Current Attack Vectors and Secure Network Design - Coursework Example

Current Attack Vectors and Secure Network Design Current Attack Vectors and Secure Network Design Security in Linux, Windows and OS X OS X and windows are both susceptible to viruses. However, infections in Windows are more prone because it harbors a number of easy-to-use programs like Microsoft Word. Lammle (2009) posits that hackers can easily take advantage of this simplicity to create virus programs. But this state is different from the OS being the most susceptible. OS X features a seemingly limited number of attack vectors because the low number of Mac PCs naturally suppresses the incentives to create virus programs for the OS X. Basically, attackers also crave for a return on investment (ROI) as pertains to the manpower and time they devote to create virus programs. As such, OS X might not be their target, but windows remains to a significant target because of the widespread use. Things have changed in the hacking world in the recent past and attackers are already shifting their attention to Linux thus leading to discovery of numerous security flaws within this operating system that has been believed to feature superb in-built security capabilities. A report by International Council of E-Commerce Consultants (2010) revealed that vulnerabilities have been reported of packages such as Wireshark, evolution, Exim, Apache and ghost script among others. However, end-users have the option of auditing Linux-based open source programs to establish the existence of security flaws and vulnerabilities, checking the home page associated with their Linux distribution for any updates or look into websites owned by application vendors in search for patches. Overall, when addressing security it is difficult failing to mention the greatest number of flaws that are found in the Windows architecture mainly because of the ease with which the associated virus file can be programmed and the wide user population. The situation is worsened by the growing expectation of customized systems from user ends. Thus, Windows will only be a good alternative if you are interested in pursuing a tradeoff between application availability and hardware capabilities, but no security. Security Concerns Portable Storage Devices Basically the storage devices found under this category includes memory cards, CD/DVDs and external disks in addition to the likes of iPods, Blackberrys, Portable Digital Assistants (PDAs) plus other media players. To begin with, the small sizes associated with the aforementioned devices encourage theft and physical loss. Certainly, such a loss will imply a serious privacy and security issue where personal and sensitive details are stored inside the device. Second, the devices could feature more elaborate storage capacities that could permit theft of great deal of information from the organization-owned servers and end user PCs. Finally, use of the devices for information transfer never allows secure approaches to data transfer like implementation of end-to-end or link encryption. As such, data risks reaching even unintended parties. Of the stated risks, lack of support for encryption is the greatest of all concerns. Thus, the organization could plan to transfer most of the sensitive data via a web platform. Wired and Wireless Network Wired network is the better option for the enterprise if establishing a very secure network is anything to go by. A reflection on the operation mode of a wireless network depicts a system whose reliance on radio frequency renders it susceptible to interception. Though this pitfall has been met by some users turning off service set identifier (SSID) broadcasting in a bid to make wireless systems more secure, Parsons& Oja (2010) confirm that hackers are still capable of seeing wireless networks even in situations where SSID is not broadcast. At least with Ethernet, it will not be possible attaching devices half-way down a communication line then gain access to information under transfer. This aspect of the wired networks is a good way to eliminate real-time data visibility of sent or received data that is typical of wireless networks. It is noteworthy that this concern does not dispute the security capabilities of wireless networks as per se; wireless connections could also be secured to heightened havens requiring usernames plus passwords prior to login. WPA2 Enterprise is an example of a wireless system that could actualize such security levels. However, the cost of acquiring one can prove to be too expensive for startup firms. Protecting Intellectual Property There are a set of physical and technical approaches to protecting the organization-owned assets. In a physical perspective, it would be appropriate ensuring that rooms that contain the most at-risk IT and valuable IT facilities are constructed using bugler proof structures. In addition, it would be appropriate employing security guards to keep watch of the assets whilst employees are outside the premises of the organization. In a technical sense, the organization needs to seek due diligence as pertains to the business entity it wishes to enjoy the cloud services from. Moreover, the organization needs to hire security administrators who are capable of keeping up with the rapid evolutions in the contemporary web environment. Skill examples that will be required of this lot is ability to define Linux based policies in a security –conscious manner and a proactive measure to ensure that the OS patches remain as up-to-date as possible. Certainly, the patches are just but new improvements to architectural framework of the OS that are aimed at addressing security flaws. Cloud Service the Associated Security Concerns In view of the growing use of cloud services to support business operations, the organization could find itself operating amidst competitor firms already leveraging the cloud concept. Thus, it is necessary that the organization uses cloud services to enjoy the speed and scalability issues as well as the intrinsic roles that are associated with the cloud-offered packages. One aspect through which the company could enjoy the cloud services is by investing in cloud enterprise resolution planning (ERP) as a way to use IT facilities in increasing the ROI for the business. That being done, the company will need to address cloud-based flaws like data breaches befalling sensitive information, data loss from intrusive actions and probable use of insecure application program interfaces (APIs) to access the cloud services. Attacks against Mobile Computing Devices Brute force is the most effective attack against mobile computing devices. Numerous studies point to the idea that consumers basically employ static passwords rather the two-factor approach to authentication when performing web-based transactions via the mobile tools. Use of a static password to meet authentication needs opens an avenue for attackers to guess passwords. Attackers targeting mobile devices can use tools such as use brute force where they resort to guess numerous passwords till they get to the right one. Top Three Hackers Tools Of the three tools mentioned during the course, the three tools most used by hackers are probe tools, password crackers and remote administrator tools. When using the probe tools, hackers assume the roles of system administrators to establish the point from which they (the hackers) can launch attacks. Typical tools under this category include LANguard Network Scanner which can figure out network flaws. When using password crackers, hackers become better positioned to figure out weak passwords then exploit such vulnerabilities. When using remote management tools, hackers use tools like AntiLemer in order to gain full control of the target systems. Interestingly, these tools all allow the target system to perceive a hacker as a system administrator intending to perform some legitimate function hence the widespread success of these tools (Information Resource Management Association, 2010). Proposed Floor Design for the Organization References Information Resources Management Association. (2010). Networking and telecommunications: Concepts, methodologies, tools, and applications. Hershey, PA: Information Science Reference. International Council of E-Commerce Consultants. (2010). Ethical hacking and countermeasures. Clifton Park, NY: Course Technology, CENGAGE Learning. In Mahmood, Z. (2014). Continued rise of the cloud: Advances and trends in cloud computing. Lammle, T. (2009). CompTIA Network+ study guide. Indianapolis, Ind: Wiley Pub. Parsons, J. J., & Oja, D. (2011). Computer concepts: Illustrated introductory. Boston, MA: Course Technology Cengage Learning. Read More