The Security Game

1
The Security Game

• By Erik A. Espinoza
• espinoza_at_forcenetworks.com

2
The Objective

• Access Control
• Trust
• People need to get work done!

The Problem
3
The Players

• People
• Users
• Crackers
• White Hats The Good Guys
• Black Hats The Bad Guys
• Script Kiddies
• Grey Hats Characteristics of both

• Computers
• Trojans
• Viruses
• Worms
• Malware (spyware/adware)

4
Attack Vectors

• Automated Attacks Requires a machine to be
  listening for penetration. Not necessary for
  Denial of Service attack.
• Directed Attacks
• Usually takes advantage of misconfigured access
  control
• Buffer overflows/underflows
• Tricking Users

5
Risk Assessment

• Budgetary Constraints
• Usability Tradeoffs
• Too Draconian to be Practical

6
Weapons

• Acceptable Use Policy
• Strict Deny All default policy
• Disable unused functionality
• Security Audits
• Configuration Versioning Control
• Patching

7
Power Ups

• Classes
• Books
• Mailing Lists
• Tech Friends
• Tech News