Symantec™ Security Gateways Reference Guide - Sawmill

22 Network security overviewSecurity considerationsStealing informationOnce into your network, it is more difficult to prevent an attacker from stealing sensitive information.However, assuming that your perimeter defense has not been compromised, an attacker may look atalternative methods to gain access. Information about your network is very useful to attackers desiringaccess. You should keep names of computers, accounts, IP addresses, and other similar informationconfidential. Give extra attention to guarding passwords, as there are several ways to compromise them:SniffingTrojan horseSocial engineeringNetworks are monitored for users entering their passwords as they log on. Although passwordsare sometimes encrypted over public networks, it is possible to obtain the original password byrunning large numbers of candidate passwords through the same encryption function andcomparing the outputs to the actual encrypted passwords. This is done by trying every possiblecombination of characters or by using a large dictionary of common words in expectation thatusers often choose common passwords.You can defend against this type of attack by choosing strong passwords that contain eight ormore characters and contain mixed case, numbers, and punctuation. If you have to choose words,try to string together two or more unrelated words.In security terms, a Trojan horse is a rogue program that takes the identity of a trusted applicationto collect information or avoid detection. For example, in a common Trojan horse attack, the useris presented with a logon screen that appears to be genuine. The user enters their user name andpassword, and are either logged on, or presented with an error message that they have to typetheir logon credentials again. Often, the rogue logon application exits after the first requestpassing the user on to the real logon. Users are easily fooled into thinking that they probablytyped the wrong password and must re-enter the information again, never suspecting that theirlogon credentials are compromised.This type of attack is difficult to detect. A strong network security policy with no unauthorizeddownloads is usually the best way to defend against Trojan horses. If you have the time andresources, perform random file comparisons of key binaries on hosts to known, good binaries,confirming that key binaries haven’t been compromised.A social engineering attack is a name given to any attack that tricks an individual into revealingprivate information. For instance, a user might get a piece of mail that appears to be from thatuser’s ISP. The mail could explain to the user that the ISP is investigating a potential attack oncertain accounts, and is asking that the user change their password for security. The mail asksthat the user send in their old account information, and what they would like the new accountinformation to be. An unsuspecting user, disarmed by the fact the ISP really seems to beconcerned about his or her privacy, can unwittingly return the old and new credentials. Obviously,the only credentials the attacker is interested in is the old ones. The new credentials are never setup, and the attacker has successfully gained access.People identifying themselves over the phone as representatives of a service provider can alsotrick users out of passwords. A convincing line from someone just doing their job is often hard toresist. Once an attacker obtains the password, he or she often attempts to add privileges to oraccess information of interest in the account, and then moves on to the next account. Someattackers actually use private information obtained from one account to gain access to a relatedaccount.Employees, especially those not affiliated with network security or an IT group, are not always asaware of potential security threats. This makes them a more likely target for a social engineeringattack. A strong network security policy and proper education of all company personnel aboutpotential social engineering attacks and preferred responses can significantly reduce or eliminatethis threat.Information theft is not limited to passwords. In addition to passwords, attackers also look for systeminformation, including IP addresses, host names, operating system, and so forth. If a system is unprotected,pertinent information is very easy to obtain through utilities like ping and finger. There is also a widevariety of network scanners like nmap or nessus available to determine the operating system used, and anypotential ports to direct an attack.