Introduction: 'Anatomy of a Hack -- The Rise and Fall of Your Network'

This introductory excerpt from Chapter 2 of "Protect Your Windows Network from Perimeter to Data," by Jesper Johansson and Steve Riley, is about.securing networks by understanding how hackers take advantage of your mistakes.

Hardening Windows Systems The following excerpt is from Chapter 2 of Protect Your Windows Network from Perimeter to Data written by Jesper Johansson and Steve Riley. Click for the complete book excerpt series or purchase the book.

Introduction: Anatomy of a Hack -- The Rise and Fall of Your Network

One of the great mysteries in security management is the modus operandi of an attacker. What is it that attackers do, and how do they do it? As with all great mysteries, this one generates a lot of interest, accounting for the phenomenal success of books and classes on how to actually attack networks. Although attacking networks can be fun and informative -- not to mention illegal if you do not have all the proper permissions -- the fact remains that the vast majority of us do not need to know how to do so. Frankly, becoming a good penetration tester (pen tester) takes more than a week-long class. It takes commitment, dedication, intuition, and technical savvy, not to mention a blatant disregard for the rules and the right way to do things. Those are not skills that most security administrators have, or need in many cases. In most cases, it is cheaper and more effective to hire someone to perform penetration tests. Professional penetration testers are going to be much more capable of finding problems, as well as articulating what led to those problems. Then, why is it that books and courses on attacking networks are so popular? Well, frankly, primarily because of the mystique and perceived coolness of it all. There is also some value in a system administrator being able to perform rudimentary penetration tests. The focus in this chapter is a bit different, however. While the narrative is somewhat vague on the specific details of how the attack works, we will be very clear on the operational practices that led to the problem in the first place. This is highly deliberate. The important part here is not to show how to attack something, but to show how attackers take advantage of your mistakes. This will enable you to protect your network by avoiding the pitfalls attackers use.

Before we start, however, let us make one thing absolutely clear: We neither condone nor will we ever aid or defend those who attack networks or systems they do not own or that they have not been asked to attack.

WARNING: Attacking networks and/or systems you do not own is illegal, immoral, and against the ethical principles of information security professionals.

Further, this chapter demonstrates the use of a number of different tools. Although some of these tools are freely available on the Internet, most were custom written for the purposes of legitimate penetration testing. Regardless, the same principle applies.

NOTE: Do not bother looking on the CD for the tools used in this chapter. They are not there.

This book is about securing networks, not distributing tools to break them. Certain information systems security professionals, namely those who are charged with pen testing, have a legitimate use for these tools. System administrators, generally, do not need the majority of these tools, because their only use is for breaking into networks. Since any competent pen tester (or system administrator) with a need for these types of tools can write them, there is no reason for us to distribute them here. It is also important to understand that both the examples we show and the network we are using to demonstrate the attack methodology are entirely fictional. This network was built specifically for the purpose of this demonstration. Any similarity to a real production network is completely accidental and unintended.

Click for the next excerpt in this series: What a penetration test will not tell you


Click for the book excerpt series or visit Addison-Wesley to purchase the book.


This was first published in August 2005

Dig deeper on Windows Server and Network Security

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close