Title: Scanning and Analysis Tools
Course: IN 2001 Principle of Information Assurance > Section: Module 7: Chapter Seven

Scanning and Analysis Tools
1. In order to secure a network, it is imperative that someone in the organization knows exactly where the network needs securing.
2. To truly assess the risk within a computing environment, one must deploy technical controls using a strategy of defense in depth.
3. Scanner and analysis tools can find vulnerabilities in systems, holes in security components and unsecured aspects of the network.
4. Therefore, they can be invaluable to security administrators because they enable administrators to see what the attacker sees.
5. Scanning tools are typically used as part of an attack protocol to collect information that an attacker would need to launch a successful attack.
6. The attack protocol is a series of steps or processes used by an attacker, in a logical sequence, to launch an attack against a target system or network.
7. Footprinting which is one of the preparatory parts of an attack.
  - Footprinting is the organized research of the Internet addresses owned or controlled by a target organization
  - The attacker uses public Internet data sources to perform keyword searches to identify the network addresses of the organization
  - To assist in the footprint intelligence collection process, an enhanced Web scanner can be used
8. Fingerprinting
  - The next phase of the attack is a second intelligence or data-gathering process called fingerprinting
  - Fingerprinting is a systematic survey of all of the target organization’s Internet addresses (which were collected during the footprinting phase) to ascertain the network services offered by the hosts in that range
9. Fingerprinting reveals useful information about the internal structure and operational nature of the target system or network for the anticipated attack.  Since these tools were created to find vulnerabilities in systems and networks, they are valuable for the network defender, since they can quickly pinpoint the parts of the systems or network that need a prompt repair to close the vulnerability.

Port Scanners
1. Port scanning utilities (or port scanners) are tools used by both attackers and defenders to identify (or fingerprint) the computers that are active on a network, as well as the ports and services that are active on those computers, the functions and roles the machines are fulfilling and other useful information.
2. These tools can scan for specific types of computers, protocols, or resources, or their scans can be generic.
3. The more specific the scanner is, the better it can give attackers and defenders information that is detailed and will be useful later.
4. However, it is also recommended that you keep a generic, broad-based scanner in your toolbox as well.

Firewall Analysis Tools
1. Several tools automate the remote discovery of firewall rules and assist the administrator in analyzing the rules to determine exactly what they allow and what they reject.
2. Incidentally, administrators who feel wary of using the same tools that attackers use should remember:
  - Regardless of the nature of the tool that is used to validate or analyze a firewall’s configuration, it is the intent of the user that will dictate how the information gathered will be used
  - In order to defend a computer or network well, it is necessary to understand the ways it can be attacked
  - Thus, a tool that can help close up an open or poorly configured firewall will help the network defender minimize the risk from attack

Operating System Detection Tools
1. Detecting a target computer’s OS is very valuable to an attacker because once the OS is known, all of the vulnerabilities to which it is susceptible can easily be determined.
2. There are many tools that use networking protocols to determine a remote computer’s OS.
3. As most OSs have a unique way of responding to ICMP requests, these tools are very reliable in finding matches and thus detecting the OSs of remote computers.
4. System and network administrators should take note of this and plan to restrict the use of ICMP through their organization’s firewalls and, when possible, within its internal networks.

Vulnerability Scanners
1. An active vulnerability scanner is one that initiates traffic on the network in order to determine security holes.
2. As a class, this type of scanner identifies exposed usernames and groups, shows open network shares, and exposes configuration problems and other vulnerabilities in servers.
3. A passive vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software.
4. Passive scanners are advantageous in that they do not require vulnerability analysts to get approval prior to testing.
5. These tools simply monitor the network connections to and from a server to gain a list of vulnerable applications.
6. Furthermore, passive vulnerability scanners have the ability to find client-side vulnerabilities that are typically not found in active scanners.

Packet Sniffers
1. A packet sniffer, or network protocol analyzer, is a network tool that collects copies of packets from the network and analyzes them.
2. A packet sniffer can provide a network administrator with valuable information for diagnosing and resolving networking issues.
3. In the wrong hands, a sniffer can be used to eavesdrop on network traffic.
4. Typically, to use these types of programs most effectively, the user must be connected to a network from a central location.
5. To use a packet sniffer legally, the administrator must:
  - Be on a network that the organization owns
  - Be under direct authorization of the owners of the network
  - Have knowledge and consent of the content creators

Wireless Security Tools
1. An organization that spends all of its time securing the wired network and leaves wireless networks to operate in any manner is opening itself up for a security breach.
2. As a security professional, you must assess the risk of wireless networks.
3. A wireless security toolkit should include the ability to sniff wireless traffic, scan wireless hosts and assess the level of privacy or confidentiality afforded on the wireless network.

Biometric Access Controls
1. These controls use biometric data (retina, fingerprint, palm print, etc.) as part of the identification process.

Effectiveness of Biometrics
1. Biometric technologies are evaluated on three basic criteria:
  1. The false reject rate: The rate at which supplicants who are authentic users are denied or prevented access to authorized areas as a result of a failure in the biometric device (Type I error)
  2. The false accept rate: The rate at which supplicants who are not legitimate users are allowed access to systems or areas as a result of a failure in the biometric device (Type II error)
  3. The crossover error rate (CER): The level at which the number of false rejections equals the number of false acceptances (equal error rate).  This is the most common and important overall measure of the accuracy of a biometric system

Acceptability of Biometrics

1. A balance must be struck between how acceptable a security system is to its users and how effective it is in maintaining security.
2. Many of the biometric systems that are highly reliable and effective are considered somewhat intrusive to users.
3. As a result, many information security professionals, in an effort to avoid confrontation and possible user boycott of the biometric controls, don’t implement them.