Improving Web Application Security: Threats and - CGISecurity

406 Part IV: Securing Your Network, Host, and ApplicationSniffingSniffing, also called eavesdropping, is the act of monitoring network traffic for data,such as clear-text passwords or configuration information. With a simple packetsniffer, all plaintext traffic can be read easily. Also, lightweight hashing algorithmscan be cracked and the payload that was thought to be safe can be deciphered.VulnerabilitiesCommon vulnerabilities that make your network susceptible to data sniffing include:●●●Weak physical securityLack of encryption when sending sensitive dataServices that communicate in plain text or weak encryption or hashingAttacksThe attacker places packet sniffing tools on the network to capture all traffic.CountermeasuresCountermeasures include the following:●●Strong physical security that prevents rogue devices from being placed on thenetworkEncrypted credentials and application traffic over the networkSpoofingSpoofing, also called identity obfuscation, is a means to hide one’s true identity on thenetwork. A fake source address is used that does not represent the actual packetoriginator’s address. Spoofing can be used to hide the original source of an attack orto work around network access control lists (ACLs) that are in place to limit hostaccess based on source address rules.VulnerabilitiesCommon vulnerabilities that make your network susceptible to spoofing include:● The inherently insecure nature of the TCP/IP protocol suite● Lack of ingress and egress filtering. Ingress filtering is the filtering of any IPpackets with untrusted source addresses before they have a chance to enter andaffect your system or network. Egress filtering is the process of filtering outboundtraffic from your network.AttacksAn attacker can use several tools to modify outgoing packets so that they appear tooriginate from an alternate network or host.