Research in Computer Viruses and Worms. Tom Chen SMU
|
|
|
- Paul Jordan
- 10 years ago
- Views:
Transcription
1 Research in Computer Viruses and Worms Tom Chen SMU
2 Outline About Me and SMU Background on Viruses/Worms Research Activities Virus research lab Early detection Epidemic modeling TC/Londonmet/ SMU Engineering p. 2
3 About Me PhD in electrical engineering from U. California, Berkeley GTE (Verizon) Labs: research in ATM switching, traffic modeling/control, network operations 1997 joined EE Dept at SMU: traffic control, mobile agents, network security TC/Londonmet/ SMU Engineering p. 3
4 About SMU Small private university with 6 schools - engineering, sciences, arts, business, law, theology 6,300 undergrads, 3,600 grads, 1,200 professional (law, theology) students School of Engineering: 51 faculty in 5 departments Dept of EE: specialization in signal processing, communications, networking, optics TC/Londonmet/ SMU Engineering p. 4
5 Background on Viruses and Worms
6 Motivations Can one IP packet cripple the Internet within 10 minutes? TC/Londonmet/ SMU Engineering p. 6
7 IP/UDP 376 bytes Internet one UDP packet 25 January 2003 example - More than 1.2 billion US dollars damage - Widespread Internet congestion - Attack peaked in 10 minutes - 70% South Korea s network paralyzed - 300,000 ISP subscribers in Portugal knocked off line - 13,000 Bank of America machines shut down - Continental Airline s ticketing system crippled TC/Londonmet/ SMU Engineering p. 7
8 IP/UDP 376 bytes Internet one UDP packet 25 January 2003 example SQL Sapphire/Slammer worm TC/Londonmet/ SMU Engineering p. 8
9 Top Viruses/Worms 70,000+ viruses are known -- only hundreds in the wild A few viruses cause the most damage Worldwide economic impact (US$ billions) up to 2001 $8.7 B $2.6 B $1.1 B $1.1 B $1.0 B Love Letter Code Red Sircam Melissa ExploreZip *estimated by Computer Economics 2001 TC/Londonmet/ SMU Engineering p. 9
10 Prevalence Viruses/worms are consistently among most common attacks % Organizations detected virus/worm attacks 82% 83% 90% 85% 94% 85% 82% *2003 CSI/FBI Computer Crime and Security Survey TC/Londonmet/ SMU Engineering p. 10
11 Damages Third most costly security attack (after theft of proprietary info and DoS) Average loss per organization due to virus/ worms (US$ K) $180K $243K $283K $200K $75K $55K $45K *2003 CSI/FBI Computer Crime and Security Survey TC/Londonmet/ SMU Engineering p. 11
12 What are Viruses Key characteristic: ability to selfreplicate by modifying (infecting) a normal program/file with a copy of itself - - Execution of the host program/file results in execution of the virus (and replication) Usually needs human action to execute infected program TC/Londonmet/ SMU Engineering p. 12
13 Cohen s Viruses Nov Fred Cohen ( father of computer virus) thought of the idea of computer viruses as a graduate student at USC - Virus named after biological virus Cohen wrote the first documented virus and demonstrated on the USC campus network TC/Londonmet/ SMU Engineering p. 13
14 Cohen s Viruses (cont) Biological virus Consists of DNA or RNA strand surrounded by protein shell to bond to host cell No life outside of host cell Replicates by taking over host s metabolic machinery with its own DNA/RNA Copies infect other cells Computer virus Consists of set of instructions stored in host program Active only when host program executed Replicates when host program is executed or host file is opened Copies infect (attach to) other host programs TC/Londonmet/ SMU Engineering p. 14
15 Virus Examples Original program Overwriting viruses Virus code Original part Prepending viruses Virus code Original program Appending viruses Original program Jump Virus code Jump TC/Londonmet/ SMU Engineering p. 15
16 Virus Anatomy Mark (optional) Infection mechanism Trigger (optional) Payload (optional) Prevents re-infection attempts Causes spread to other files Conditions for delivering payload Possible damage to infected computer (could be anything) TC/Londonmet/ SMU Engineering p. 16
17 What are Worms Worm is also self-replicating but a stand-alone program that exploits security holes to compromise other computers and spread copies of itself through the network Unlike viruses, worms do not need to parasitically attach to other programs Inherently network dependent Do not need any human action to spread TC/Londonmet/ SMU Engineering p. 17
18 Worm Anatomy Mark (optional) Infection mechanism Trigger (optional) Payload (optional) - Structurally similar to viruses, except a stand-alone program instead of program fragment - Infection mechanism searches for weakly protected computers through a network (ie, worms are networkbased) - Payload might drop a Trojan horse or parasitically infect files, so worms can have Trojan horse or virus characteristics TC/Londonmet/ SMU Engineering p. 18
19 Worms (cont) Worms are more common and dangerous than viruses today - Virtually all computers are networked - Worms spread quickly through networks without need for human actions - People are more alert about viruses (disable MS Office macros, turn on antivirus software, ) TC/Londonmet/ SMU Engineering p. 19
20 Virus/Worm Highlights John Shoch and Jon Hupp at Xerox Fred Cohen 25 years Robert Morris Jr Virus creation toolkits, Self Mutating Engine Concept macro virus Melissa (March), ExploreZip (June) Love Letter (May) Sircam (July), Code Red I+II (July-Aug.), Nimda (Sep.) Slammer (Jan.), Blaster (Aug.), Sobig.F (Aug.) TC/Londonmet/ SMU Engineering p. 20
21 Past Trends: 4 Waves Wave 1 : Experimental Wave 2 : Cross platform, polymorphic Wave 3 : Mass ers Wave 4 : Dangerous, fast, complex,... TC/Londonmet/ SMU Engineering p. 21
22 Wave John Shoch and Jon Hupp - Xerox worms 1983 Fred Cohen Brain virus Christma Exec virus Robert Morris worm Wank worm Stoned virus TC/Londonmet/ SMU Engineering p. 22
23 Wave 1 Highlights Most viruses limited to DOS and spread slowly by diskettes Experiments with worms (Xerox, Morris) got out of control Beginnings of stealth viruses and social engineering attacks TC/Londonmet/ SMU Engineering p. 23
24 Wave Polymorphic generators (MtE, SMEG, NED), virus construction toolkits (VCL, PS-MPC) 1994 Pathogen, Queeg polymorphic viruses Concept macro virus Boza, Tentacle, Punch viruses for Windows Bliss virus for Linux CIH virus, HLLP.DeTroie virus TC/Londonmet/ SMU Engineering p. 24
25 Wave 2 Highlights Easy-to-use virus toolkits allow largescale automated creation of viruses Polymorphic generators allow easy creation of polymorphic viruses (appearance is scrambled) - challenges antivirus software Most viruses target Windows Macro viruses go cross-platform TC/Londonmet/ SMU Engineering p. 25
26 Wave Happy99 worm Melissa macro virus PrettyPark, ExploreZip worms 2000 BubbleBoy virus, KAK worm Love Letter worm Hybris worm 2001 Anna Kournikova worm TC/Londonmet/ SMU Engineering p. 26
27 Wave 3 Highlights Mass ing viruses become most popular - Attacks increase in speed and scope Social engineering (tricking users into opening attachments) becomes common Worms start to become dangerous (data theft, dynamic plug-ins) TC/Londonmet/ SMU Engineering p. 27
28 Wave Ramen, Davinia worms Lion, Gnutelman worms Sadmind worm Sircam, Code Red I, Code Red II worms Nimda worm Badtrans, Klez, Bugbear worms Gibe worm 2003 Slapper worm Winevar worm Lirva, Sapphire/Slammer worms Fizzer worm Blaster, Welchia/Nachi, Sobig.F worms TC/Londonmet/ SMU Engineering p. 28
29 Wave 4 Highlights New infection vectors (Linux, peer-to-peer, IRC chat, instant messaging,...) Blended attacks (combined vectors) Dynamic code updates (via IRC, web,...) Dangerous payloads - backdoors, spyware Armored viruses try to disable antivirus software Sophisticated worms (Code Red, Nimda, Slammer, Blaster) spread very fast TC/Londonmet/ SMU Engineering p. 29
30 Top 2004 Worms MyDoom spreads by to Windows PCs, searches for addresses in various files, opens backdoor for remote access Netsky spreads by , exploits Internet Explorer to automatically execute attachments, removes MyDoom and Bagle from PCs TC/Londonmet/ SMU Engineering p. 30
31 Top 2004 Worms (cont) Bagle spreads by , tries to remove Netsky from PCs, opens backdoor for remote access, downloads code updates from Web, disables antivirus and firewall software TC/Londonmet/ SMU Engineering p. 31
32 Current Defenses Antivirus software Operating system patching Firewalls Intrusion detection systems (IDS) Router access control lists So why do worm outbreaks continue? TC/Londonmet/ SMU Engineering p. 32
33 Software Issues Antivirus software works by virus signatures combined with heuristics - Signatures are more accurate, but need time to develop for each new virus and constant updating - Heuristics can detect new viruses before signature is available, but not perfect detection Many people do not use antivirus software or keep it updated TC/Londonmet/ SMU Engineering p. 33
34 Software Issues (cont) OS patches are announced regularly, but not always used Constant patching takes time and effort Patches can cause software conflicts Patches are often available only for most critical vulnerabilities Missed patches leaves window of vulnerability for worms to exploit TC/Londonmet/ SMU Engineering p. 34
35 Network Issues Firewalls are partially effective but - Need expert configuration of filter rules - May still allow viruses/worms to pass via allowed services - May allow new viruses/worms to pass Current IDS equipment are susceptible to high rates of false positives (false alarms) - Detection accuracy is major issue TC/Londonmet/ SMU Engineering p. 35
36 Research Activities
37 Research Activities Virus research lab Early detection of worms Epidemic modeling TC/Londonmet/ SMU Engineering p. 37
38 Virus Research Lab Distributed computers in EE building and Business School Internet Campus network Cox Business School EE Building TC/Londonmet/ SMU Engineering p. 38
39 Virus Research Lab (cont) Intrusion detection systems to monitor live traffic - Snort, Prelude, Samhain Honeypots to catch viruses - Honeyd, Logwatch, Nagios Network/virus simulator - To simulate virus behaviors in different network topologies TC/Londonmet/ SMU Engineering p. 39
40 Early Detection of Worms Goal is global system for early warning of new worm outbreaks Jointly with Symantec to enhance their DeepSight Threat Management System - - DeepSight collects log data from hosts, firewalls, IDSs from 20,000 organizations in 180 countries Symantec correlates and analyzes traffic data to track attacks by type, source, time, targets TC/Londonmet/ SMU Engineering p. 40
41 Early Detection (cont) Architecture of DeepSight Signatures Correlation + analysis Data collection IDS Internet IDS TC/Londonmet/ SMU Engineering p. 41
42 Early Detection (cont) Addition of honeypots to DeepSight Honeypots are decoy computers configured to appear vulnerable to attract attacks and collect data about attacker behavior - Can be used to capture worms - Carefully restricted from spreading any attacks to network TC/Londonmet/ SMU Engineering p. 42
43 Epidemic Modeling Epidemic models predict spreading of diseases through populations - Deterministic and stochastic models developed over 250 years - Helped devise vaccination strategies, eg, smallpox Our goal is to adapt epidemic models to computer viruses and worms - Take into account different behavior of computer viruses and effect of network congestion TC/Londonmet/ SMU Engineering p. 43
44 Basic Epidemic Model Assumes all hosts are initially Susceptible, can become Infected after contact with an Infected - Assumes fixed population and random contacts Number of Infected hosts shows logistic growth TC/Londonmet/ SMU Engineering p. 44
45 Basic Epidemic (cont) Logistic equation predicts S growth Observed worm outbreaks (eg, Code Red) tend to slow down more quickly than predicted Predicted Number infected Observed TC/Londonmet/ SMU Engineering p. 45
46 Basic Epidemic (cont) Initial rate is exponential: random scanning is efficient when susceptible hosts are many Later rate slow downs: random scanning is inefficient when susceptible hosts are few Spreading rate also slows due to network congestion caused by heavy worm traffic TC/Londonmet/ SMU Engineering p. 46
47 Dynamic Quarantine Recent worms spread too quickly for manual response Dynamic quarantine tries to isolate worm outbreak from spreading to other parts of Internet - Cisco and Microsoft proposals Epidemic model? TC/Londonmet/ SMU Engineering p. 47
48 Quarantining (cont) Community of households epidemic model assumes - - Population is divided into households Infection rates within households can be different than between households Similar to structure of Internet as network of networks TC/Londonmet/ SMU Engineering p. 48
49 Quarantining (cont) Intra-network infection rates Network (household) Network (household) Network (household) Network (household) Inter-network infection rates -- Control these rates for quarantining TC/Londonmet/ SMU Engineering p. 49
50 Conclusions Viruses and worms will continue to be an enormous network security problem New technologies are needed in - Early detection - Dynamic quarantining - Intrusion-tolerant networks TC/Londonmet/ SMU Engineering p. 50
Cryptography and Network Security Chapter 21. Malicious Software. Backdoor or Trapdoor. Logic Bomb 4/19/2010. Chapter 21 Malicious Software
Cryptography and Network Security Chapter 21 Fifth Edition by William Stallings Chapter 21 Malicious Software What is the concept of defense: The parrying of a blow. What is its characteristic feature:
Randy Lee FireEye Labs. Understanding Modern Malware.
Randy Lee FireEye Labs Understanding Modern Malware. History Of Malware 1971 1975 1986 1990 Creeper Virus - Experimental self replicating worm Rabbit - The Fork Bomb 1974 Pervading Animal - First Trojan
Malicious Software. Malicious Software. Overview. Backdoor or Trapdoor. Raj Jain. Washington University in St. Louis
Malicious Software Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
1949 Self-reproducing cellular automata. 1959 Core Wars
114 Virus timeline When did viruses, Trojans and worms begin to pose a threat? Most histories of viruses start with the Brain virus, written in 1986. That was just the first virus for a Microsoft PC, though.
Real-time Network Monitoring and Security Platform for Securing Next-Generation Network. Assoc. Prof. Dr. Sureswaran Ramadass
Real-time Network Monitoring and Security Platform for Securing Next-Generation Network Assoc. Prof. Dr. Sureswaran Ramadass The platform Definition A description of a software framework that makes services
Comparison of Firewall, Intrusion Prevention and Antivirus Technologies
White Paper Comparison of Firewall, Intrusion Prevention and Antivirus Technologies How each protects the network Juan Pablo Pereira Technical Marketing Manager Juniper Networks, Inc. 1194 North Mathilda
Computer Security DD2395
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh11/ Fall 2011 Sonja Buchegger [email protected] Lecture 7 Malicious Software DD2395 Sonja Buchegger 1 Course Admin Lab 2: - prepare
Computer Viruses: How to Avoid Infection
Viruses From viruses to worms to Trojan Horses, the catchall term virus describes a threat that's been around almost as long as computers. These rogue programs exist for the simple reason to cause you
Denial of Service. Tom Chen SMU [email protected]
Denial of Service Tom Chen SMU [email protected] Outline Introduction Basics of DoS Distributed DoS (DDoS) Defenses Tracing Attacks TC/BUPT/8704 SMU Engineering p. 2 Introduction What is DoS? 4 types
Sapphire/Slammer Worm. Code Red v2. Sapphire/Slammer Worm. Sapphire/Slammer Worm. Sapphire/Slammer Worm. Why Was Slammer So Fast?
First Worm Ever Morris Worm Robert Morris, a PhD student at Cornell, was interested in network security He created the first worm with a goal to have a program live on the Internet in November 9 Worm was
WORMS : attacks, defense and models. Presented by: Abhishek Sharma Vijay Erramilli
WORMS : attacks, defense and models Presented by: Abhishek Sharma Vijay Erramilli What is a computer worm? Is it not the same as a computer virus? A computer worm is a program that selfpropagates across
WORMS HALMSTAD UNIVERSITY. Network Security. Network Design and Computer Management. Project Title:
HALMSTAD UNIVERSITY Network Design and Computer Management Course Title: Network Security Project Title: WORMS Project members: - Tchape Philippe 841122-T099 - Jose Enrique Charpentier 830112-9154 Lecturer:
Network Incident Report
To submit copies of this form via facsimile, please FAX to 202-406-9233. Network Incident Report United States Secret Service Financial Crimes Division Electronic Crimes Branch Telephone: 202-406-5850
Managing Security Risks in Modern IT Networks
Managing Security Risks in Modern IT Networks White Paper Table of Contents Executive summary... 3 Introduction: networks under siege... 3 How great is the problem?... 3 Spyware: a growing issue... 3 Feeling
CS549: Cryptography and Network Security
CS549: Cryptography and Network Security by Xiang-Yang Li Department of Computer Science, IIT Cryptography and Network Security 1 Notice This lecture note (Cryptography and Network Security) is prepared
SECURITY TERMS: Advisory Backdoor - Blended Threat Blind Worm Bootstrapped Worm Bot Coordinated Scanning
SECURITY TERMS: Advisory - A formal notice to the public on the nature of security vulnerability. When security researchers discover vulnerabilities in software, they usually notify the affected vendor
Malicious Software. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ [email protected] +46 470 70 86 49. Viruses and Related Threats
Malicious Software Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ [email protected] +46 470 70 86 49 1 Outline Viruses and Related Threats Malicious Programs The Nature of Viruses Antivirus
Security Engineering Part III Network Security. Intruders, Malware, Firewalls, and IDSs
Security Engineering Part III Network Security Intruders, Malware, Firewalls, and IDSs Juan E. Tapiador [email protected] Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer
Security Information Management (SIM)
1. A few general security slides 2. What is a SIM and why is it needed 3. What are the features and functions of a SIM 4. SIM evaluation criteria 5. First Q&A 6. SIM Case Studies 7. Final Q&A Brian T.
CS 356 Lecture 9 Malicious Code. Spring 2013
CS 356 Lecture 9 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and Terminology Integrity, Confidentiality, Availability, Authentication, and Accountability Types of threats: active vs. passive,
HoneyBOT User Guide A Windows based honeypot solution
HoneyBOT User Guide A Windows based honeypot solution Visit our website at http://www.atomicsoftwaresolutions.com/ Table of Contents What is a Honeypot?...2 How HoneyBOT Works...2 Secure the HoneyBOT Computer...3
ANTIVIRUS BEST PRACTICES
ANTIVIRUS BEST PRACTICES Antivirus Best Practices 1. Introduction This guideline covers the basics on Antivirus Software and its best practices. It will help to have an overall understanding of the subject
Spam, Spyware, Malware and You! Don't give up just yet! Presented by: Mervin Istace Provincial Library Saskatchewan Learning
Spam, Spyware, Malware and You! Don't give up just yet! Presented by: Mervin Istace Provincial Library Saskatchewan Learning Lee Zelyck Network Administrator Regina Public Library Malware, Spyware, Trojans
The Critical Importance of Three Dimensional Protection (3DP) in an Intrusion Prevention System
The Critical Importance of Three Dimensional Protection (3DP) in an Intrusion Prevention System Top Layer Networks, Inc. Enterprises without a sound intrusion prevention strategy across the three threat
Denial of Service (DoS) Technical Primer
Denial of Service (DoS) Technical Primer Chris McNab Principal Consultant, Matta Security Limited [email protected] Topics Covered What is Denial of Service? Categories and types of Denial of
Integrated Protection for Systems. João Batista [email protected] Territory Manager
Integrated Protection for Systems João Batista [email protected] Territory Manager 2 McAfee Overview Proven Expertise And what it means to you Proof of Expertise Impact of Expertise 1 17 100 300
MALWARE THREATS AND TRENDS. Chris Blow, Director Dustin Hutchison, Director
MALWARE THREATS AND TRENDS Chris Blow, Director Dustin Hutchison, Director WHAT IS MALWARE? Malicious Software Viruses Worms Trojans Rootkits Spyware Ransomware 2 MALWARE ORIGINS Users bring it from home
The Reverse Firewall: Defeating DDOS Attacks Emanating from a Local Area Network
Pioneering Technologies for a Better Internet Cs3, Inc. 5777 W. Century Blvd. Suite 1185 Los Angeles, CA 90045-5600 Phone: 310-337-3013 Fax: 310-337-3012 Email: [email protected] The Reverse Firewall: Defeating
Malicious Programs. CEN 448 Security and Internet Protocols Chapter 19 Malicious Software
CEN 448 Security and Internet Protocols Chapter 19 Malicious Software Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University [email protected]
IDS / IPS. James E. Thiel S.W.A.T.
IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods
Norton Personal Firewall for Macintosh
Norton Personal Firewall for Macintosh Evaluation Guide Firewall Protection for Client Computers Corporate firewalls, while providing an excellent level of security, are not always enough protection for
Computer Security Maintenance Information and Self-Check Activities
Computer Security Maintenance Information and Self-Check Activities Overview Unlike what many people think, computers are not designed to be maintenance free. Just like cars they need routine maintenance.
CSE331: Introduction to Networks and Security. Lecture 15 Fall 2006
CSE331: Introduction to Networks and Security Lecture 15 Fall 2006 Worm Research Sources "Inside the Slammer Worm" Moore, Paxson, Savage, Shannon, Staniford, and Weaver "How to 0wn the Internet in Your
Network Immunity Solution. Technical White paper. ProCurve Networking
ProCurve Networking Network Immunity Solution Technical White paper Introduction... 2 Current Security Threats... 2 Solutions for Internal Threat Protection... 2 Network Immunity Solution: What It Is and
CSE331: Introduction to Networks and Security. Lecture 17 Fall 2006
CSE331: Introduction to Networks and Security Lecture 17 Fall 2006 Announcements Project 2 is due next Weds. Homework 2 has been assigned: It's due on Monday, November 6th. CSE331 Fall 2004 2 Summary:
Intruders and viruses. 8: Network Security 8-1
Intruders and viruses 8: Network Security 8-1 Intrusion Detection Systems Firewalls allow traffic only to legitimate hosts and services Traffic to the legitimate hosts/services can have attacks CodeReds
Malware: Malicious Code
Malware: Malicious Code UIC 594/Kent Law: Computer and Network Privacy and Security: Ethical, Legal, and Technical Considerations 2007, 2008 Robert H. Sloan Malicious code: Viruses Most famous type of
Contact details For contacting ENISA or for general enquiries on information security awareness matters, please use the following details:
Malicious software About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for
INSIDE. Malicious Threats of Peer-to-Peer Networking
Symantec Security Response WHITE PAPER Malicious Threats of Peer-to-Peer Networking by Eric Chien, Symantec Security Response INSIDE Background Protocols New Vector of Delivery Malicious Uses of Peer-to-Peer
Symantec enterprise security. Symantec Internet Security Threat Report April 2009. An important note about these statistics.
Symantec enterprise security Symantec Internet Security Threat Report April 00 Regional Data Sheet Latin America An important note about these statistics The statistics discussed in this document are based
What are Viruses, Trojans, Worms & Spyware:
What are Viruses, Trojans, Worms & Spyware: There are many different types of computer viruses circulating in the cyber world, including regular Computer Viruses, Worms, Trojans, and Spyware. Each is different
HACKING RELOADED. Hacken IS simple! Christian H. Gresser [email protected]
HACKING RELOADED Hacken IS simple! Christian H. Gresser [email protected] Agenda About NESEC IT-Security and control Systems Hacking is easy A short example where we currently are Possible solutions IT-security
Understanding Computer Viruses: What They Can Do, Why People Write Them and How to Defend Against Them
Lab Exercises Understanding Computer Viruses: What They Can Do, Why People Write Them and How to Defend Against Them Review Questions 1) In class, we made the distinction between a front-door attack and
Computer System Security Updates
Why patch? If you have already deployed a network architecture, such as the one recommended by Rockwell Automation and Cisco in the Converged Plantwide Ethernet Design and Implementation Guide (http://www.ab.com/networks/architectures.html),
Information Security Threat Trends
Talk @ Microsoft Security Day Sep 2005 Information Security Threat Trends Mr. S.C. Leung 梁 兆 昌 Senior Consultant 高 級 顧 問 CISSP CISA CBCP M@PISA Email: [email protected] 香 港 電 腦 保 安 事 故 協 調 中 心 Introducing
Intrusion Detection for Mobile Ad Hoc Networks
Intrusion Detection for Mobile Ad Hoc Networks Tom Chen SMU, Dept of Electrical Engineering [email protected] http://www.engr.smu.edu/~tchen TC/Rockwell/5-20-04 SMU Engineering p. 1 Outline Security problems
OfficeScan 10 Enterprise Client Firewall Updated: March 9, 2010
OfficeScan 10 Enterprise Client Firewall Updated: March 9, 2010 What is Trend Micro OfficeScan? Trend Micro OfficeScan Corporate Edition protects campus networks from viruses, Trojans, worms, Web-based
INSIDE. Securing Network-Attached Storage Protecting NAS from viruses, intrusions, and blended threats
Symantec Enterprise Security WHITE PAPER Securing Network-Attached Storage Protecting NAS from viruses, intrusions, and blended threats INSIDE Executive Summary Challenges to securing NAS An effective
Deep Security Vulnerability Protection Summary
Deep Security Vulnerability Protection Summary Trend Micro, Incorporated This documents outlines the process behind rules creation and answers common questions about vulnerability coverage for Deep Security
Spyware. Michael Glenn Technology Management [email protected]. 2004 Qwest Communications International Inc.
Spyware Michael Glenn Technology Management [email protected] Agenda Security Fundamentals Current Issues Spyware Definitions Overlaps of Threats Best Practices What Service Providers are Doing References
ACS-3921/4921-050 Computer Security And Privacy. Lecture Note 5 October 7 th 2015 Chapter 5 Database and Cloud Security
ACS-3921/4921-050 Computer Security And Privacy Lecture Note 5 October 7 th 2015 Chapter 5 Database and Cloud Security ACS-3921/4921-050 Slides Used In The Course A note on the use of these slides: These
ABB s approach concerning IS Security for Automation Systems
ABB s approach concerning IS Security for Automation Systems Copyright 2006 ABB. All rights reserved. Stefan Kubik [email protected] The problem Most manufacturing facilities are more connected (and
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
Intrusion Forecasting Framework for Early Warning System against Cyber Attack
Intrusion Forecasting Framework for Early Warning System against Cyber Attack Sehun Kim KAIST, Korea Honorary President of KIISC Contents 1 Recent Cyber Attacks 2 Early Warning System 3 Intrusion Forecasting
Cisco IPS Tuning Overview
Cisco IPS Tuning Overview Overview Increasingly sophisticated attacks on business networks can impede business productivity, obstruct access to applications and resources, and significantly disrupt communications.
Certified Ethical Hacker Exam 312-50 Version Comparison. Version Comparison
CEHv8 vs CEHv7 CEHv7 CEHv8 19 Modules 20 Modules 90 Labs 110 Labs 1700 Slides 1770 Slides Updated information as per the latest developments with a proper flow Classroom friendly with diagrammatic representation
Course Title: Penetration Testing: Security Analysis
Course Title: Penetration Testing: Security Analysis Page 1 of 9 Course Description: The Security Analyst Series from EC-Council Press is comprised of five books covering a broad base of topics in advanced
Is Your Network a Sitting Duck? 3 Secrets to Securing Your Information Systems. Presenter: Matt Harkrider. Founder, Alert Logic
Is Your Network a Sitting Duck? 3 Secrets to Securing Your Information Systems Presenter: Matt Harkrider Founder, Alert Logic Who We Are: Corporate Fact Sheet Founded: 2002 Sample Customers: HQ: Houston,
Online Security Awareness - UAE Exchange - Foreign Exchange Send Money UAE Exchange
The responsibility of safeguarding your personal information starts with you. Your information is critical and it must be protected from unauthorised disclosure, modification or destruction. Here we are
Network Monitoring Tool to Identify Malware Infected Computers
Network Monitoring Tool to Identify Malware Infected Computers Navpreet Singh Principal Computer Engineer Computer Centre, Indian Institute of Technology Kanpur, India [email protected] Megha Jain, Payas
Threats and Vulnerabilities. Ed Crowley
Threats and Vulnerabilities Ed Crowley Threat and Vulnerability Objectives At the end of this course, you should be able to analyze and differentiate among types of: Malware Attacks Social engineering
How To Protect Your Network From Attack From A Virus And Attack From Your Network (D-Link)
NetDefend Firewall UTM Services Unified Threat Management D-Link NetDefend UTM firewalls (DFL-260/860) integrate an Intrusion Prevention System (IPS), gateway AntiVirus (AV), and Web Content Filtering
Malware: Malicious Software
Malware: Malicious Software 10/21/2010 Malware 1 Viruses, Worms, Trojans, Rootkits Malware can be classified into several categories, depending on propagation and concealment Propagation Virus: human-assisted
VBSim. Symantec Computer Virus/Worm Simulation System. Version 1.2. Copyright 1999, Symantec Corporation
Symantec Computer Virus/Worm Simulation System Version 1.2 Copyright 1999, Symantec Corporation Contents About VBSim... 3 Simulating the spread of malware... 3 Understanding the VBSim interface... 4 Demonstrating
1 Introduction. Agenda Item: 7.23. Work Item:
3GPP TSG SA WG3 Security S3#34 S3-040583 6-9 Jul 2004 updated S3-040566 Acapulco, Mexico Title: Selective Disabling of UE Capabilities; updated S3-040566 based on the comments on SA3 mailing list Source:
Desktop Security. Overview and Technology Guidance. Michael Ramsey Network Specialist, NC DPI
Desktop Security Overview and Technology Guidance Michael Ramsey Network Specialist, NC DPI Desktop Security Best practices for both the technical type and the typical user Defensive Layering Top Vulnerabilities
CONFIGURING TCP/IP ADDRESSING AND SECURITY
1 Chapter 11 CONFIGURING TCP/IP ADDRESSING AND SECURITY Chapter 11: CONFIGURING TCP/IP ADDRESSING AND SECURITY 2 OVERVIEW Understand IP addressing Manage IP subnetting and subnet masks Understand IP security
Lecture 13 - Network Security
Lecture 13 - Network Security CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ Exploiting the network... The Internet is extremely
Intrusion Detection. Tianen Liu. May 22, 2003. paper will look at different kinds of intrusion detection systems, different ways of
Intrusion Detection Tianen Liu May 22, 2003 I. Abstract Computers are vulnerable to many threats. Hackers and unauthorized users can compromise systems. Viruses, worms, and other kinds of harmful code
Network Security in Vietnam and VNCERT. Network Security in Vietnam and VNCERT
Network Security in Vietnam and VNCERT 1. Information Security Problems 2. Legal and Law 3. Plan for establishing VNCERT 4. Cooperation Network Security in Vietnam and VNCERT Information Security Problems:
Second-generation (GenII) honeypots
Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. [email protected] Abstract Honeypots are security resources which trap malicious activities, so they
CS 640 Introduction to Computer Networks. Network security (continued) Key Distribution a first step. Lecture24
Introduction to Computer Networks Lecture24 Network security (continued) Key distribution Secure Shell Overview Authentication Practical issues Firewalls Denial of Service Attacks Definition Examples Key
Building A Secure Microsoft Exchange Continuity Appliance
Building A Secure Microsoft Exchange Continuity Appliance Teneros, Inc. 215 Castro Street, 3rd Floor Mountain View, California 94041-1203 USA p 650.641.7400 f 650.641.7401 ON AVAILABLE ACCESSIBLE Building
How To Protect Your Network From Attack From A Hacker On A University Server
Network Security: A New Perspective NIKSUN Inc. Security: State of the Industry Case Study: Hacker University Questions Dave Supinski VP of Regional Sales [email protected] Cell Phone 215-292-4473 www.niksun.com
INTRUSION DETECTION SYSTEMS and Network Security
INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS
Data Centers Protection from DoS attacks. Trends and solutions. Michael Soukonnik, Radware Ltd [email protected] Riga. Baltic IT&T. 21.04.
Data Centers Protection from DoS attacks. Trends and solutions Michael Soukonnik, Radware Ltd [email protected] Riga. Baltic IT&T. 21.04.2010 Cybercrime Trends Page 2 Types of DoS attacks and classical
Information Security By Bhupendra Ratha, Lecturer School of Library & Information Science D.A.V.V., Indore E-mail:[email protected] Outline of Information Security Introduction Impact of information Need
WatchGuard Gateway AntiVirus
Gateway AntiVirus WatchGuard Gateway AntiVirus Technical Brief WatchGuard Technologies, Inc. Published: March 2011 Malware Continues to Grow New and ever-changing threats appear with alarming regularity,
Cisco Security Agent (CSA) Network Admission Control (NAC)
Cisco Security Agent (CSA) Network Admission Control (NAC) Pascal Delprat Security Consultant Cisco France Vincent Bieri Marketing Manager, Security EMEA Technology Marketing Organisation 1 Agenda CSA
Chapter 14 Computer Threats
Contents: Chapter 14 Computer Threats 1 Introduction(Viruses,Bombs,Worms) 2 Categories of Viruses 3 Types of Viruses 4 Characteristics of Viruses 5 Computer Security i. Antivirus Software ii. Password,
(Self-Study) Identify How to Protect Your Network Against Viruses
SECTION 24 (Self-Study) Identify How to Protect Your Network Against Viruses The following objective will be tested: Describe What You Can Do to Prevent a Virus Attack In this section you learn about viruses
Network- vs. Host-based Intrusion Detection
Network- vs. Host-based Intrusion Detection A Guide to Intrusion Detection Technology 6600 Peachtree-Dunwoody Road 300 Embassy Row Atlanta, GA 30348 Tel: 678.443.6000 Toll-free: 800.776.2362 Fax: 678.443.6477
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology. Project Proposal 1
Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology Project Proposal 1 Project Proposal 2 Abstract Honeypot systems are readily used by organizations large and
Intelligent Worms: Searching for Preys
Intelligent Worms: Searching for Preys By Zesheng Chen and Chuanyi Ji ABOUT THE AUTHORS. Zesheng Chen is currently a Ph.D. Candidate in the Communication Networks and Machine Learning Group at the School
Understanding Virus Behavior in 32-bit Operating Environments
Understanding Virus Behavior in 32-bit Operating Environments Executive Summary Computer Viruses and How They Spread Types of Viruses How Viruses Spread Virus Damage Viruses in a Windows 95 Environment
WHITE PAPER. Understanding How File Size Affects Malware Detection
WHITE PAPER Understanding How File Size Affects Malware Detection FORTINET Understanding How File Size Affects Malware Detection PAGE 2 Summary Malware normally propagates to users and computers through
Network Security Demonstration - Snort based IDS Integration -
Network Security Demonstration - Snort based IDS Integration - Hyuk Lim ([email protected]) with TJ Ha, CW Jeong, J Narantuya, JW Kim Wireless Communications and Networking Lab School of Information and
How to build and use a Honeypot. Ralph Edward Sutton, Jr. DTEC 6873 Section 01
How to build and use a Honeypot By Ralph Edward Sutton, Jr DTEC 6873 Section 01 Abstract Everybody has gotten hacked one way or another when dealing with computers. When I ran across the idea of a honeypot
Lifecycle Solutions & Services. Managed Industrial Cyber Security Services
Lifecycle Solutions & Services Managed Industrial Cyber Security Services Around the world, industrial firms and critical infrastructure operators partner with Honeywell to address the unique requirements