CIS 450 Network Security

1
CIS 450 Network Security

• Chapter 1 - Introduction

2
General Trends

• Systems are easy to break into
• Wide range of skill and expertise
• Script kiddies have lots of time but low
  expertise
• Experienced hackers with high expertise

3
General Trends
4
General Trends

• Tools for automating attacks are easy to obtain
  on the Internet
• Boundless nature of the Internet
• Vast pool of resources
• No one is policing the Internet
• Companies do not report
• Ignorance sites do not know they are being
  attacked
• Bad Publicity

5
How Did it Get So Bad

• Y2K Issue
• Cost and Ineffectiveness of Fixing Existing
  Systems, security is an afterthought
• Intangible nature of security benefits

6
What Are Companies Doing

• Zero Tolerance
• Security through Obscurity
• Attempting to fix established system, put in
  firewall and other security measures after the
  network is built
• Concentrating on all or nothing approach

7
What Companies Should Not Be Doing
8
What Should Companies Be Doing

• Invest in Prevention and Detection
• Close the Biggest Holes First
• Raise Security Level to Stop Casual and Amateur
  Attackers guard against low-tech exploits (User
  Id of guest)
• More Focus on Detection
• Have an Intrusion Detection Systems (IDS)
• Logging Events
• Awareness Training for Employees

9
Defense in Depth