Title: Avenue of Attacks
Course: 2016FA-MCO-110-401 > Section: Module 10: Cybersecurity

Click here for a downloadable version of this document:(EXTERNAL) Avenue of Attacks

Avenue of Attacks

Generally, computer systems are attacked either as specific targets or merely as targets of opportunity. An attacker's motivation in specifically targeting a system may be political, monetary, or other. In these instances the choice to attack does not rely on the exact hardware and software being used in the targeted system, but rather proceeds in spite of these details. Target of opportunity attacks succeed when systems are found which have not been updated with the most current security patches and are therefore vulnerable to specific exploits.

1. Conduct Reconnaissance: The first step of an attack is to gather as much information as possible about the system or organization being targeted. Key data would include: names, phone numbers, IP addresses, networks maintained by the organization, and even the organizational structure or hierarchy. This information can be gathered through open source Internet searches of web pages and ftp sites through Google or another search engine. Information can also be acquired using resources such as the SEC's EDGAR website which provides numerous financial reports. Additional information can be gathered using tools such as Whois.Net to link registrants and IP addresses.
2. Scan: It is not always clear as to what information will be needed to make the attack successful. That is why an attacker will gather as much as can be found using as many sources as possible. During the scan phase there may be a ping sweep, port scan, or an analysis on packet response.
3. Research Vulnerabilities: As the attack moves forward through the scanning and vulnerability research phase, some of the information may prove more valuable than originally thought. Once vulnerabilities are researched and determinations are made the attack is matched to the identified vulnerability and a back door is created.
4. Cover Tracks: Finally, tracks are then covered by erasing pertinent files and changing file time stamps.

Minimizing Possible Avenues of Attack

In order to minimize the possibility of an attack, an administrator should limit the exposure of their systems. This can be completed by the following three steps:
Ensure all patches are installed and up to date.Limit the services being run on the system. Limit the amount of publicly available data about the system and organization.

Adapted from LAN153 (IT Security Essentials: Security+) created by Susan Sands, NISGTC which is licensed CC-BY 4.0

Objectives met:
- C10
- 10.7