Hands-On Ethical Hacking and Network Defense - Second Edition Chapter 1. After reading this chapter and completing the exercises, you will be able to:

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Hands-On Ethical Hacking and Network Defense - Second Edition Chapter 1. After reading this chapter and completing the exercises, you will be able to:"

Transcription

1 Objectives After reading this chapter and completing the exercises, you will be able to: Describe the role of an ethical hacker Describe what you can do legally as an ethical hacker Describe what you can t do as an ethical hacker Who are the Players? Introduction to Ethical Hacking Who are Ethical Hackers Hired by companies to perform penetration tests Penetration test Authorized attempt to break into a company s network to find the weakest link Security test More than a break in attempt; includes analyzing company s security policy and procedures Vulnerabilities are reported The Role of Security and Penetration Testers Hackers Crackers Tiger box Access computer system or network without authorization Breaks the law; can go to prison Break into systems to steal or destroy data U.S. Department of Justice calls both hackers Collection of tools Used for conducting vulnerability assessments and attacks The Role of Security & Penetration Testers (cont)

2 Script kiddies or Packet Monkeys Younger, inexperienced hackers who copy code from knowledgeable hackers See Leet speak ( Programming Skills Languages used by experienced penetration testers Script What is a Script? Practical Extraction and Report Language (Perl) C language Set of instructions Runs in sequence to perform tasks Definition: A script is a set of instructions used by a computer to execute a set of pre-determined instructions. Once the computer executes the instructions, it returns data (a value) which could be a number, a string, a list, or another data type. A very simple script does nothing but return a value. To return a value, it uses the "return" keyword of the script to provide the request data to the script that called it. A very simple script might look like this: return ("This is a string."). The return keyword is usually followed by open and close parentheses. Javascript Example: window.open (" Penetration-Testing Methodologies White Box model Tester is told about network topology and technology Tester is permitted to interview IT personnel and company employees

3 Black Box model Hands-On Ethical Hacking and Network Defense - Second Edition Makes tester s job a little easier Staff does not know about the test Tester is not given details about technologies used Burden is on tester to find details Tests security personnel s ability to detect an attack Gray Box model Hybrid of white and black box models Company gives tester partial information (e.g., OSs are used, but no network diagrams) Certification Programs - Network Security Personnel Minimum certification: Security+: Comptia (or equivalent knowledge) Industry Standard: Certified Ethical Hacker (CEH): EC Council Based on 22 domains (subject areas) Certified Information System Security Professional (CISSP): International Information Systems Security Certification Consortium (ISC2), CISSP Consists of ten domains Certification Programs - Network Security Personnel (cont) Professional Security Tester Designated by the Institute for Security and Open Methodologies (ISECOM) Based on Open Source Security Testing Methodology Manual (OSSTMM) Written by Peter Herzog Five main topics (i.e., professional, enumeration, assessments, application, and verification)

4 Red Team Internal to organization Conducts penetration tests Composed of people with varied skills Unlikely that one person will perform all tests SANS Institute SysAdmin, Audit, Network, Security (SANS) Institute Top 20 list Offers training and certifications through Global Information Assurance Certification (GIAC) One of the most popular SANS Institute documents Details most common network exploits Suggests ways of correcting vulnerabilities Web site: Which Certification Is Best? Penetration and Security Testers Both need technical skills to perform duties effectively Good understanding of networks Role of management in an organization Skills in writing and verbal communication Desire to continue learning Danger of certification exams What You Can Do Legally Some participants simply memorize terminology Laws involving technology change Don t have a good grasp of subject matter

5 Keep abreast of what s happening in your area Find out what is legal for you locally Be aware of what is allowed and what you should not or cannot do Laws of the Land Laws vary from state to state and country to country Some hacking tools on your computer might be illegal Contact local law enforcement agencies before installing hacking tools Laws are written to protect society Written words are open to interpretation Government is getting more serious about cybercrime punishment Is Port Scanning Legal? Some states deem it legal Not always the case Be prudent before using penetration-testing tools Federal government does not see it as a violation Allows each state to address it separately Research state laws Read your ISP s Acceptable Use Policy IRC bot Program that sends automatic responses to users Gives the appearance of a person being present AUP Comparisons Federal Laws Getting more specific in areas of: Cybercrimes

6 Intellectual property issues Computer hacking and intellectual property (CHIP) New government branch Addresses computer hacking and intellectual property crimes What You Cannot Do Legally Illegal actions: Accessing a computer without permission Destroy data without permission Copy information without permission Installing worms or viruses Denying users access to network resources Be careful your actions do not prevent client s employees from doing their jobs! Get It in Writing Contracts: Using a contract is good business (CYA) May be useful in court Check internet for free modifiable templates Have an attorney review contracts before signing (CYA) Books on working as an independent contractor The Computer Consultant s Guide by Janet Ruhl Getting Started in Computer Consulting by Peter Meyer Ethical Hacking in a Nutshell Skills needed to be a security tester Knowledge of network and computer technology Ability to communicate with management and IT personnel

7 An understanding of the laws in your location Ability to use necessary tools

Introduction to Ethical Hacking and Network Defense. Objectives. Hackers

Introduction to Ethical Hacking and Network Defense. Objectives. Hackers Introduction to Ethical Hacking and Network Defense January 14, 2010 MIS 4600 - Abdou Illia Objectives Describe the role of an ethical hacker Describe what can an ethical hacker legally do Describe what

More information

Ethical Hacking Overview

Ethical Hacking Overview chapter Ethical Hacking Overview After reading this chapter and completing the exercises, you will be able to: Describe the role of an ethical hacker Describe what you can do legally as an ethical hacker

More information

2011 Course Technology, Cengage Learning

2011 Course Technology, Cengage Learning Licensed to: ichapters User Hands-On Ethical Hacking and Network Defense, Second Edition Michael T. Simpson, Kent Backman, and James E. Corley Vice President, Career and Professional Editorial: Dave Garza

More information

Security Testing. Vulnerability Assessment vs Penetration Testing. Gabriel Mihai Tanase, Director KPMG Romania. 29 October 2014

Security Testing. Vulnerability Assessment vs Penetration Testing. Gabriel Mihai Tanase, Director KPMG Romania. 29 October 2014 Security Testing Vulnerability Assessment vs Penetration Testing Gabriel Mihai Tanase, Director KPMG Romania 29 October 2014 Agenda What is? Vulnerability Assessment Penetration Testing Acting as Conclusion

More information

Penetration Testing in Romania

Penetration Testing in Romania Penetration Testing in Romania Adrian Furtunǎ, Ph.D. 11 October 2011 Romanian IT&C Security Forum Agenda About penetration testing Examples Q & A 2 What is penetration testing? Method for evaluating the

More information

Hacking Book 1: Attack Phases. Chapter 1: Introduction to Ethical Hacking

Hacking Book 1: Attack Phases. Chapter 1: Introduction to Ethical Hacking Hacking Book 1: Attack Phases Chapter 1: Introduction to Ethical Hacking Objectives Understand the importance of information security in today s world Understand the elements of security Identify the phases

More information

Computer Security and Penetration Testing. Chapter 1 Ethics of Hacking and Cracking

Computer Security and Penetration Testing. Chapter 1 Ethics of Hacking and Cracking Computer Security and Penetration Testing Chapter 1 Ethics of Hacking and Cracking Objectives Understand how the act of unethical computer hacking is a crime Classify and identify groups and classes of

More information

Hackers are here. Where are you?

Hackers are here. Where are you? 1 2 What is EC-Council Certified Security Analyst Licensed Penetration Tester Program You are an ethical hacker. Your last name is Pwned. You dream about enumeration and you can scan networks in your sleep.

More information

About Effective Penetration Testing Methodology

About Effective Penetration Testing Methodology 보안공학연구논문지 (Journal of Security Engineering), 제 5권 제 5호 2008년 10월 About Effective Penetration Testing Methodology Byeong-Ho KANG 1) Abstract Penetration testing is one of the oldest methods for assessing

More information

Hackers are here. Where are you?

Hackers are here. Where are you? 1 2 What is EC-Council Certified Security Analyst Licensed Penetration Tester Program You are an ethical hacker. Your last name is Pwned. You dream about enumeration and you can scan networks in your sleep.

More information

Scoping Questionnaire for Penetration Testing

Scoping Questionnaire for Penetration Testing Scoping Questionnaire for Penetration Testing BII Compliance and its contractors adhere to the OSSTMM penetration testing methodology and code of ethics. The analysts performing these tests will each be

More information

SCOPING QUESTIONNAIRE FOR PENETRATION TESTING

SCOPING QUESTIONNAIRE FOR PENETRATION TESTING SCOPING QUESTIONNAIRE FOR PENETRATION TESTING PathMaker Group adheres to the OSSTMM penetration testing methodology and code of ethics regarding this level and classification of test. The analysts performing

More information

FedVTE Training Catalog SPRING 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov

FedVTE Training Catalog SPRING 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov FedVTE Training Catalog SPRING 2015 advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov If you need any assistance please contact the FedVTE Help Desk here or email the

More information

Cybercrime & Cybersecurity: the Ongoing Battle International Hellenic University

Cybercrime & Cybersecurity: the Ongoing Battle International Hellenic University Cybercrime & Cybersecurity: the Ongoing Battle International Hellenic University Andreas Athanasoulias, CISM, CISSP Information Security Officer & Security Consultant Brief introduction My career path

More information

National Cyber League Certified Ethical Hacker (CEH) TM Syllabus

National Cyber League Certified Ethical Hacker (CEH) TM Syllabus National Cyber League Certified Ethical Hacker (CEH) TM Syllabus Note to Faculty This NCL Syllabus is intended as a supplement to courses that are based on the EC- Council Certified Ethical Hacker TM (CEHv8)

More information

InfoSec Academy Pen Testing & Hacking Track

InfoSec Academy Pen Testing & Hacking Track Fundamental Courses Foundational Courses InfoSec Academy Specialized Courses Advanced Courses Certification Preparation Courses Certified Information Systems Security Professional (CISSP) Texas Security

More information

FedVTE Training Catalog SUMMER 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov

FedVTE Training Catalog SUMMER 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov FedVTE Training Catalog SUMMER 2015 advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov Access FedVTE online at: fedvte.usalearning.gov If you need any assistance please

More information

InfoSec Academy Forensics Track

InfoSec Academy Forensics Track Fundamental Courses Foundational Courses InfoSec Academy Specialized Courses Advanced Courses Certification Preparation Courses Certified Information Systems Security Professional (CISSP) Texas Security

More information

EC-Council. Certified Ethical Hacker. Program Brochure

EC-Council. Certified Ethical Hacker. Program Brochure EC-Council C Certified E Ethical Hacker Program Brochure Course Description The (CEH) program is the core of the most desired information security training system any information security professional

More information

Application Backdoor Assessment. Complete securing of your applications

Application Backdoor Assessment. Complete securing of your applications Application Backdoor Assessment Complete securing of your applications Company brief BMS Consulting is established as IT system integrator since 1997 Leading positons in Eastern Europe country Product

More information

EC-Council Certified Security Analyst (ECSA)

EC-Council Certified Security Analyst (ECSA) EC-Council Certified Security Analyst (ECSA) v8 Eğitim Tipi ve Süresi: 5 Days VILT 5 Day VILT EC-Council Certified Security Analyst (ECSA) v8 Learn penetration testing methodologies while preparing for

More information

Ethical Hacking and Penetration Testing Presented by: Adam Baneth Managing director

Ethical Hacking and Penetration Testing Presented by: Adam Baneth Managing director Whiteshield Ethical Hacking and Penetration Testing Presented by: Adam Baneth Managing director Hacking Facts Success Hacking stories Stories IV. 1111,111111,lennon@xds.com TEAS,test123,TEST123@SS.COM

More information

The reports in this appendix will give you a good idea of what security testers do and how they

The reports in this appendix will give you a good idea of what security testers do and how they DOCUMENTATION FORMS FOR PENETRATION TESTS The reports in this appendix will give you a good idea of what security testers do and how they should present findings to managers and IT personnel. The sample

More information

Pivotal Basics for Every Beginner

Pivotal Basics for Every Beginner FOR REAL BEGINNERS Pivotal Basics for Every Beginner Is being a pentester your dream job? Would you like to do pentesting every day until the death but you do not know what to start with? In this article

More information

Hackers: Detection and Prevention

Hackers: Detection and Prevention Computer Networks & Computer Security SE 4C03 Project Report Hackers: Detection and Prevention Due Date: March 29 th, 2005 Modified: March 28 th, 2005 Student Name: Arnold Sebastian Professor: Dr. Kartik

More information

Access FedVTE online at: fedvte.usalearning.gov

Access FedVTE online at: fedvte.usalearning.gov FALL 2015 Access FedVTE online at: fedvte.usalearning.gov If you need any assistance please contact the FedVTE Help Desk her e or email the Help Desk at support@usalearning.net. To speak with a Help Desk

More information

The purpose of this Unit is to develop an awareness of the knowledge and skills used by ethical and malicious hackers.

The purpose of this Unit is to develop an awareness of the knowledge and skills used by ethical and malicious hackers. National Unit specification General information Unit code: H9HY 45 Superclass: CC Publication date: September 2015 Source: Scottish Qualifications Authority Version: 02 Unit purpose The purpose of this

More information

Cyber R &D Research Roundtable

Cyber R &D Research Roundtable Cyber R &D Research Roundtable 2 May 2013 N A T I O N A L S E C U R I T Y E N E R G Y & E N V I R O N M E N T H E A L T H C Y B E R S E C U R I T Y Changing Environment Rapidly Evolving Threat Changes

More information

Threats and Attacks. Modifications by Prof. Dong Xuan and Adam C. Champion. Principles of Information Security, 5th Edition 1

Threats and Attacks. Modifications by Prof. Dong Xuan and Adam C. Champion. Principles of Information Security, 5th Edition 1 Threats and Attacks Modifications by Prof. Dong Xuan and Adam C. Champion Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to:

More information

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks

More information

ITEC441- IS Security. Chapter 15 Performing a Penetration Test

ITEC441- IS Security. Chapter 15 Performing a Penetration Test 1 ITEC441- IS Security Chapter 15 Performing a Penetration Test The PenTest A penetration test (pentest) simulates methods that intruders use to gain unauthorized access to an organization s network and

More information

Security Certifications. Presentatie SecCert 101 Jordy Kersten MSc., ISC2 Ass., CEH, OSCP

Security Certifications. Presentatie SecCert 101 Jordy Kersten MSc., ISC2 Ass., CEH, OSCP Security Certifications Presentatie SecCert 101 Jordy Kersten MSc., ISC2 Ass., CEH, OSCP Wie ben ik? Jordy Kersten 26 jaar Communicatie Systemen HAN Arhnem Informatiekunde RU Nijmegen Security Consultant

More information

IT Security Training. Why Security Certification? A Serious Business - Fear Drives the Demand High Demand Freedom to Make and Break Rules

IT Security Training. Why Security Certification? A Serious Business - Fear Drives the Demand High Demand Freedom to Make and Break Rules IT Security Training Why Security Certification? A Serious Business - Fear Drives the Demand High Demand Freedom to Make and Break Rules Benefits of Certification Provides Assurance to Employers Certification

More information

Certified Ethical Hacker (CEH)

Certified Ethical Hacker (CEH) Certified Ethical Hacker (CEH) Course Number: CEH Length: 5 Day(s) Certification Exam This course will help you prepare for the following exams: Exam 312 50: Certified Ethical Hacker Course Overview The

More information

Track 2: Introductory Track PREREQUISITE: BASIC COMPUTER EXPERIENCE

Track 2: Introductory Track PREREQUISITE: BASIC COMPUTER EXPERIENCE Anne Arundel Community College Tracks Anne Arundel Community College s computer technologies courses have been organized into 10 suggested tracks. The tracks are arranged to ensure that students have the

More information

LINUX / INFORMATION SECURITY

LINUX / INFORMATION SECURITY LINUX / INFORMATION SECURITY CERTIFICATE IN LINUX SYSTEM ADMINISTRATION The Linux open source operating system offers a wide range of graphical and command line tools that can be used to implement a high-performance,

More information

Introduction to Penetration Testing Graham Weston

Introduction to Penetration Testing Graham Weston Introduction to Penetration Testing Graham Weston March 2014 Agenda Introduction and background Why do penetration testing? Aims and objectives Approaches Types of penetration test What can be penetration

More information

Analyze. Secure. Defend. Do you hold ECSA credential?

Analyze. Secure. Defend. Do you hold ECSA credential? 1 Analyze. Secure. Defend. Do you hold ECSA credential? TM E C S A EC-Council Certified Security Analyst 1 EC-Council Cyber Security Professional Path Threat Agent Application of Methodology So You Can

More information

EC-Council. Program Brochure. EC-Council. Page 1

EC-Council. Program Brochure. EC-Council. Page 1 Program Brochure Page 1 Certified Ethical Hacker Version 7 Revolutionary Product releases the most advanced ethical hacking program in the world. This much anticipated version was designed by hackers and

More information

VULNERABILITY MANAGEMENT AND RESEARCH PENETRATION TESTING OVERVIEW

VULNERABILITY MANAGEMENT AND RESEARCH PENETRATION TESTING OVERVIEW VULNERABILITY MANAGEMENT AND RESEARCH PENETRATION TESTING OVERVIEW Len Kleinman Director ATO Trusted Access Australian Taxation Office Session ID: DAS-W01 Session Classification: General Interest What

More information

Digital Barracuda Information Security Reports that the Risk from Viruses and Worms is Only the Tip of the Iceberg FACT SHEET

Digital Barracuda Information Security Reports that the Risk from Viruses and Worms is Only the Tip of the Iceberg FACT SHEET Digital Barracuda Information Security Worms is Only the Tip FACT SHEET from Viruses and Worms is Only the Tip Do you have security with teeth? You had better, because if the worms don t get you, the viruses

More information

Exam 1 - CSIS 3755 Information Assurance

Exam 1 - CSIS 3755 Information Assurance Name: Exam 1 - CSIS 3755 Information Assurance True/False Indicate whether the statement is true or false. 1. Antiquated or outdated infrastructure can lead to reliable and trustworthy systems. 2. Information

More information

Vinny Hoxha Vinny Hoxha 12/08/2009

Vinny Hoxha Vinny Hoxha 12/08/2009 Ethical Hacking and Penetration Testing Vinny Hoxha Vinny Hoxha 12/08/2009 What is Ethical Hacking? Types of Attacks Testing Approach Vulnerability Assessments vs. Penetration Testing Testing Methodology

More information

Redhawk Network Security, LLC 62958 Layton Ave., Suite One, Bend, OR 97701 sales@redhawksecurity.com 866-605- 6328 www.redhawksecurity.

Redhawk Network Security, LLC 62958 Layton Ave., Suite One, Bend, OR 97701 sales@redhawksecurity.com 866-605- 6328 www.redhawksecurity. Planning Guide for Penetration Testing John Pelley, CISSP, ISSAP, MBCI Long seen as a Payment Card Industry (PCI) best practice, penetration testing has become a requirement for PCI 3.1 effective July

More information

The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.

The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked. This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out

More information

The Information Security Problem

The Information Security Problem Chapter 10 Objectives Describe the major concepts and terminology of EC security. Understand phishing and its relationship to financial crimes. Describe the information assurance security principles. Identify

More information

TESTING OUR SECURITY DEFENCES

TESTING OUR SECURITY DEFENCES INFOSECURITY WITH PLYMOUTH UNIVERSITY TESTING OUR SECURITY DEFENCES Dr Maria Papadaki maria.papadaki@plymouth.ac.uk 1 1 Do we need to test our defences? Can penetration testing help to improve security?

More information

National Cyber League Certified Ethical Hacker (CEH) TM Syllabus

National Cyber League Certified Ethical Hacker (CEH) TM Syllabus National Cyber League Certified Ethical Hacker (CEH) TM Syllabus Note to Faculty This NCL Syllabus is intended as a supplement to courses that are based on the EC- Council Certified Ethical Hacker TM (CEHv8)

More information

Penetration Testing. I.T. Security Specialists. Penetration Testing 1

Penetration Testing. I.T. Security Specialists. Penetration Testing 1 Penetration I.T. Security Specialists ing 1 about us At Caretower, we help businesses to identify vulnerabilities within their security systems and provide an action plan to help prevent security breaches

More information

Forensic Certifications

Forensic Certifications Forensic Certifications Mayuri Shakamuri CS 489-02 Digital Forensics October 31, 2006 New Mexico Tech Executive Summary Digital Forensics is rapidly growing and evolving to become a scientific practice

More information

Penetration Testing Guidelines For the Financial Industry in Singapore. 31 July 2015

Penetration Testing Guidelines For the Financial Industry in Singapore. 31 July 2015 For the Financial Industry in Singapore 31 July 2015 TABLE OF CONTENT 1. EXECUTIVE SUMMARY 3 2. INTRODUCTION 4 2.1 Audience 4 2.2 Purpose and Scope 4 2.3 Definitions 4 3. REQUIREMENTS 6 3.1 Overview 6

More information

167 th Air Wing Fast Track Cyber Security Blue Ridge Community and Technical College

167 th Air Wing Fast Track Cyber Security Blue Ridge Community and Technical College 167 th Air Wing Fast Track Cyber Security Blue Ridge Community and Technical College Information Security Certificate: Designed to introduce students to programming, security basics, network monitoring,

More information

CISO's Guide to. Penetration Testing. James. S. Tiller. A Framework to Plan, Manage, and Maximize Benefits. CRC Press. Taylor & Francis Group

CISO's Guide to. Penetration Testing. James. S. Tiller. A Framework to Plan, Manage, and Maximize Benefits. CRC Press. Taylor & Francis Group CISO's Guide to Penetration Testing A Framework to Plan, Manage, and Maximize Benefits James S. Tiller CRC Press Taylor & Francis Group Boca Raton London New York CRC Press is an imprint of the Taylor

More information

If you know the enemy and know yourself, you need not fear the result of a hundred battles.

If you know the enemy and know yourself, you need not fear the result of a hundred battles. Rui Pereira,B.Sc.(Hons),CIPS ISP/ITCP,CISSP,CISA,CWNA/CWSP,CPTE/CPTC Principal Consultant, WaveFront Consulting Group ruiper@wavefrontcg.com 1 (604) 961-0701 If you know the enemy and know yourself, you

More information

Information Security Specialist Training on the Basis of ISO/IEC 27002

Information Security Specialist Training on the Basis of ISO/IEC 27002 Information Security Specialist Training on the Basis of ISO/IEC 27002 Natalia Miloslavskaya, Alexander Tolstoy Moscow Engineering Physics Institute (State University), Russia, {milmur, ait}@mephi.edu

More information

Web App Security Audit Services

Web App Security Audit Services locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System

More information

Certification Programs

Certification Programs Registration Questions? Please contact us directly. 507 S. Grand Ave., Lansing, MI 48933 sfisher@mibankers.com (517) 342-9057 Certification Programs 2015 Following the lecture on day 2, students have the

More information

InfoSec Academy Application & Secure Code Track

InfoSec Academy Application & Secure Code Track Fundamental Courses Foundational Courses InfoSec Academy Specialized Courses Advanced Courses Certification Preparation Courses Certified Information Systems Security Professional (CISSP) Texas Security

More information

State of South Carolina InfoSec and Privacy Career Path Model

State of South Carolina InfoSec and Privacy Career Path Model State of South Carolina InfoSec and Privacy Career Path Model Start Introduction This Career Path Model for the State of South Carolina (State) is designed to help define the various career options available

More information

Information Security Principles and Practices

Information Security Principles and Practices Information Security Principles and Practices by Mark Merkow and Jim Breithaupt Chapter 3: Certification Programs and the Common Body of Knowledge Certification & Information Security Industry standards,

More information

SECURITY. Risk & Compliance Services

SECURITY. Risk & Compliance Services SECURITY Risk & Compliance s V1 8/2010 Risk & Compliances s Risk & compliance services Summary Summary Trace3 offers a full and complete line of security assessment services designed to help you minimize

More information

ASK PC Certified Information Systems Security Expert - CISSE

ASK PC Certified Information Systems Security Expert - CISSE Course Description As part of our mission to spread the awareness of IT security in the Middle East, we understand that an Arabic course will be valuable for native speakers. This is a comprehensive course

More information

CS 391-950 Ethical Hacking Spring 2016

CS 391-950 Ethical Hacking Spring 2016 CS 391-950 Ethical Hacking Spring 2016 Instructor: Shahriar Nick Rahimi Office: Faner 2136 Office Hours: MW 8:30 am-11 am Friday 10 am- 11 am E-Mail: nick@cs.siu.edu Course Web Site: https://online.siu.edu/

More information

How Your Current IT Security System Might Be Leaving You Exposed TAKEAWAYS CHALLENGES WHITE PAPER

How Your Current IT Security System Might Be Leaving You Exposed TAKEAWAYS CHALLENGES WHITE PAPER WHITE PAPER CHALLENGES Protecting company systems and data from costly hacker intrusions Finding tools and training to affordably and effectively enhance IT security Building More Secure Companies (and

More information

Information Security solutions that protect your business

Information Security solutions that protect your business Information Security solutions that protect your business We deliver Information Security solutions that stabilize your organization helping you build a strong foundation to prevent potential security

More information

INTRODUCTION: PENETRATION TEST A BUSINESS PERSPECTIVE:

INTRODUCTION: PENETRATION TEST A BUSINESS PERSPECTIVE: PENETRATION TESTING A SYSTEMATIC APPROACH INTRODUCTION: The basic idea behind writing this article was to put forward a systematic approach that needs to be followed to perform a successful penetration

More information

167 th Air Wing Fast Track Cyber Program Blue Ridge Community and Technical College

167 th Air Wing Fast Track Cyber Program Blue Ridge Community and Technical College 167 th Air Wing Fast Track Cyber Program Blue Ridge Community and Technical College Information Security Certificate: Designed to introduce students to programming, security basics, network monitoring,

More information

Principle of Information Security. Asst. Prof. Kemathat Vibhatavanij Ph.D.

Principle of Information Security. Asst. Prof. Kemathat Vibhatavanij Ph.D. Principle of Information Security Asst. Prof. Kemathat Vibhatavanij Ph.D. Security Challenges Evolution of technology focused on ease of use Compliance to government laws and regulations Direct impact

More information

of Highly Effective Security Professionals By Sondra Schneider CEO Security University s0ndra@securityuniversity.net 203.357.7744

of Highly Effective Security Professionals By Sondra Schneider CEO Security University s0ndra@securityuniversity.net 203.357.7744 6 Skills of Highly Effective Security Professionals By Sondra Schneider CEO Security University s0ndra@securityuniversity.net 203.357.7744 Basic Principles The Basic Principles of InfoSecurity are Universal

More information

SPSP Phase III Recruiting, Selecting, and Developing Secure Power Systems Professionals: Job Profiles

SPSP Phase III Recruiting, Selecting, and Developing Secure Power Systems Professionals: Job Profiles PNNL-24138 SPSP Phase III Recruiting, Selecting, and Developing Secure Power Systems Professionals: Job Profiles March 2015 LR O Neil TJ Conway DH Tobey FL Greitzer AC Dalton PK Pusey Prepared for the

More information

Penetration Testing Workshop

Penetration Testing Workshop Penetration Testing Workshop Who are we? Carter Poe Nathan Ritchey Mahdi Shapouri Fred Araujo Outline Ethical hacking What is penetration testing? Planning Reconnaissance Footprinting Network Endpoint

More information

IDS and Penetration Testing Lab ISA 674

IDS and Penetration Testing Lab ISA 674 IDS and Penetration Testing Lab ISA 674 Ethics Statement Network Security Student Certification and Agreement I,, hereby certify that I read the following: University Policy Number 1301: Responsible Use

More information

THE SANS 2005-2007 INFORMATION SECURITY SALARY & CAREER ADVANCEMENT SURVEY

THE SANS 2005-2007 INFORMATION SECURITY SALARY & CAREER ADVANCEMENT SURVEY THE SANS 2005-2007 INFORMATION SECURITY SALARY & CAREER ADVANCEMENT SURVEY What factors impact compensation? Which security certifications matter? What makes security people mad? What matters for career

More information

IQware's Approach to Software and IT security Issues

IQware's Approach to Software and IT security Issues IQware's Approach to Software and IT security Issues The Need for Security Security is essential in business intelligence (BI) systems since they have access to critical and proprietary enterprise information.

More information

Penetration testing & Ethical Hacking. Security Week 2014

Penetration testing & Ethical Hacking. Security Week 2014 Penetration testing & Ethical Hacking Security Week 2014 Agenda Penetration Testing Vulnerability Scanning Social engineering Security Services offered by Endava 2 3 Who I am Catanoi Maxim Information

More information

The fast track to top skills and top jobs in cyber. Guaranteed.

The fast track to top skills and top jobs in cyber. Guaranteed. The fast track to top skills and top jobs in cyber. Guaranteed. FREE TO QUALIFYING PARTICIPANTS WELCOME The SANS Institute is presenting the SANS CyberTalent Immersion Academy for Women to encourage women

More information

Learn Ethical Hacking, Become a Pentester

Learn Ethical Hacking, Become a Pentester Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,

More information

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 8 Desktop and Server OS Vulnerabilities

Hands-On Ethical Hacking and Network Defense Second Edition Chapter 8 Desktop and Server OS Vulnerabilities Objectives After reading this chapter and completing the exercises, you will be able to: Describe vulnerabilities of Windows and Linux operating systems Identify specific vulnerabilities and explain ways

More information

PKF Avant Edge. Penetration Testing. Stevie Heong CISSP, CISA, CISM, CGEIT, CCNP

PKF Avant Edge. Penetration Testing. Stevie Heong CISSP, CISA, CISM, CGEIT, CCNP PKF Avant Edge Penetration Testing Stevie Heong CISSP, CISA, CISM, CGEIT, CCNP What is Penetration Testing (PenTest)? A way to identify vulnerabilities that exists in a system/network that has existing

More information

Network Incident Report

Network Incident Report To submit copies of this form via facsimile, please FAX to 202-406-9233. Network Incident Report United States Secret Service Financial Crimes Division Electronic Crimes Branch Telephone: 202-406-5850

More information

Penetration tests Risk of security loopholes in IT networks

Penetration tests Risk of security loopholes in IT networks Penetration tests Risk of security loopholes in IT networks Penetration tests Risk of security loopholes in IT networks Unauthorized access to the systems and data of your company, loss of expertise, and

More information

Brandman University. School of CCNA

Brandman University. School of CCNA Information Technology Certifications CCNA The Cisco CCNA Training Package (ICND: Parts 1 and 2) includes expert instructor-led training modules with customized presentations, practice exam simulators

More information

locuz.com Professional Services Security Audit Services

locuz.com Professional Services Security Audit Services locuz.com Professional Services Security Audit Services Today s Security Landscape Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System layer.

More information

Application Intrusion Detection

Application Intrusion Detection Application Intrusion Detection Drew Miller Black Hat Consulting Application Intrusion Detection Introduction Mitigating Exposures Monitoring Exposures Response Times Proactive Risk Analysis Summary Introduction

More information

Department of Computer Science and Technology, UTU 2014

Department of Computer Science and Technology, UTU 2014 M.Sc. (CA) Semester 3 Course Name & Code: Penetration Testing (040020305) Tedi Heriyanto, Shakeel Ali, BackTrack 4: Assuring Security By Penetration Testing, Shroff/Packt Publishing is abbreviated as ST,

More information

WHITE PAPER. An Introduction to Network- Vulnerability Testing

WHITE PAPER. An Introduction to Network- Vulnerability Testing An Introduction to Network- Vulnerability Testing C ONTENTS + Introduction 3 + Penetration-Testing Overview 3 Step 1: Defining the Scope 4 Step 2: Performing the Penetration Test 5 Step 3: Reporting and

More information

Part Banker. Part Geek. All Security & Compliance.

Part Banker. Part Geek. All Security & Compliance. Part Banker. Part Geek. All Security & Compliance. Your IT Security Assessment......begins with Vulnerability Scanning to identify and classify security weaknesses in your IT network. We look for weaknesses

More information

Spooks in the Machine

Spooks in the Machine A Higher Education Services Company Spooks in the Machine Proactive Strategies for Securing the Network Steven M. Helwig, CISSP Technical Director shelwig@sungardcollegis.com Contents of Presentation Aligning

More information

MelbourneOnline.com.au Hosting Terms and Conditions

MelbourneOnline.com.au Hosting Terms and Conditions MelbourneOnline.com.au Hosting Terms and Conditions Last Updated: 5 th April 2012 MelbourneOnline.com.au provides a variety of hosting services, including web hosting, email hosting, database services,

More information

Acceptable Use Policy

Acceptable Use Policy Acceptable Use Policy Acceptable Use Policy (AUP) ionfish Group, LLC s network and services have been designed to serve its clients, partners, and employees (each individually a User ), and to enhance

More information

Career Paths in Information Security v6.0

Career Paths in Information Security v6.0 Career Paths in Information Security v6.0 Have you ever considered a career in computer security but didn t know how to get started? The Information Security industry is an exciting and diverse place to

More information

Certification Programs

Certification Programs Certification Programs 2014 The SBS Institute serves community banks by providing educational programs that will certify a banker has the knowledge and skills to protect against todays information security

More information

E-commerce. business. technology. society. Kenneth C. Laudon Carol Guercio Traver. Second Edition. Copyright 2007 Pearson Education, Inc.

E-commerce. business. technology. society. Kenneth C. Laudon Carol Guercio Traver. Second Edition. Copyright 2007 Pearson Education, Inc. Copyright 2007 Pearson Education, Inc. Slide 5-1 E-commerce business. technology. society. Second Edition Kenneth C. Laudon Carol Guercio Traver Copyright 2007 Pearson Education, Inc. Slide 5-2 Chapter

More information

Topic 1 Lesson 1: Importance of network security

Topic 1 Lesson 1: Importance of network security Topic 1 Lesson 1: Importance of network security 1 Initial list of questions Why is network security so important? Why are today s networks so vulnerable? How does Melissa virus work? How does I love you

More information

Computer Networks & Computer Security

Computer Networks & Computer Security Computer Networks & Computer Security Software Engineering 4C03 Project Report Hackers: Detection and Prevention Prof.: Dr. Kartik Krishnan Due Date: March 29 th, 2004 Modified: April 7 th, 2004 Std Name:

More information

EC-Council CAST CENTER FOR ADVANCED SECURITY TRAINING. CAST 619 Advanced SQLi Attacks and Countermeasures. Make The Difference CAST.

EC-Council CAST CENTER FOR ADVANCED SECURITY TRAINING. CAST 619 Advanced SQLi Attacks and Countermeasures. Make The Difference CAST. CENTER FOR ADVANCED SECURITY TRAINING 619 Advanced SQLi Attacks and Countermeasures Make The Difference About Center of Advanced Security Training () The rapidly evolving information security landscape

More information

EC Council Certified Ethical Hacker V8

EC Council Certified Ethical Hacker V8 Course Code: ECCEH8 Vendor: Cyber Course Overview Duration: 5 RRP: 2,445 EC Council Certified Ethical Hacker V8 Overview This class will immerse the delegates into an interactive environment where they

More information

Security Testing Summary of Next-Generation Enterprise VoIP Solution: Unify Inc. OpenScape SBC V8

Security Testing Summary of Next-Generation Enterprise VoIP Solution: Unify Inc. OpenScape SBC V8 Security Testing Summary of Next-Generation Enterprise VoIP Solution: Unify Inc. OpenScape SBC V8 SR140531D 19 August 2014 Miercom www.miercom.com Overview Unify Inc. (formerly Siemens Enterprise Communications)

More information

Social Media Security Training and Certifications. Stay Ahead. Get Certified. Ultimate Knowledge Institute. ultimateknowledge.com

Social Media Security Training and Certifications. Stay Ahead. Get Certified. Ultimate Knowledge Institute. ultimateknowledge.com Ultimate Knowledge Institute ultimateknowledge.com Social Media Security Training and Certifications Social Media Security Professional (SMSP) Social Media Engineering & Forensics Professional (SMEFP)

More information

Information Systems Security Certificate Program

Information Systems Security Certificate Program Information Technologies Programs Information Systems Security Certificate Program Accelerate Your Career extension.uci.edu/infosec University of California, Irvine Extension s professional certificate

More information