Remote Login 83Windows 84Linux 84VMware 84Managing User Administration 85Windows 85Linux 86VMware 86Managing Services 87Windows 87Linux 88Other OSes 88Mounting Disks 89Windows 89Linux 90VMware 90Moving Data Between Systems on Networks 90Windows File Sharing 91Secure File Transfer Protocol (SFTP) 91VMware 91Other Techniques 92Converting Text Files Between OSes 92Making Backup Disks 92Formatting Disks 93Windows 93Linux 94Configuring Firewalls 94Converting and Migrating VMs 97Additional Network Administration Knowledge 99Summary 99Assignments 101Chapter 5 Customizing BackTrack and Security Tools 103Creating and Running BackTrack Images 104Customizing BackTrack with VM 105Updating and Upgrading BackTrack and Pen Test Tools 106Adding Windows to BackTrack with VMware 106Disk Partitioning 107Performing Multi-Boot Disk Setup 108Results of the New Pen Test Architecture 110Alternative Pen Test Architectures 111Licensing Challenges for Network Administrators 111Perpetual License 111Annual License 111Time Limited per Instance License 112Time Hold Renewal License 112Summary 112Assignments 113Chapter 6 Protocol Analysis and Network Programming 115Networking Theory and Practice 116Frequently Encountered Network Protocols 117ARP and Layer 2 Headers 118IP Header 120ICMP Header 120UDP Header 121TCP Header 122Network Programming: Bash 124Bash for Basic Network Programming 125Bash Network Sweep: Packaging a Script 126Bash Network Scanning Using While 127Bash Banner Grabbing 128Network Programming: Windows Command-Line Interface (CLI) 130Windows Command Line: Network Programming Using For /L 131Windows Command Line: Password Attack Using For /F 132Python Programming: Accelerated Network Scanning 133Summary 136Assignments 137Chapter 7 Reconnaissance, Vulnerability Assessment, and Cyber Testing 139Types of Cybersecurity Evaluations 139Body of Evidence (BOE) Review 140Penetration Tests 141Vulnerability Assessment 141Security Controls Audit 141Software Inspection 141Iterative/Incremental Testing 142Understanding the Cybersecurity Testing Methodology 142Reconnaissance 144Network and Port Scanning 150Policy Scanning 153Vulnerability Probes and Fingerprinting 155Test Planning and Reporting 159Summary 162Assignments 163Chapter 8 Penetration Testing 165Forms of Cyber Attacks 166Buffer Overflows 166Command Injection Attacks 167SQL Injection Attacks 167Network Penetration 167Commercial Pen Testing Tools 170Using IMPACT 170Using CANVAS 171Using Netcat to Create Connections and Move Data and Binaries 172Using Netcat to Create Relays and Pivots 173Using SQL Injection and Cross-Site Techniques to Perform Web Application and Database Attacks 175Collecting User Identities with Enumeration and Hash Grabbing 177Enumeration and Hash Grabbing on Windows 178Enumeration and Hash Grabbing on Linux 179Password Cracking 179John the Ripper 181Rainbow Tables 181Cain & Abel 181Privilege Escalation 182Final Malicious Phases 183Backdoors 183Entrenchment 184Hidden Files 184Rootkits 184Rootkit Removal 185Summary 185Assignments 187Chapter 9 Cyber Network Defense Using Advanced Log Analysis 189Introduction to Cyber Network Defense 190General Methods and Tools for Cyber Investigations 191Observation 192Hypothesis 192Evaluation 193Continuous Cyber Investigation Strategy 193A Summary of the Cyber Investigation Process 195Network Monitoring 197The daycap script 199The pscap Script 200Text Log Analysis 200The snortcap Script 201The headcap Script 201The statcap Script 202The hostcap Script 202The alteripcap Script 203The orgcap Script 204The iporgcap Script 205The archcap Script 205Binary Log Analysis 206Advanced Wireshark Filters 206Data Carving 207Advanced tcpdump Filtering and Techniques 208Analyzing Beacons 209Reporting Cyber Investigations 210Elimination of Cyber Threats 211Intrusion Discovery on Windows 214Summary 215Assignments 216Part III Cyber Network Application Domains 217Chapter 10 Cybersecurity for End Users, Social Media, and Virtual Worlds 219Doing an Ego Search 219Protecting Laptops, PCs, and Mobile Devices 220Staying Current with Anti-Malware and Software Updates 222Managing Passwords 223Guarding against Drive-By Malware 224Staying Safe with E‐mail 225Securely Banking and Buying Online 226Understanding Scareware and Ransomware 227Is Your Machine p0wned? 227Being Careful with Social Media 228Staying Safe in Virtual Worlds 229Summary 230Assignments 231Chapter 11 Cybersecurity Essentials for Small Business 233Install Anti-Malware Protection 234Update Operating Systems 234Update Applications 235Change Default Passwords 235Educate Your End Users 236Small Enterprise System Administration 236Wireless Security Basics for Small Business 237Tips for Apple Macintosh Users 238Summary 239Assignments 239Chapter 12 Large Enterprise Cybersecurity: Data Centers and Clouds 241Critical Security Controls 242Scanning Enterprise IP Address Range (Critical Control 1) 243Drive-By Malware (Critical Controls 2 & 3) 244Unpatched Applications in Large Enterprises (Critical Controls 2 & 4) 246Internal Pivot from Compromised Machines (Critical Controls 2 & 10) 247Weak System Configurations (Critical Controls 3 & 10) 248Unpatched Systems (Critical Controls 4 & 5) 250Lack of Security Improvement (Critical Controls 4, 5, 11, & 20) 250Vulnerable Web Applications and Databases (Critical Controls 6 & 20) 251Wireless Vulnerability (Critical Control 7) 252Social Engineering (Critical Controls 9, 12, & 16) 253Temporary Open Ports (Critical Controls 10 & 13) 254Weak Network Architectures (Critical Controls 13 & 19) 255Lack of Logging and Log Reviews (Critical Control 14) 256Lack of Risk Assessment and Data Protection (Critical Controls 15 & 17) 257Data Loss via Undetected Exfiltration (Critical Control 17) 259Poor Incident Response — APT (Critical Control 18) 260Cloud Security 261How Do Clouds Form? How Do Clouds Work? 262Stovepiped Widgets in the Cloud 263Special Security Implications 264Consolidation into Clouds Can Magnify Risks 264Clouds Require Stronger Trust Relationships 264Clouds Change Security Assumptions 265Cloud Indexing Changes Security Semantics 265Data Mashups Increase Data Sensitivity 265Cloud Security Technology Maturity 266New Governance and Quality Assurance for Cloud Computing 266Summary 267Assignments 268Chapter 13 Healthcare Information Technology Security 269Hipaa 270Healthcare Risk Assessment 270Healthcare Records Management 271Healthcare IT and the Judicial Process 272Data Loss 272Managing Logs in Healthcare Organizations 273Authentication and Access Control 274Summary 275Assignments 276Chapter 14 Cyber Warfare: An Architecture for Deterrence 277Introduction to Cyber Deterrence 278Cyber Warfare 278Comprehensive National Cybersecurity Initiative 279Methodology and Assumptions 280Cyber Deterrence Challenges 283Legal and Treaty Assumptions 284Cyber Deterrence Strategy 286Reference Model 290Solution Architecture 291Architectural Prototypes 296Baseline Code: Threaded Scanning 297Botnet for Distributed Scanning 298Performance Benchmarks 300Deterministic Models of Performance 302Projections for Military Botnets 303Summary 304Assignments 305Glossary 307Bibliography 317Index 323