4.

0
WIRELESS
TECHNOLOGIES
AND BASIC
SECURITY
 Introduction

The term is commonly used in the telecommunications industry to

refer to telecommunications systems (e.g. radio transmitters and
receivers, remote controls, computer networks, network terminals,
etc.) which use some form of energy (e.g. radio frequency (RF),
infrared (IR) light, laser light, visible light, acoustic energy, etc.) to
transfer information without the use of wires.[1]

Information is transferred in this manner over both short and long

distances.
 4.1
REMEMBER WIRELESS
TECHNOLOGIES

4.1.1 Define wireless technology.

Wireless Technology...

Electronic products and systems that interact by using

electromagnetic energy, to carry information between them,
so they can communicate with each other.

Wireless operations permits services, such as long range

communications, that are impossible or impractical to
implement with the use of wires.
Define Wireless Technologies
Definition:

 telecommunications systems (e.g. radio transmitters and

receivers, remote controls, computer networks, network
terminals, etc.) which use some form of energy (e.g. radio
frequency (RF), infrared (IR) light, laser light, visible light, acoustic
energy, etc.) to transfer information without the use of wires.

Information is transferred in this manner over both short and long

distances.
 4.1
REMEMBER WIRELESS
TECHNOLOGIES

4.1.2 Describe the advantages and the

limitations of the wireless technology.
 Advantages Of The Wireless
Technology.
1. Convenience
 The wireless nature of such networks allows users to access network
resources from nearly any convenient location within their primary
networking environment (a home or office). With the increasing
saturation of laptop-style computers, this is particularly relevant.

2. Mobility
 With the emergence of public wireless networks, users can access the
internet even outside their normal work environment.
 Most chain coffee shops, for example, offer their customers a wireless
connection to the internet at little or no cost.
 Advantages Of The Wireless
Technology.

3. Productivity
 Users connected to a wireless network can maintain a nearly constant
affiliation with their desired network as they move from place to place.
 For a business, this implies that an employee can potentially be more
productive as his or her work can be accomplished from any convenient
location.

4. Deployment
 Initial setup of an infrastructure-based wireless network requires little more
than a single access point.
 Wired networks, on the other hand, have the additional cost and complexity of
actual physical cables being run to numerous locations (which can even be
 Advantages Of The Wireless
Technology.

5. Expandability
 Wireless networks can serve a suddenly-increased number of clients with
the existing equipment.
 In a wired network, additional clients would require additional wiring.

6. Cost
 Wireless networking hardware is at worst a modest increase from wired
counterparts. This potentially increased cost is almost always more than
outweighed by the savings in cost and labor associated to running physical
cables.
 4.1
REMEMBER WIRELESS
TECHNOLOGIES

4.1.3 Define types of wireless

networks and their boundaries
 Wireless
Personal Area
networks
(WPAN)

Types of
Wireless
Networks
Wireless Wireless
Wide Area Local Area
networks networks
(WWAN) (WLAN)
Wireless Network
 4.1
REMEMBER WIRELESS
TECHNOLOGIES

4.1.4 Define each given scenario as a

WPAN, WLAN, and WWAN
 Wireless Personal Area Network
(WPAN)
is the smallest wireless
Wireless network used to connect
Personal Area
networks various peripheral devices
(WPAN)
such as mice, keyboards
and PDAs to a computer.

Person centred short-range wireless connectivity.

Bluetooth and ZigBee.
Standards - 802.15.
 WPAN - Applications

Applications include:
1. Short-range (< 10 m) connectivity for multimedia
applications
PDAs, Cameras, Voice (hands free devices)
High QoS, high data rate (IEEE 802.15.3)
 WPAN - Applications

1. Industrial sensor applications

 Low speed, low battery, low cost sensor networks (IEEE 802.15.4)
 Inbuilt Bluetooth Data communication between shared devices –printers,
faxes,PCs.
 Automatic wireless interface between PCs and remotely monitored
equipment
WPAN - Applications

ZigBee
i. Remote Keyless Entry ( Transmitters)
ii. Wireless Security Systems
iii. Home Appliances Control (Lighting Control, Ceiling
Fans)
iv. Radio Remote Control (Hobby, Toys)
v. Garage Door Openers
vi. Wireless PC Peripherals (Keyboard, Mouse)
vii. Telemetry (Tire Pressure, Utility Meter, Asset Tracking)
WPAN - Applications

 RFID (Radio-frequency identification)

i. Asset tracking – Industrial test equipment's, valuable

items.....
ii. People tracking – Personal Security, staff movement
management...
iii. Vehicle tracking – Location based applications,
automobile workshops, auto garage openers....
iv. Inventory tracking – library books, arms in military,
police premises......
Wireless Local Area Networks (WLAN )

WLAN’s are typically used in confined areas

Wireless
Local Area within an organization, such as a warehouse,
networks
factory or retail store, and can be considered the
(WLAN)
wireless extension of the local area network .

 Wireless Local Area Networks (WLAN ), use an industry standard known as

802.11.

 WLAN's may also extend beyond the four walls, providing network
connectivity for outside storage areas, docks, and between multiple buildings.
Wireless Local Area Networks (WLAN )

WLAN is typically used to extend the boundaries of the local wired

network (LAN).
 WLANs use RF technology and conform to the IEEE 802.11 standards.

 They allow many users to connect to a wired network through a device known
as an Access Point (AP).

 An Access Point provides a connection between wireless hosts and hosts on an

Ethernet wired network.
Wireless Local Area Networks (WLAN )

With WLAN it’s easy for

small businesses to grow
and connect more users
without adding wires
WLAN keeps you
constantly connected to WLAN is
your network as your typically faster
move around your house
or network area than WWAN

WLAN connections are

commonly found in homes,
offices, hotels, coffee shops
Advantag
and airports and are
sometimes free to use es

It’s easy and affordable to

set up a WLAN network
in your home using a
router and Internet
service provider (ISP)

Most computers
come with WLAN
technology built in
Wireless Local Area Networks (WLAN )
 WLAN Applications

Another use of wireless LAN technology is to support

traveling access by providing a wireless link between a LAN
hub and a mobile data terminal equipped with an antenna,
such as a laptop computer or notepad computer.

 One example of the utility of such a connection is to enable an

employee returning from a trip to transfer data from a personal
portable computer to a server in the office.
 WLAN Applications

Another example of a wireless LAN application is an ad hoc

network, which is a peer-to-peer network (no centralized
server) set up temporarily to meet some immediate need.

 For example, a group of employees, each with a laptop or palmtop

computer, may convene in a conference room for a business or
classroom meeting. The employees link their computers in a
temporary network just for the duration of the meeting.
Wireless Wide Area Network (WWAN)

Wireless – WWAN networks provide coverage

Wide Area
networks over extremely large areas.
(WWAN)

 WWAN networks provide coverage over extremely large areas.

 These networks use technologies such as Code Division Multiple Access
(CDMA) or Global System for Mobile Communication (GSM).

 Wireless Wide Area Networks (WWAN ) offer the most expansive range of all
wireless networks .
Wireless Wide Area Network (WWAN)

WWAN’s work through mobile phone or public networks and

provide a way for field-based employees, parcel delivery and
transportation organizations to access real time data .
WWAN’s can be accessed anywhere cellular service is
available.
Wide Area Networks , allow the transmission of both data and
voice.
Wireless Wide Area Network (WWAN)

Advantages:

Ideal
Ideal for
for users
users away
away from
from
home needing
home needing to
to connect
connect
virtually
virtually anywhere
anywhere inin
their
their coverage
coverage area
area

Utilize
Utilize cellular
cellular WWAN
WWAN provides
provides
technology to
technology to securely
securely regional, nationwide
regional, nationwide
transfer
transfer data
data or
or connect
connect and
and global
global wireless
wireless
to
to the
the Internet
Internet44 coverage
coverage

WWAN
WWAN provides
provides Insert
Insert the
the WWAN
WWAN cardcard from
from your
your
service
service provider
provider or
or even
even easier,
easier, select
select
better security
better security than
than aa notebook
notebook with
with built-in
built-in WWAN
WWAN
technology
technology (such
(such as
as an
an HP
HP Mobile
WLAN
WLAN thanks
thanks to
to built-
built- Broadband card)
card) and
and then
Mobile
then contract
contract
Broadband
in
in 128-bit
128-bit encryption
encryption with
with aa service
service provider
provider
Wireless Wide Area Network (WWAN)

 Disadvantages:

1. ISP contract may cost more than WLAN for those who rarely need or use
wireless Internet access.

2. Replacing a lost external WWAN card can be costly (a built-in version may be
a better choice).
 Wireless Technologies
WAN
(Wide Area Network)
MAN
(Metropolitan Area Network)
LAN
(Local Area Network)
PAN
(Personal Area
Network)

PAN LAN MAN WAN

802.11a, 11b, 11g 802.11 GSM, GPRS,
Standards Bluetooth HiperLAN2 MMDS, LMDS CDMA, 2.5–3G

Speed <1 Mbps 2–54+ Mbps 22+ Mbps 10–384 Kbps

Range Short Medium Medium–Long Long

PDAs, Mobile
Peer-to-Peer Enterprise Fixed, Last
Applications Device-to-Device Networks Mile Access
Phones, Cellular
Access
 Wireless Data Networks
50 Mbps
802.11 is WiFi
Spread
10 Mbps
Spectrum WAP is small
Infrared Wireless handhelds
2 Mbps Wireless LANs
Rates
Data Rates

LANs
1 Mbps
2.5GHz
Data

Services

Broadband PCS
56 Kbps
Circuit and Packet Data
19.6 Kbps Cellular, CDPD, Mobitex, DataTac
Narrow Band
9.6 Kbps Wireless LANs Narrowband PCS Satellite

Local Wide
Coverage
Coverage Area
Area
High-Level Differences between WPANs, WLANs,
WWANs, and Satellite
 Which connections are you?

Which connection is right for you?

 Home users – If most of your computing is done in your home WLAN is usually
the best choice.
 Students – Since most universities provide Internet service on their campus,
WLAN may be the best option.
 Travellers – If you’re constantly on the road for business or pleasure and can’t
be without your web connection, WWAN is right for you.
 Netbook users – HP Mini netbooks come with built-in WLAN capability2 but if
you want Internet connections beyond hotspots, you may want to order an HP
Mini with built-in mobile broadband.3
 4.1
REMEMBER WIRELESS
TECHNOLOGIES

4.1.5 List Wireless standard published

by IEEE
Wireless LAN Standards

The IEEE 802.11 standard governs the WLAN environment.

There are four amendments to the IEEE 802.11 standard that describe
different characteristics for wireless communications.

The currently available amendments are 802.11a, 802.11b, 802.11g and

802.11n (802.11n is not ratified at the time of this writing).

Collectively these technologies are referred to as Wi-Fi, Wireless Fidelity.

The Wi-Fi logo on a device means that this equipment meets standards
and should interoperate with other devices of the same standard.
Wireless LAN Standards

802.11a

uses 5 GHz RF spectrum.

It is not compatible with 2.4 GHz spectrum, i.e. 802.11 b/g/n devices.
It’s range is approximately 33% that of the 802.11 b/g.
It is relatively expensive to implement compared to other
technologies.
And Increasingly difficult to find 802.11a compliant equipment.
Wireless LAN Standards

 802.11b
uses the 2.4 GHz technologies.
 The maximum data-rate of 11 Mbps which ranges approximately 46 m (150
ft) indoors/96 m (300 ft) outdoors.

 802.11g
uses 2.4 GHz technologies with a maximum data-rate increase to 54 Mbps.
 It has the same range as the 802.11b.
 Backwards compatible with 802.11b.
 Wireless LAN Standards

 802.11n
is the newest standard in development.
 It uses 2.4 GHz technologies (draft standard specifies support for 5 GHz) and
extends the range and data throughput.
 Backwards compatible with existing 802.11g and 802.11b equipment (draft
standard specifies 802.11a support).
WI-FI Range Diagram
 Architecture of Wireless LANs devices

1. Stations
 All components that can connect into a wireless medium in a network are referred to as
stations.
 All stations are equipped with wireless network interface controllers (WNICs).
 Wireless stations fall into one of two categories: access points, and clients.
 Access points (APs), normally routers, are base stations for the wireless network.
 They transmit and receive radio frequencies for wireless enabled devices to
communicate with.
 Wireless clients can be mobile devices such as laptops, personal digital assistants,
IP phones and other smart phones, or fixed devices such as desktops and workstations
that are equipped with a wireless network interface.
 Architecture of Wireless LANs devices

2. Basic Service Set (BSS)

 The basic service set (BSS) is a set of all stations that can communicate with each other.
 There are two types of BSS:
 Independent BSS (also referred to as IBSS), and
 Infrastructure BSS.

 Every BSS has an identification (ID) called the BSSID, which is the MAC address of the
access point servicing the BSS.
 An independent BSS (IBSS) is an ad-hoc network that contains no access points, which
means they can not connect to any other basic service set.
 An infrastructure BSS can communicate with other stations not in the same basic
service set by communicating through access points.
 Architecture of Wireless LANs devices

3. Extended Service Set (ESS)

 An extended service set (ESS) is a set of connected BSSs.
 Access points in an ESS are connected by a distribution system.
 Each ESS has an ID called the SSID which is a 32-byte (maximum) character string.
4. Distribution system (DS)
 A distribution system (DS) connects access points in an extended service set.
 The concept of a DS can be used to increase network coverage through roaming
between cells.
 DS can be wired or wireless.
 Current wireless distribution systems are mostly based on WDS or MESH protocols,
though other systems are in use.
Service Set Identifier (SSID)

Short for service set identifier, a 32-character unique identifier attached to

the header of packets sent over a WLAN that acts as a password when a
mobile device tries to connect to the BSS.
The SSID differentiates one WLAN from another, so all access points and all
devices attempting to connect to a specific WLAN must use the same SSID.
A device will not be permitted to join the BSS unless it can provide the
unique SSID.
Because an SSID can be sniffed in plain text from a packet it does not supply
any security to the network.
An SSID is also referred to as a network name because essentially it is a
name that identifies a wireless network.
Wireless Channels

 In telecommunications and computer networking, a communication

channel, or channel, refers either to a physical transmission medium
such as a wire, or to a logical connection over a multiplexed medium
such as a radio channel.
 A channel is used to convey an information signal, for example a digital
bit stream, from one or several senders (or transmitters) to one or
several receivers.
 A channel has a certain capacity for transmitting information, often
measured by its bandwidth in Hz or its data rate in bits per second
Trivia Questions

1. What do wireless technologies use to carry information between

devices?
– Electromagnetic waves, Radio Frequency (RF)
2. Which wavelength is relatively low energy and cannot penetrate
through walls or other obstacles?
– Infrared (IR)
3. What is one of the main advantages of wireless technology?
– The ability to provide anytime, anywhere connectivity
4. What are the limitations of wireless LAN technology?
– Interference, Network and data security and Technology
 Trivia Questions

5. What are the THREE major categories of wireless networks?

– WPAN – Wireless Personal Area Network, WLAN – Wireless Local Area
Network and WWAN – Wireless Wide Area Network
6. What is the smallest wireless network, which is used to connect various
peripheral devices?
– WPAN
7. What technologies does the WWAN use?
– Code Division Multiple Access (CDMA) or Global System for Mobile
Communications (GSM)
8. What is a good example of a WWAN?
– Cell phone network/GSM/GPRS/EDGE
 4.2
Understand security on
a Wireless LAN

4.2.1 Discuss how to avoid WLAN attack by using

 Limited access to WLAN
 Authentication on WLAN
 Encryption on a WLAn
 Traffic Filtering on WLAN
 1.The Limitations Acess Of The
Wireless Technology.

1. Wireless networks may choose to utilize some of the various

encryption technologies available.
2. The typical range of a common 802.11g network with standard
equipment is on the order of tens of meters.
3. The speed on most wireless networks (typically 1-54 mbps) is
far slower than even the slowest common wired networks
(100mbps up to several Gbps.
 1.The Limitations Acess Of The
Wireless Technology.
4. Security
 To combat this consideration, wireless networks may choose to utilize some
of the various encryption technologies available.
 Some of the more commonly utilized encryption methods, however, are
known to have weaknesses that a dedicated adversary can compromise.
5. Range
 The typical range of a common 802.11g network with standard equipment is
on the order of tens of meters. While sufficient for a typical home, it will be
insufficient in a larger structure.
 To obtain additional range, repeaters or additional access points will have to
be purchased. Costs for these items can add up quickly.
 1.The Limitations Acess Of The
Wireless Technology.

6. Reliability
 Like any radio frequency transmission, wireless networking signals are subject
to a wide variety of interference, as well as complex propagation effects that
are beyond the control of the network administrator.
7. Speed
 The speed on most wireless networks (typically 1-54 Mbps) is far slower than
even the slowest common wired networks (100Mbps up to several Gbps).
However, in specialized environments, the throughput of a wired network
might be necessary.
2. Authentication on a WLAN

Authentication
 802.11 authentication is the first step in network attachment.
 802.11 authentication requires a mobile device (station) to establish its
identity with an Access Point (AP) or broadband wireless router.
 There is no data encryption or security at this stage.
 The Institute of Electrical and Electronics Engineers, Inc.(IEEE) 802.11
standard defines two link-level types of authentication:
1. Open System.
2. Shared Key.
 Open System Authentication
1. Open System Authentication
 Open system authentication consists of TWO(2) communications.
 The first is an authentication request from the mobile device that contains the
station ID (typically the MAC address).
 This is followed by an authentication response from the AP/router containing
a success or failure message.
 Shared Key Authentication
2. Shared Key Authentication
 With shared key authentication, a shared key or passphrase is manually set on
both the mobile device and the AP/router.
 There are several types of shared key authentication available today for home or
small office WLAN environments:
 Wired Equivalent Privacy (WEP)
 Wi-Fi Protected Access (WPA)
 Wi-Fi Protected Access 2 (WPA2)
 3. Encryption on a WLAN

WLAN Encryption Methods

 Along with the method used for authentication, the choice
of encryption method is a very important part of deploying
a wireless LAN.

Many of the encryption methods that were implemented in

earlier wireless LAN standards have been proven insecure
and have been criticized by more modern methods.
Encryption on a WLAN

As time goes on, this is sure to happen with all

encryption techniques as they are used more
commonly (thus becoming a target for exploitation)
and as processing power continues to increase.

Wired Equivalent Privacy (WEP)

Wi-Fi Protected Access (WPA)
Wi-Fi Protected Access 2 (WPA2)
 Wired Equivalent Wi-Fi Protected Wi-Fi Protected
Privacy (WEP) Access (WPA) Access 2 (WPA2)

The original encryption protocol

developed for wireless networks Enhancement over WEP Introduced in 2004

WEP was designed to provide the Use a pre-shared key (PSK), commonly Enhancement to WPA2 over WPA is
same level of security as wired referred to as WPA Personal. the use of the Advanced Encryption
networks Standard (AES) for encryption

Has many well-known security flaws / Theoretically, WPA2 is not hackable

provides minimal security More safety than WEP while WPA is

Difficult to configure. Provides a higher level of security WPA2 requires more processing power
than WPA

Easily broken (hacked). Uses TKIP (Temporal Key Integrity

Protocol)
802.11 Encryption

Source: Cam-Winget, Moore, Stanley and Walker

 4. Traffic filtering on a WLAN

MAC ID filtering
 One of the simplest techniques is to only allow access from known user, approved
MAC addresses.

 However, this approach gives no security against sniffing, and client devices can
easily spoof MAC addresses, leading to the need for more advanced security
measures.

 Most wireless access points contain some type of MAC ID filtering that allows the
administrator to only permit access to computers that have wireless functionalities
that contain certain MAC IDs.
4. Traffic filtering on a WLAN

This can be helpful; however, it must be remembered that MAC IDs over a
network can be faked.

Cracking utilities such as SMAC are widely available, and some computer
hardware also gives the option in the BIOS to select any desired MAC ID for its
built in network capability.

Some access points can also support "AP isolation" which isolates all wireless
clients and wireless devices on the network from each other.

Wireless devices will be able to communicate with the gateway but not with
each other in the network
 4.3
Understand
networking threats

4.3.1 Describe risks of

network intrusion.
 The Definition of Intrusion

As defined by Heady et al.,

an intrusion is:
Intrusion  any set of actions that
attempt to comprise the
integrity, confidentiality or
availability of a resource.

61
 Describe risks of network intrusion.

Network Intrusion leads to violations of the security policies of a

computer system, such as unauthorized access to private information,
malicious break-in into a computer system, or rendering a system
unreliable or unusable.
Intrusion detection (ID)
is a type of security management system for computers and
networks.
An ID system gathers and analyzes information from various areas
within a computer or a network to identify possible security breaches,
which include both intrusions (attacks from outside the organization)
and misuse (attacks from within the organization).
 Describe risks of network intrusion.

ID uses vulnerability assessment (sometimes referred to as

scanning), which is a technology developed to assess the
security of a computer system or network.
Functions include:
 Monitoring and analyzing both user
and system activities
Intrusion  Analyzing system configurations and
Detection 
vulnerabilities
Assessing system and file integrity
(ID)  Ability to recognize patterns typical of
attacks
 Analysis of abnormal activity patterns
 Tracking user policy violations
 Describe risks of network intrusion.

Typically, an ID system follows a two-step process.

The first procedures are host-based and are considered the
passive component, these include: inspection of the system's
configuration files to detect inadvisable settings; inspection of
the password files to detect inadvisable passwords; and
inspection of other system areas to detect policy violations.
The second procedures are network-based and are considered
the active component: mechanisms are set in place to re-enact
known methods of attack and to record system responses.
 4.3
Understand
networking threats

4.3.2 Identify types of security

threats for given scenario
There are a number of security issues for a
computer network environment [1]:

Availability:- The system must be functional and correctly provide

services.
Confidentiality:- The data transmitted from one system to the other must
be accessible only for the authorized parties.
Authentication:- The identity associated with the data must be correct.
The identity can apply to a user, host or software component.
Integrity:- The data being processed or transmitted can be modified only
by the authorized parties.
Non-repudiation:- Neither the sender nor the receiver of data is able to
deny the fact of data transmission.
There are a number of security issues for a
computer network environment [1]:

A system that meets the above criteria can be considered as a

secure computer network system. A hacker who wants to attack a
network, thus thinks of ways to compromise the above criteria [1]:
1. Interruption: Destroy a system or make it unavailable or
unusable.
2. Interception: Obtain unauthorized access to data.
3. Modification: Compromise data integrity, e.g. modify
messages sent from one system to another.
 4.3
Understand
networking threats

4.3.3 Determine sources

of network intrusion
Sources Of Network Intrusion.

Network Threat
Unstructured threats
Structured threats
Internal threats
External threats

Network Attacks
Reconnaissance Attack
Access Attack
Denial-of-Service attack
Data Manipulation attack
The FOUR(4) Primary Types of Network
Threats

●
An unstructured security threat is one
Unstructur created by an inexperienced person
who is trying to gain access to your
ed threats network, i.e. a wannabe hacker.

●
A structured security threat, on the
Structure other hand, is implemented by a
technically skilled person who is trying
d threats to gain access to your network.
The FOUR(4) Primary Types of Network
Threats

Internal ●
An internal security threat occurs
when someone from inside your
network creates a security threat to
threats your network.

●
An external security threat occurs
when someone outside your network
External threats creates a security threat to your
network.
The FOUR(4) Primary Types of Network
Attack

Data ●
Unauthorized data manipulation
manipulati involves interpreting, altering, and
deleting confidential data.
on attacks
Reconnaissanc ●
Reconnaissance attack is a kind of information
gathering on network system and services.
e ●
This enables the attacker to discover vulnerabilities or
weaknesses on the network. It could be likened to a
(Exploration) thief surveying through a car parking lot for
vulnerable – unlocked - cars to break into and steal.
attacks
The FOUR(4) Primary Types of Network
Attack

Access An attempt to access another user account or network

●

device through improper means.

●
If proper security measures are not in place, the
network may be left vulnerable to intrusion.

attacks A network administrator is responsible for ensuring

●

that only authorized users access the network.

Denial-of- ●
An attacker attempts to prevent
service legitimate users from accessing
information or services.
attacks
Questions

1. Name FOUR(4) Types of Network Threats.

2. Give an example of situation according to the following

threats:

i. Internal threats

ii. Unstructured threats

 4.3
Understand
networking threats

4.3.4 Explain social engineering

and phishing in networking.
 ** What is a Social Engineering Attack?

An attacker uses human

interaction (social skills) to obtain
Social Engineering or compromise information about
Attack an organization or its computer
systems.

An attacker may seem unassuming and respectable, possibly

claiming to be a new employee, repair person, or researcher and
even offering credentials to support that identity.
** What is a Social Engineering Attack?

However, by asking questions, he or she may be able to

piece together enough information to
infiltrate(menyusup/menembusi) an organization's
network.
If an attacker is not able to gather enough information
from one source, he or she may contact another source
within the same organization and rely on the
information from the first source to add to his or her
credibility.
The 3 most commonly used techniques of Social
Engineering in network security:

Pretexti
●
Pretexting is the human equivalent of phishing, where
someone impersonates an authority figure or someone
your trust to gain access to your login information.   
●
It can take form as fake IT support needing to do

ng maintenance, or a false investigator performing a

company audit.

Phishin
●
Phishing involves false emails, chats, or websites
designed to impersonate real systems with the goal of
capturing sensitive data.  
●
A message might come from a bank or other well

g known institution with the need to “verify” your login

information.
The 3 most commonly used techniques of Social
Engineering in network security:

●
Instead of being directed by e-mail to a Web site, an e-
mail message asks the user to make a telephone call.
●
The call triggers a voice response system that asks for

Vishing ●
the user's credit card number.
The initial bait can also be a telephone call with a
recording that instructs the user to phone an 800
number.
 ** What is a Phishing Attack?

 Phishing is a form of social engineering.

Phishing  Phishing attacks use email or malicious

websites to solicit(ask) personal
Attack? information by posing as a trustworthy
organization.

For example, an attacker may send email seemingly from a

reputable credit card company or financial institution that requests
account information, often suggesting that there is a problem.
When users respond with the requested information, attackers
can use it to gain access to the accounts.
** What is a Phishing Attack?

Phishing attacks may also appear to come from other types of

organizations, such as charities.
Attackers often take advantage of current events and certain times of the
year, such as:
 natural disasters (e.g., Hurricane Katrina, Indonesian tsunami)
 epidemics and health scares (e.g., H1N1)
 economic concerns (e.g., IRS scams)
 major political elections
 holidays
 4.4
Understand methods of
attacks

4.4.1 Describe Viruses, Worms and Trojan Horses.

4.4.2 Identify if the user has been infected by a Virus, Worm or Trojan Horses
for the given scenario
4.4.3 Explain denial of service and brute force attacks.
4.4.4 Differentiate Spyware, Tracking, Cookies, Adware and Pop-up.
4.4.5 Describe Spam.
 4.4
Understand methods of
attacks

4.4.1 Describe Viruses,

Worms and Trojan Horses.
 Introduction

 Viruses, Worms, and Trojan Horses are all malicious programs that are
purposely written to cause damage to a computer and/or information on
the computer.

 They are also capable of slowing down the Internet, and they can use an
individual’s computer to spread themselves to friends, family, co-workers,
or others.
 Infection Methods

 Recent security threats, such as MyDoom, have spread through e-

mails disguised as familiar-looking returned-mail error messages.
 The attached file appeared to be the text of a message recently sent,
disguised as a wrong address.
 However, if opened, one fell victim to the virus. No matter how
authentic an e-mail appears to be, know the contents of the
attachment before opening it.
 Virtually all viruses and many worms cannot spread unless opened or
run from an infected program. Worms can spread in insidious
manners, but the initial user action is crucial to their deployment.
 Prevention

 Although viruses, worms, and Trojan Horses operate differently,

there are FOUR(4) main ways to help protect the computer and
files:
1. Never open an e-mail attachment from a stranger.
2. Never open an e-mail attachment from known source unless
expected, and the contents have been verified.
3. Update antivirus software at least once per week.
4. Keep your operating system software current.
Describe Viruses, Worms and Trojan Horses.

Virus
A virus is maliciously written code that replicates itself.
It may damage hardware, software, or information files.
Most viruses exist simply to replicate themselves.

Worm
A worm is designed to copy itself from one computer to another, but it does so
automatically (perhaps over a network) by taking control of features on the computer
that can transport files or information.
This often occurs without the action of humans.
Worms are very effective at using e-mail systems and address books to spread .

Trojan Horse
A Trojan (or Trojan horse) is a malicious program disguised as a normal application.
Trojan horse programs do not replicate themselves like a virus, but they can be
propagated as attachments to a virus.
Trojan horses cause damage or compromise the security of the computer .
 Virus A virus is maliciously written
code that replicates itself.

 It may damage hardware, software, or information files.

 By definition, human interaction is necessary for a virus to spread to
another user's files.
 New viruses are discovered daily.
 Most viruses exist simply to replicate themselves.
 Others can do serious damage such as erasing files or even
rendering the computer itself inoperable.
 Virus

Many viruses do a large amount of damage by infecting another

program, boot sector, partition sector, or a document that
supports macros by inserting itself or attaching itself to that
medium.
A virus must meet TWO(2) criteria:  
1. It must execute itself.
– It often places its own code in the path of execution of another program.
2. It must replicate itself.
– For example, it may replace other executable files with a copy of the virus infected
file. Viruses can infect desktop computers and network servers alike.
FIVE(5) recognized types of viruses:

1. File infector viruses.

 This type of virus normally infects program files such as .exe, .com, .bat.
 Once this virus stays in memory it tries to infect all programs that load on
to memory.

2. Boot sector viruses.

 Boot sector virus infects the boot sector of a HDD or FDD.
 These are also memory resident in nature.
 As soon as the computer starts it gets infected from the boot sector.
 Cleaning this type of virus is very difficult.
 FIVE(5) recognized types of viruses:

3. Master boot record viruses.

 Many destructive viruses damage the Master Boot Record and make it
impossible to start the computer from the hard disk.

4. Multipartite viruses.
 A hybrid of Boot and Program/file viruses.
 They infect program files and when the infected program is executed,
these viruses infect the boot record.
 When you boot the computer next time the virus from the boot record
loads in memory and then start infecting other program files on disk
 FIVE(5) recognized types of viruses:

5. Macro viruses
A macro virus is a computer virus that alters or replaces a
macro, which is a set of commands used by programs to
perform common actions.
For example, the "open document" action in many word-
processing programs relies on a macro to function, since there
are several discrete steps in the process.
Macro viruses change this command set, allowing them to
execute whenever the macro is run.
  A worm is similar to a virus.
Worm  A worm is designed to copy
itself from one computer to
another, but it does so
automatically (perhaps over a
network) by taking control of
features on the computer that
can transport files or
information.
 This often occurs without the
action of humans.
Worm
Worms are very effective at using e-mail systems and
address books to spread.
They replicate themselves like viruses, but do not alter files
the way that viruses do.
 The main difference is that worms reside in memory and usually remain
unnoticed until their effects become apparent, obnoxious, or overwhelming.
 A worm may arrive in the form of a joke program or software of
some sort, or by copying itself using email or another transport
mechanism.
Worm

When new worms are unleashed,

Denial of Service they spread very quickly, clogging
networks and possibly making you
Attack. wait twice as long to view Web
pages on the Internet.

 A great danger of worms is their ability to replicate in great volume.

 The worm may do damage and compromise the security of the computer.
 Worm
Once a worm is in a computer system it can travel alone.
Because worms don't need to travel via a "host" program
or file, they can tunnel into the system and allow another
person to take control of the computer remotely.
To protect against a worm, networked users must keep up
with operating system patches and updates as well as anti-
virus software, and be aware of any suspicious traffic.
 Trojan
A Trojan (or Trojan horse)
Horse is a malicious program
disguised as a normal
application.

Trojan horse programs do not replicate themselves like a virus,

but they can be propagated as attachments to a virus.
Trojan horses cause damage or compromise the security of the
computer.
 Trojan Horse
Trojan horses spread when people are lured into opening a
program because they think it comes from a legitimate source.
But while it runs, it could be allowing "back door" access to
the computer by hackers or destroying files on the hard disk.
Often an individual emails a Trojan horse-it does not email
itself-and it may arrive in the form of a joke program or
software of some sort.
 Trojan Horse
 A recent Trojan horse came in the form of an e-mail that
included attachments claiming to be Microsoft security updates,
but turned out to be viruses that attempted to disable antivirus
and firewall software.
 Trojan horses can be included in software that you download for
free.
 Never download software from a source that you don't trust.
 For protection against a Trojan horse, users must be suspicious of
any unknown program and be sure it is safe before running it.
4.4 Understand methods
of attacks

4.4.2 Identify if the user has been

infected by a Virus, Worm or Trojan
Horses for the given scenario
Trojan Horse

Trojan horses usually rely on email to spread.

The email will claim to do something that most users
would find beneficial but in reality it will do harm to
the system if run.
One recent example is an email message that
purports to be a free upgrade to Internet explorer
from Microsoft.
Common Symptoms of Trojan horse
Infections

Your system will receive false threats repeatedly. This trick is

played to convince the owner so that he or she purchases the
program instantly.
The more you try to delete the virus the more it pop up,
because the virus can re-install itself via the hidden
components of the system.
 However, it is better not to delete the virus with Add programs
as it may result total crash of system or often “blue screen of
death” occur due to this removal
Common Symptoms of Trojan horse
Infections

Due to this virus attack, the desktop background often gets

replaced with blue screen and the user notice a caption
“SPYWARE INFECTION”.
The windows system starts informing that you must use
spyware-deleting tools to prevent loss of data.
 If you receive this type of security quotes, it is imperative to
use the PC only after removing it of the Trojan viruses.
 Common Symptoms of Virus
Infections

1. Displaying unwanted messages

2. Unusual visual or SFX (sound effects)
3. Loss of Data from a storage medium
4. Computers restarting unexpectedly
5. Unwanted generation of emails
 Symptoms of Worm
Infection

1. Programs take longer to load than normal.

2. Computer’s hard drive constantly runs out of free space.
3. The floppy disk drive or hard drive runs when you are
not using it.
4. New files keep appearing on the system and you don’t
know where it come from.
5. Program sizes keep changing.
 4.4
Understand methods of
attacks

4.4.3 Explain Denial of Service

and Brute Force Attacks.
Denial of Service
Intended to deny services
(DoS attack)
to users.

Floods network with traffic.

Disrupts connections between client and server.
Types of DoS:
1. Sync (Synchronous) Flooding
Packets sent with invalid IP address
Server tries to respond
2. Ping to Death
Larger packet size sent then allowed
Leads to system crashing
 Denial of Service (DoS)

Denial of Service (DoS) attacks are commonly used to disturb

the normal operation of applications.
DoS attacks take advantage of a weakness in the system or
application and cause it to crash or stop responding.
Although this attack does not provide the attacker with any
escalated system access, it disturbs the operation of the site.
 Detailed Description - DoS

DoS attacks are explicit attacks that prevent legitimate users

from accessing a service.
In most cases, a DoS attack floods the victim server with
network traffic.
This can be achieved by either overloading the ability of the
victim server to handle incoming traffic or by sending requests
that cause the victim server to behave unpredictably, possibly
hanging or crashing the server.
 Example DoS

1. To illustrate a simple denial of service attack, imagine an attacker who creates a

program that calls a pizza store.
2. If the program repeats this task continuously, it prevents legitimate customers
from ordering pizza because the telephone line is busy.
3. This example illustrates a classic resource consumption technique.
4. Resource consumption is a familiar technique of performing DoS attacks on Web
applications.
5. With this technique, the attacker tries to identify operations that are implemented
in a poor manner and consume relatively vast resources.
6. The attacker repeats these operations until the server is no longer capable of
serving other users.
7. The affected resources can be the server's bandwidth, memory, disk space or CPU
time.
 Another DoS situations

1. For example, consider a Web application that contains forums with

millions of messages.
2. The application contains a search engine that enables sophisticated
regular expression searches.
3. An attacker can easily create complicated regular expressions that
consume a lot of CPU each time a search is initiated.
4. The attacker then writes a script to launch this request over and over
again until the application consumes 100% of the Web server CPU.
5. As a result, legitimate users will not be able to access services in the
server or will receive very poor performance.
 Denial of Service attacks

 To crash a web server running an application, a DoS threat attacks the

following services:
 Network bandwidth
 Server memory
 Application exception handling mechanism
 CPU usage
 Hard disk space
 Database space
 Database connection pool
 Brute force attacks use
Brute Force exhaustive trial and error
methods in order to find
Attack legitimate authentication
credentials.

 Brute Force Attack adalah kaedah untuk mendapatkan kata laluan yang
paling banyak digunakan oleh para penggodam (hackers).
 Serangan ini akan cuba untuk menggunakan gabungan kesemua watak
(characters) yang mungkin digunakan sebagai kata laluan.
 Untuk memulihkan kata laluan satu watak, memerlukan kita untuk
mencuba 26 kombinasi ('a' hingga 'z'). Ini pasti akan memberikan hasil...
 Brute Force Attack
 The brute force attack is a method of obtaining a user's authentication
identifications.
 Authentication is the process of determining if a user is who he/she claims to
be.
 It is commonly performed through the usage of usernames and passwords.
 Knowledge of the password is assumed to guarantee that the user is
authentic.
 Each user initially registers (or is registered by someone else) using an
assigned or self-declared password.
 On each subsequent use, the user must know and use the previously
declared password.
 Brute Force Attack
Using brute force, attackers attempt combinations of the
accepted character set in order to find a specific combination
that gains access to the authorized area. Consider the
following form:
 Brute Force Attack
 Attackers can use brute force applications, such as password
guessing tools and scripts, in order to try all the combinations of
well-known usernames and passwords.
 Such applications may use default password databases or
dictionaries that contain commonly used passwords or they may
try all combinations of the accepted character set in the
password field.
 4.4
Understand methods of
attacks

4.4.4 Differentiate Spyware, Tracking,

Cookies, Adware and Pop-up.
 Spyware is tracking software that
hides itself (runs in the
Spyware background) and gathers
information without the computer
owner's or user's knowledge or
permission for the benefit of
someone else.

It uses the computer owner's internet connection without

permission to send the collected information to whomever the
tracking software designates.
This is the reason every home computer should have an invalid
default internet connection.
Spyware
 Spyware can compromise the safety of your passwords, logon information,
financial, or personal information.

 Information collected can include your online habits and preferences (where
you go, where you shop, for what, how much, how often, etc), each key you
press on your keyboard, passwords, logon information, account and
financial information, online correspondence and conversations or whatever
information is stated in the agreement.
 Spyware
 Unauthorized software installation without the computer user’s or owner’s
permission can include:
 Programs designed to help steal personal user information to commit
identity theft without the user or owner of the computer providing their
permission to do so.
 Disabling security without the computer owner or user providing their permission
 Endless loop pop-up advertisements or adware when the computer user or owner
does not deliberately activate the software either through an installed program or
through understanding an End-User License Agreement.
 Denial of Service attacks Modem Hijacking – the computer user can incur financial
telecommunication charges without their prior permission
Guidelines to Avoid Spyware

 Follow internet safety guidelines including:

 Not opening emails or email attachments from unknown senders
 Block or don’t click on suspicious pop-up windows
 Don’t open files that are more prone to be associated with malware
such as .bat, .com, .exe, .pif, .txt.vbs, .htm.exe or .vbs
 Don’t download or execute applications from un-trusted sources.
 Avoid phishing scams.
 Use updated anti-virus and anti-spyware software regularly.
 Belum buat

Tracking

It uses the computer owner's internet connection without

permission to send the collected information to whomever the
tracking software designates.
.
 A cookie, also known as an HTTP cookie,
web cookie, or browser cookie, is used for

Cookie an origin website to send state information to

a user's browser and for the browser to return
the state information to the origin site.

 The state information can be used for authentication, identification of a

user session, user's preferences, shopping cart contents, or anything
else that can be accomplished through storing data on the user's
computer.
 Cookies are not software.
Cookies
They cannot be programmed, cannot carry viruses,
and cannot install malware on the host computer .
However, they can be used by spyware to track user's
browsing activities
a major privacy concern that prompted European
and US law makers to take action.
Cookies can also be stolen by hackers to gain access
to a victim's web account.
Other Definition For Cookies

A cookie is a piece of text that a Web server can store on

a user's hard disk.
Cookies allow a Web site to store information on a user's
machine and later retrieve it. The pieces of information are
stored as name-value pairs.
For example, a Web site might generate a unique ID
number for each visitor and store the ID number on each
user's machine using a cookie file.
Other Definition For Cookies Cont.

If you use Microsoft's Internet Explorer to browse the Web, you
can see all of the cookies that are stored on your machine. The
most common place for them to reside is in a directory called
c:windowscookies.
When I look in that directory on my machine, I find 165 files. Each
file is a text file that contains name-value pairs, and there is one
file for each Web site that has placed cookies on my machine.
 Adware
The term adware frequently refers to any software which
displays advertisements, whether or not the user has responded.
Programs such as the Eudora mail client display advertisements
as an alternative to shareware registration fees.
These may be classified as "adware", in the sense of advertising-
supported software, but not as spyware.
Adware in this form does not operate surreptitiously or mislead
the user, and provides the user with a specific service.
Most adware is spyware in a different sense than "advertising-
supported software
 Pop-up Ads Or Pop-ups
Pop-up ads or pop-ups are a form of online advertising on the World
Wide Web intended to attract web traffic or capture email addresses.
Pop-ups are generally new web browser windows to display
advertisements.
The pop-up window containing an advertisement is usually generated
by JavaScript, but can be generated by other means as well.
A variation on the pop-up window is the pop-under advertisement,
which opens a new browser window hidden under the active window.
Pop-under do not interrupt the user immediately and are not seen until
the covering window is closed, making it more difficult to determine
which web site opened them.
 4.4
Understand methods
of attacks

4.4.5 Describe Spam.

 Spam is the term used to
Spam describe unwanted emails
that are typically
distributed in bulk.

Spam messages will typically contain commercial content

examples include pornography, pharmaceuticals, dubious
financial transactions, or ‘too good to be true’ offers.
In most cases, spam emails are sent with fraudulent
intent, but there are also cases where reputable
companies or private users send mass emails too.
Spam

Spam can also be used to launch phishing attacks where users

are sent emails tricking them into ‘updating’ their personal
details online via a fake website (imitating a bank or similar).
Spam can also be used as a means of distributing malicious
software which can install key-logging software on your PC
without your knowledge
 Malware is short for “malicious software,”
as that is precisely what it is.

Malware defines an entire class of malicious software.

Malware includes computer viruses, worms, Trojans, adware,
spyware, crimeware, scareware, rootkits, and other unwanted
programs.
Malware means software that was made to get into and
damage your computer system without your consent.
How to help protect your computer from
malware

There are several free ways to help protect your computer against
malware:
1. Make sure automatic updating is turned on to get all the latest security
updates.
2. Keep your firewall turned on.
3. Don't open spam email messages or click links on suspicious websites.
4. Download Microsoft Security Essentials, which is free, or another
reputable antivirus and anti-malware program (see the warning below).
5. Scan your computer with the Microsoft Safety Scanner.
 Questions

1. While surfing the Internet, a user notices a box claiming a prize has been
won. The user opens the box unaware that a program is being installed.
An intruder now accesses the computer and retrieves personal
information. What type of attack occurred?
2. What is a major characteristic of a Worm?
3. What type of advertising is typically annoying and associated with a
specific website that is being visited?
4. What is a widely distributed approach to marketing on the Internet that
advertises to as many individual users as possible via IM or e-mail?
Answer

1. Trojan horse
2. Exploits vulnerabilities with the intent of propagating itself across a
network
3. Pop-ups
4. Spam
 4.5
Understand security
policy

4.5.1 Define common security measures.

4.5.2 Identify the importance of updated software and patches
4.5.3 Explain update software patches and antivirus latest patterns
 Network Security Policy

A network security policy is a generic document that

outlines rules for computer network access, determines
how policies are enforced and lays out some of the basic
architecture of the company security/ network security
environment.
The document itself is usually several pages long and
written by a committee.
 Network Security Policy

A security policy goes far beyond the simple idea of "keep

the bad guys out".
It's a very complex document, meant to govern data access,
web-browsing habits, use of passwords and encryption,
email attachments and more.
It specifies these rules for individuals or groups of
individuals throughout the company.
 4.5
Understand security
policy

4.5.1 Define common security measures.

Explain Common Security Measures.

Your list will be specific to your organization, but will probably

include the following subordinate policies:
1. Computer Acceptable Use.
 A general document covering all computer use by employees and
contractors, including desktop, mobile, home PCs, and servers.

2. Password.
 A description of the requirements for password protecting computer
systems, the rules for choosing passwords, and how the password policy
is enforced.
 Explain Common Security Measures.

3. Email.
 This policy covers the use of email sent from any company email address
and received at any company computer system.

4. Web.
 A specification of what browsers may be used, how they should be
configured, and any restrictions on which sites employees can visit.

5. Mobile Computing and Portable Storage.

 A description of who owns the mobile computing and portable storage
on your network, how they are supported, and what specific devices (if
any) are authorized for use on the company network.
 Explain Common Security Measures.

6. Remote Access.
 A policy stating who can access what information from which
locations under what circumstances.
7. Internet.
 A description of your Internet-facing gateway configuration, stating
what is allowed in and out, and why.
8. Wireless.
 A specification stating how wireless access will be managed on your
network; how access points will be plugged in, secured, and
maintained; who is allowed to use them; and under what
circumstances.
 Explain Common Security Measures.

9. Servers.
 A statement of the company standards for servers, what services are
enabled or disabled by default, and important distinctions between
production, test, and development environments.

10. Incident Response Plan.

 No policy is complete until it also specifies what to do when defences fail:
what is considered a security incident; who gets called; who is authorized to
shut things down if needed; who is responsible for enforcing applicable
local laws; who speaks for the company.
 4.5
Understand security
policy

4.5.2 Identify the importance of

updated software and patches
Identify The Importance Of Updated
Software And Patches.

So are these updates really necessary?

The answer is YES to all of the above.
A computer, like a car or your very own body, requires
maintenance from time to time.
System patches and updates do a number of things to ensure
that your operating system and/or third party software run
safely and efficiently.
The importance of system patches and updates should now be
obvious. However annoying the process may be, it is critical.
 Identify The Importance Of Updated
Software And Patches.

Here are just a few of the tasks that system patches and
updates perform:
1. Fix security holes
2. Update subsystems and drivers to increase software
compatibility
3. Optimize how the operating system handles resources
4. Add updated features and tools
5. Remove outdated features and tools
Identify The Importance Of Updated
Software And Patches.

In the competitive world of software, it is always important to

stay ahead of the game.

There are several ways to do this, and one of those is through

software updates. As a software publisher, you can make
updates available in TWO(2) ways:
1. Manual Update

2. Automatic Update
 Manual Update

Where the user downloads it from the vendors website, ftp site
or in some extreme cases, receives it via mail on CD or DVD.
This method is acceptable but not the best as it involves lot of
user interaction.
The user has to visit the site, download the update, install it,
trouble shoot in case of errors during download or install, etc.
Sometimes the user might even decide not to update due to
some arbitrary reason.
 Automatic Update

This way is preferable to the manual method due to numerous

reasons.
Automatic updates take the hassle away from the user, so that
the process takes place in the background.
This makes it easy for many users and gives them confidence
that the vendor is going to be constantly developing the
product.
In turn, this method gives developers more control over
software they have sold.
This enables them to fix bugs, add enhancements, add features
to the software seamlessly and even combat piracy.
 Automatic Update

It also takes away the burden of packaging updates for end
users to install.
Instead, the software itself supports the updates in whichever
way is easy for the developer to package it.
This method also makes it easy to distribute the updates
globally and at the same time.
As this method will ensure fewer bugs and issues, it will result in
fewer calls to the technical support division, thus reducing costs.