Network Security
Network Security
Network security is paramount because it helps keep sensitive data safe and ensures that network data is trusted. Keeping a network secure requires a multi-layered approach which includes software, hardware, and training. Your network can contain sensitive data which could harm or embarrass a company or even an individual. A company could have trade secrets, which, if divulged, may cause them to lose their edge in their field of business. Data may be simple but necessary to carry out daily business. Customer private data needs to be protected.
A breach of customer information could open them up to identity theft and financial ruin. As many companies interconnect with other companies using cloud-based products, managing access to needed services and maintaining security becomes even more complex. As an individual, your network should also remain secure. It might seem a mild annoyance if someone gets onto your home network and turns your lights on or off. They may also gain access to personal data such as health or financial information. At home, you don’t have an IT department helping you, so it is a personal responsibility to be aware of the possibilities of home attacks.
Ping Attacks
The ping of death is an attack that repeatedly floods a computer with malformed, fragmented, or oversized pings. According to (Fortinet, 2022, p. 1), “Sending packets that are larger than 65,535 bytes violates the rules of IP. To avoid this, attackers will send packets in fragments that their target system then attempts to piece together. When it does, the oversized packet will cause a memory overflow.” Multiple successive invalid pings are sent, trying to crash or freeze the targeted computer. The possibility of a ping of death attack is one reason some sites do not respond to the ICMP ping messages. The firewall may be set to block pings, but this may prevent legitimate pings.
Phishing
Phishing is an attack designed to trick the end user into giving up sensitive information such as passwords, credit card numbers, or other personal data. Phishing scams take on the appearance of legitimate communications. Phishing is often email or text-based. In a phishing attack, the computer is not typically a risk; rather, the user becomes a risk to the computer. Cybercriminals use your emotions, such as fear or curiosity, or often create a sense of urgency. You may get an email that looks like it came from your bank. A cybercriminal may copy a real email and make slight changes. The logos look correct, and often contact information is correct. Other times the incorrect URL may be nearly identical to the real URL, so at first glance, nothing appears wrong. The link may even take you to a webpage that looks like a real sign-on page.
The email intends to make you click. Sometimes, clicking on a bad link can download malware to your computer, which could be anything from Adware to complete ransomware. Sometimes the attack is to get a piece of information to be used in an escalated attack by obtaining more information from other users at a company. If the link causes you to enter private information such as a password, the hacker could end up with access to your network. According to (Imperva, 2020), “Spear phishing targets a specific person or enterprise, as opposed to random application users. It’s a more in-depth version of phishing that requires special knowledge about an organization, including its power structure”. This can make it appear that a legitimate message comes from within your organization, which makes you feel more secure about clicking and giving up credentials or other sensitive information.
Awareness is the key to stopping phishing attacks. One rule of thumb is never to click on links sent to you unless you expect them. For example, if you get a message from your bank that something needs attention, it would be smart to go to your bank's website on your own rather than clicking on the message. If you get a message that a computer password needs to be changed if in doubt, use steps that you already know to change your password, rather than clicking on links. Use two-factor authentication wherever possible. Look at messages that come in. Usually, hovering over the URL in a message will have a popup window showing the URL you might visit. Understanding a URL's structure can help you easily identify if the URL is incorrect. Occasionally, these copycat emails may have incorrect fonts or misspellings. Messages with those errors are easier to spot, but you must pay attention.
Social Engineering
Social engineering can be looked at as a more advanced type of phishing. Computer systems are not the target. Again, like phishing, the weak link and the target of social engineering attacks are people themselves. There are various names that the IT industry will use to refer to different types of social engineering. Some of these names are baiting, phishing, watering hole, tailgating, and many others. Regardless of the name, the important thing is that they all rely on a person's innate willingness to be curious, helpful, or avoid getting in trouble.
The perpetrator will often investigate their intended target to gather information about them. Then, they use human interaction to influence or trick people into breaking security protocols to gain access to systems, networks, or physical locations. They may call the person over the phone, use personal information already known about the victim, and pretend to be a friend or someone of importance. Through conversation, the attacker will make moves to gain the victim's trust, to get the person to give up more revealing information. The attacker may offer to provide something in exchange for information or assistance. An example may be pretending to be the IT support help desk and they offer to help with a computer issue. The helpful IT person may require the victim to divulge otherwise sensitive information to provide "assistance."
Taking advantage of curiosity, the attacker may leave something such as a USB drive in a place they know someone will pick it up. A victim's first action may be to plug it into their computer to see what is on it or to see if they can discover it's the owner. This action could install malware. The attacker may 'tailgate' or follow someone through a secure door while it's still open. They may also accept or divert delivery of a package at a location. Even a company's trash isn't safe. People may go dumpster diving to find information that can help infiltrate systems.
The key to avoiding social engineering attacks is also awareness. Be alert to anyone who contacts you without you expecting it. Do not give out personally identifiable information unless you are sure who you are talking to and only if you know it's required. Nobody should ask for your password. IT help desks will already know your user id. Use two-factor authentication when possible. If you get a call from a company, such as your bank, asking for information, hang up and call the entity directly. Don't be afraid to question. We can all stay safe will common sense thoughts about what is being asked of us.
References
Fortinet. (2022, September 8). What Is a Ping of Death and Ping of Death Attack? https://www.fortinet.com/resources/cyberglossary/ping-of-death
Imperva. (2020, June 17). What is phishing | Attack techniques & scam examples | Imperva. Imperva Learning Center. https://www.imperva.com/learn/application-security/phishing-attack-scam/