Cyber Security Essentials 1st Edition James Graham download
Cyber Security Essentials 1st Edition James Graham download
https://ebookname.com/product/cyber-security-essentials-1st-
edition-james-graham/
https://ebookname.com/product/essentials-of-counterterrorism-
praeger-security-international-james-j-f-forest-editor/
https://ebookname.com/product/cyber-security-awareness-for-ceos-
and-management-1st-edition-david-willson/
https://ebookname.com/product/cyber-security-and-the-politics-of-
time-1st-edition-edition-tim-stevens/
https://ebookname.com/product/ballet-world-of-dance-2nd-edition-
robin-rinaldi/
Death and Medical Power 1st Edition Henk Ten Have
https://ebookname.com/product/death-and-medical-power-1st-
edition-henk-ten-have/
https://ebookname.com/product/destructive-myths-in-family-
therapy-how-to-overcome-barriers-to-communication-by-seeing-and-
saying-a-humanistic-perspective-1st-edition-daniela-kramer-moore/
https://ebookname.com/product/nmr-spectroscopy-and-computer-
modeling-of-carbohydrates-recent-advances-acs-symposium-1st-
edition-johannes-f-g-vliegenthart/
https://ebookname.com/product/structures-and-granular-solids-
from-scientific-principles-to-engineering-application-1st-
edition-chen/
https://ebookname.com/product/hydrogen-generation-storage-and-
utilization-1st-edition-jin-zhong-zhang/
Phylogenomics A Primer 1st Edition Rob Desalle (Author)
https://ebookname.com/product/phylogenomics-a-primer-1st-edition-
rob-desalle-author/
CYBER SECURITY
ESSENTIALS
CYBER SECURITY
ESSENTIALS
Edited by
James Graham
Richard Howard
Ryan Olson
Auerbach Publications
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2011 by Taylor and Francis Group, LLC
Auerbach Publications is an imprint of Taylor & Francis Group, an Informa business
This book contains information obtained from authentic and highly regarded sources. Reasonable
efforts have been made to publish reliable data and information, but the author and publisher cannot
assume responsibility for the validity of all materials or the consequences of their use. The authors and
publishers have attempted to trace the copyright holders of all material reproduced in this publication
and apologize to copyright holders if permission to publish in this form has not been obtained. If any
copyright material has not been acknowledged please write and let us know so we may rectify in any
future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or
hereafter invented, including photocopying, microfilming, and recording, or in any information stor-
age or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copy-
right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222
Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that pro-
vides licenses and registration for a variety of users. For organizations that have been granted a pho-
tocopy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the Auerbach Web site at
http://www.auerbach-publications.com
Contents
C h a p t e r 1 C y b e r S e c u r i t y F u n d a m e n ta l s 1
1.1 Network and Security Concepts 1
1.1.1 Information Assurance Fundamentals 1
1.1.1.1 Authentication 1
1.1.1.2 Authorization 2
1.1.1.3 Nonrepudiation 3
1.1.1.4 Confidentiality 3
1.1.1.5 Integrity 4
1.1.1.6 Availability 5
1.1.2 Basic Cryptography 6
1.1.3 Symmetric Encryption 11
1.1.3.1 Example of Simple Symmetric
Encryption with Exclusive OR
(XOR) 12
1.1.3.2 Improving upon Stream Ciphers
with Block Ciphers 14
1.1.4 Public Key Encryption 16
1.1.5 The Domain Name System (DNS) 20
1.1.5.1 Security and the DNS 24
1.1.6 Firewalls 25
1.1.6.1 History Lesson 25
1.1.6.2 What’s in a Name? 25
1.1.6.3 Packet-Filtering Firewalls 27
Chapter 2 A t ta c k e r Te c h n i q u e s an d M o t i vat i o n s 75
2.1 How Hackers Cover Their Tracks (Antiforensics) 75
2.1.1 How and Why Attackers Use Proxies 75
C h a p t e r 3 E x p l o i tat i o n 119
3.1 Techniques to Gain a Foothold 119
3.1.1 Shellcode 119
3.1.2 Integer Overflow Vulnerabilities 124
3.1.3 Stack-Based Buffer Overflows 128
3.1.3.1 Stacks upon Stacks 128
3.1.3.2 Crossing the Line 130
3.1.3.3 Protecting against Stack-Based
Buffer Overflows 132
3.1.3.4 Addendum: Stack-Based Buffer
Overflow Mitigation 132
3.1.4 Format String Vulnerabilities 133
3.1.5 SQL Injection 138
3.1.5.1 Protecting against SQL Injection 140
3.1.5.2 Conclusion 141
3.1.6 Malicious PDF Files 142
3.1.6.1 PDF File Format 143
C h a p t e r 4 M a l i c i o u s C o d e 195
4.1 Self-Replicating Malicious Code 195
4.1.1 Worms 195
4.1.2 Viruses 198
4.2 Evading Detection and Elevating Privileges 203
4.2.1 Obfuscation 203
4.2.2 Virtual Machine Obfuscation 208
4.2.3 Persistent Software Techniques 213
4.2.3.1 Basic Input–Output System
(BIOS)/Complementary Metal-
Oxide Semiconductor (CMOS)
and Master Boot Record (MBR)
Malicious Code 213
4.2.3.2 Hypervisors 214
4.2.3.3 Legacy Text Files 214
4.2.3.4 Autostart Registry Entries 215
4.2.3.5 Start Menu “Startup” Folder 217
4.2.3.6 Detecting Autostart Entries 217
C h a p t e r 5 D e f e n s e an d A na ly s i s Te c h n i q u e s 267
5.1 Memory Forensics 267
5.1.1 Why Memory Forensics Is Important 267
5.1.2 Capabilities of Memory Forensics 268
5.1.3 Memory Analysis Frameworks 268
5.1.4 Dumping Physical Memory 270
5.1.5 Installing and Using Volatility 270
5.1.6 Finding Hidden Processes 272
5.1.7 Volatility Analyst Pack 275
5.1.8 Conclusion 275
This is not your typical security book. Other books of this genre exist to
prepare you for certification or to teach you how to use a tool, but none
explains the concepts behind the security threats impacting enterprises
every day in a manner and format conducive to quick understanding.
It is similar to a reference book, an encyclopedia of sorts, but not
quite. It is not comprehensive enough to be an encyclopedia. This
book does not cover every security concept from A to Z, just the ones
that we have observed having the most impact on the large-enterprise
network battle.
It is similar to books like the Unix Power Tools series, but again not
quite. Those authors collected small snippets of practical information
about how to run a UNIX machine. This book has no code samples.
It is not a “how-to” book on hacking skills. This book, instead, covers
key security concepts and what they mean to the enterprise in an easy-
to-read format that provides practical information and suggestions for
common security problems. The essays in this book are short, designed
to bring a reader up to speed on a subject very quickly. They are not
70-page treatises, but rather high-level explanations about what the
issue is, how it works, and what mitigation options are available.
It is similar to the Physician’s Desktop Reference (PDR), but once
again not quite. The PDR is an annually published aggregation of
drug manufacturers’ prescription information. The information in
© 2011 by Taylor & Francis Group, LLC xi
xii A N o t e f r o m t he E x ecu ti v e Ed it o rs
this book does not change often enough to require an annual update.
Most of the material covers baseline concepts with which all security
practitioners should be familiar and may serve as the first step toward
developing a prescription to solve security problems they are likely to
see daily.
It is similar to military “smart books,” but, ultimately, not quite.
Smart books are built by the soldiers themselves when they are placed
in charge of a new mission. These are generally looseleaf notebooks
that carry snippets of key information about how to get the job
done—everything from stats about a unit’s combat reaction drills to
information about the entire unit’s weapons capabilities. They contain
checklists and how-to’s and FAQs and any other critical information
that a soldier cannot afford to forget. In summary, we took the liberty
of building a cyber security smart book for you.
This book builds on the methods that all these types of books use.
The contents are inspired by the cyber security experts around the
world who are continuously learning new concepts or who have to
explain old concepts to bosses, peers, and subordinates. What they
need is a desktop reference, a place to start to refresh their knowledge
on old subjects they are already familiar with or to come up to speed
quickly on something new they know nothing about.
We do not want you to read this from cover to cover. Go to the table
of contents, pick a topic you are interested in, and understand it. Jump
around; read what interests you most, but keep it handy for emergen-
cies—on your desk, on your bookshelf, or even in your e-book reader.
By the time you are done with all the issues explained throughout this
book, you will be the “go-to” person in your security organization.
When you need a refresher or you need to learn something new, start
here. That’s what we intend it to do for you.
FACTOR EXAMPLES
Something Information the system assumes others do not know; this information may be
You Know secret, like a password or PIN code, or simply a piece of information that most
people do not know, such as a user’s mother’s maiden name.
Something Something the user possesses that only he or she holds; a Radio Frequency ID
You Have (RFID) badge, One-Time-Password (OTP) generating Token, or a physical key
with another one when writing a message. For instance, one could
shift the letters of the English alphabet as shown:
abcdefghijklmnopqrstuvwxyz
nopqrstuvwxyzabcdefghijklm
Using this cipher, the message “the act starts at midnight” would be
written as “gur npg fgnegf ng zvqavtug.” The text above, showing how
to decode the message, is known as the key. This is a very simple sub-
stitution cipher known as the Caesar cipher (after Julius Caesar, who
used it for military communications) or ROT13 because the charac-
ters in the key are rotated thirteen spaces to the left.
Cryptography is driven by the constant struggle between people
who want to keep messages secret and those who work to uncover
their meanings. Substitution ciphers are very vulnerable to crypta-
nalysis, the practice of breaking codes. With enough text, it would be
simple to begin replacing characters in the ciphertext with their pos-
sible cleartext counterparts. Even without knowing about the Caesar
cipher, it is easy to guess that a three-letter word at the beginning of
a sentence is likely to be the. By replacing all instances of the letters g,
u, and r with t, h, and e, the ciphertext changes to
Next, the analyst might notice that the fourth word is only two letters
long and ends with t. There are two likely possibilities for this word: at
and it. He chooses at and replaces all occurrences of n in the sentence
with an a.
With at in place, the pattern is clearer, and the analyst guesses that if
the letter g translates to t, the adjacent letter f may translate to s.
The word sta_ts now looks very close to starts, and the analyst makes
another substitution, indicating that rst is equivalent to efg, which
reveals the full pattern of the cipher and the message. While the
message is now clear, the meaning of “the act starts at midnight” is
not. Code words are an excellent way of hiding a message but, unlike
© 2011 by Taylor & Francis Group, LLC
8 Cy ber Securit y E s sen tia l s
e 12.70% m 2.41%
t 9.06% w 2.36%
a 8.17% f 2.23%
o 7.51% g 2.02%
i 6.97% y 1.97%
n 6.75% p 1.93%
s 6.33% b 1.49%
h 6.09% v 0.98%
r 5.99% k 0.77%
d 4.25% j 0.15%
l 4.03% x 0.15%
c 2.78% q 0.10%
u 2.76% z 0.07%
This reduction of rates in the case of the group of Eastern roads has
amounted to 79 per centum, and in the Western group to 73 per
centum, in the twenty-four years. Not less remarkable than the
extent of this decline in freight charges per mile is its uniformity.
Both groups show a wonderful steadiness in the progress of rate
reductions. Starting at quite different points as to territorial
development, they have yet travelled at a nearly equal pace in the
same direction. This shows the operation of causes at once steady
and universal. Statistics can never of themselves yield us causes; but
they guide the way to them; at any rate, they prevent any radical
misinterpretation of them. The great and overshadowing cause here
of the cheaper freights per ton, as everywhere else of cheaper rates
at the junction of efforts by capitalists and laborers, is of course the
perpetual and augmenting and ever-gratuitous assistance of natural
forces at every point.
While the rates of freight per ton have decreased more than three-
quarters in less than one-quarter of a century in the case of these 13
railroads on the whole average, the entire cost of the operation of
these roads in this interval of time has not been diminished to any
appreciable extent, as also stated by the same Manual. The main
item in all the operation-expenses of railroads is the wages paid to
the laborers of all grades; and the laborers are quite as well paid
now on these 13 roads as they were in 1865, proper allowances
being made for the changed and changing standards in the national
Money. If, on a broad view, railroad employees of all grades have
lost nothing as such in their wages in this interval; and the general
public, including these laborers and also the capitalists concerned,
have greatly gained, how can we account for the immensely
lessened freight-charges while the whole operation-expenses
continue substantially as before?
There is only one rational account to be given of this. And it is
trustworthy. All known facts jump with it, and nothing substantial
can be urged against it. The gains to the masses including the
capitalists and the laborers have come out of the capitalists as such.
This is apparent as well as real. Cost of Labor and Cost of Capital is
the whole cost. If the whole cost of moving one ton of freight from
Boston to Chicago is ¾ less than it was ¼ of a century ago, the cost
of the labor being the same at the two points of time, then the
conclusion is inevitable, that the cost of the capital at the second
point is less than it was at the first point. With this conclusion all
facts agree. All the laborers connected with a railroad from highest
to lowest must be paid at any rate, or else the trains will certainly
cease to move, whether the stockholders receive any dividend or not
on their capital invested. The original stock—the capital that built the
roads—of many if not of most the railroads in the country, has been
annihilated, a new indebtedness in another form called bonds having
taken the place of it. Even the nominal dividends of dividend-paying
roads have declined in the interval from 10 or 8 to 5 or 4 per centum
in the general, that is, 50 per centum. It is perfectly evident on
every hand, that there is something in the nature and progress of
things, that makes for wages as contrasted with profits: wages hold
on and relatively enlarge, profits decline or go out altogether.
Fortunately we are not left to generalities here, however plain and
certain these may be. One of the 13 railroads specified above, the
Illinois Central, made a remarkable exhibit in its own annual Report
of 1887, showing the cost of its locomotive service for each year of
the thirty years preceding. This cost per mile run had fallen from
26.52 cents in 1857 to 13.93 cents in 1886. This reduction had been
effected wholly on the Capital side of the account, by inventions and
improvements of all sorts in the machinery of locomotion; while the
wages of the engineers and firemen had risen in the period from
4.51 cents to 5.52 cents per mile run. The cost of the labor had risen
both relatively and absolutely while the cost of the capital had
declined both absolutely and relatively. In 1857 the engineers and
firemen had received as wages 17% of the entire cost of the
locomotive service, but in 1886 they had received 39% of that total
cost. The table is as follows: —
I. C. R. R. CO.
Performance of Locomotives. Relation of Wages to Total Cost per Mile
Run.
Total Total
Cost of wages of Cost of wages of
cost cost
engineers and engineers and
Years. per Years. per
firemen per mile firemen per mile
mile mile
run. run.
run. run.
Cents. Cents. Cents. Cents.
1857 Gold. 4.51 26.22 1872 Currency. 5.77 21.76
1858 3.97 19.81 1873 5.84 21.10
1859 3.81 20.78 1874 6.02 19.57
1860 3.96 20.17 1875 6.03 19.57
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
ebookname.com