Improving Web Application Security: Threats and - CGISecurity

Chapter 15: Securing Your Network 405Threats and CountermeasuresAn attacker looks for poorly configured network devices to exploit. Commonvulnerabilities include weak default installation settings, wide-open access controls,and unpatched devices. The following are high-level network threats:● Information gathering● Sniffing● Spoofing● Session hijacking● Denial of serviceWith knowledge of the threats that can affect the network, you can apply effectivecountermeasures.Information GatheringInformation gathering can reveal detailed information about network topology,system configuration, and network devices. An attacker uses this information tomount pointed attacks at the discovered vulnerabilities.VulnerabilitiesCommon vulnerabilities that make your network susceptible to an attack include:● The inherently insecure nature of the TCP/IP protocol suite● Configuration information provided by banners● Exposed services that should be blockedAttacksCommon information-gathering attacks include:● Using Tracert to detect network topology●●●Using Telnet to open ports for banner grabbingUsing port scans to detect open portsUsing broadcast requests to enumerate hosts on a subnetCountermeasuresYou can employ the following countermeasures:●●Use generic service banners that do not give away configuration information suchas software versions or names.Use firewalls to mask services that should not be publicly exposed.