Editor's note

and nonsense information displayed. This attack uses
password cracking to penetrate websites that the
attacker wants to deface. Some of the common ways
to get into a website is by dictionary attack. A dictionary
file (a text file full of dictionary words) is loaded into
a cracking application, which is run against common
user accounts used by the application or website login.
Because the majority of passwords are often simplistic,
running a dictionary attack is often sufficient to do the
job.
Packet Sniffing
Packet sniffer is an application that captures data
packets, which can be used to capture passwords and
other data in transit over the network.
Key Loggers
These are programs that record keystrokes made by a
user, allowing crackers to discover passwords and login
codes.
Rootkits and Backdoors
Rootkits are a collection of programs that permits
administrator-level control of a computer. Hackers
use rootkits to control computers and evade detection.
Backdoors are methods of circumventing the normal
operating-system procedures, allowing a cracker to
access information on another computer.
Spoong attack (Phishing)
A spoofing attack usually involves a program, system, or
website masquerading as another thereby being treated
as a trusted system by a user or another program. The
purpose of this is usually to fool programs, systems, or
users into revealing confidential information, such as
user names and passwords, to the attacker.
Vulnerability Scanner
A vulnerability scanner is a tool used to check computers
and networks for known weaknesses. Hackers also
commonly use port scanners. These softwares check
to see which ports on a specified computer are open
or available to access the computer. Once open ports
are discovered smart programmers can access the
computer or network and cause havoc.
So how do you protect your organization from such
attacks? The simple answer of avoiding the internet
is not a feasible answer because the global economy
now depends on the internet, and you cannot opt
out of it. Hence, customers, businessmen and
governments need additional confidence that their
money, confidential documents, military secrets,
starterkit 02/2011(2)
SOLUTIONS
etc., are not compromised by pranksters and
enemies. Providing this additional confidence lies
in implementing a proper cyber security system to
prevent unauthorized entry into a computer network.
However, an important question that arises in all
these discussions is – who are the owners of cyber
security in an organization? Most would immediately
say the owners would (or should) be the person(s)
supporting the IT equipment. After all, you might
argue those techies are the ones babysitting the
computer systems. But this is an incorrect assumption.
Actually, the true owners of cyber security are the
business managers of your organization. Though your
organization may have hired some IT staff or external
vendors to manage the IT infrastructure, but from a
business perspective they are not the owners of your
cyber security. For example, if your server gets hacked
and funds stolen from customer accounts the techies
cannot be solely blamed for the crime and reputation
damage. They may technically operate the system, but
it is your business managers who should understand
the potential loss in terms of financial, reputation or
legal aspects of cyber attacks. In most organizations
business managers do not understand (or try to
understand) the technical department’s work and
constraints, and technical people do not understand (or
try to understand) the business people’s needs. While
this does not mean the business manager become
techies themselves, they can assist in implementing
cyber security by doing the following good deeds for
their techies.
Knowledge
The advancement and easy availability of new and
useful technologies today have enabled thousands
of organizations worldwide to implement and become
heavily dependent on technology for running their
businesses. Today, it is not possible to run any
organization, small or big, without the use of some
computer- or telecom-related technology. With so much
proliferation of hardware, software and networking
equipment, it is necessary for business managers
to be aware of the advantages and disadvantages
of using technology. While it does not mean they
start operating the computers themselves, business
managers must understand what the loss is in terms of
financial, reputation, regulatory or legal consequences
for disasters related to cyber threats.
Financial Support
Provide necessary budgets for comprehensive
maintenance of hardware, software, telecom equipment,
spares, backup devices, etc. For example, suppose
Page 42 http://pentestmag.com