IBM Security & Privacy Portfolio
thical Hacking Services

Yovko Lambrev

y_lambrev@bg.ibm.com

IBM Bulgaria

Have you ever been…

@genda

The new business model and where the security is?

Why IBM is a security leader? Our market position and partners

Standards, models and methods

IBM security services portfolio

Ethichal hacking review

Host/Network penetration demo

A Fact

Approx. 80% of all companies surveyed indicated they have experienced some security attack.

(IDC, Dec. 2002)

Daily News

Source, IDC 12/2002

„...	Number of Security incidents	has increased dramatically.

Approx. 80% of all companies surveyed indicated they have experienced some security attack. The most common being the threat of a virus.

Security spending increased in the past six month ...“

„… Internet Traffic globally slowed for hours …“

„… At least 160,000 computers worldwide infected …“

„… Bank of America, most of its 13,000 automatic teller machines unable to process customer transactions …“

„… Caused flight delays and cancellations for
Houston-based Continental Airlines ...“

„… Delay the publication of Sunday's first edition
of Atlanta Journal-Constitution …“

NY Times

Washington Post

Reuters

Washington Post

Washington Post

Increased Risk in a New World

Distance between
business & IT

Traditional business
models

Consumer / employee interacts
with organization

Security is purchased
as a component

Consumer / employee
interacts with IT

Global reach extended

e-business models adopted by B2B and B2C

Security viewed as enterprise-wide need

Physical and IT-security converging

Old World Model

New World Model

business

processes

IT

business

processes

IT

consumer

employee

organization

information

technology

consumer

employee

information

technology

organization

Increased Risk

Increased need for

security, privacy
and trust

Security is everyone’s business

More complex IT systems – More potential security holes

Better attacks

Better crackers

Lower level of cracking knowledge

Variety of cracking tools available for free

Internet is not so friendly environment

Social engineering possibilities

SPAM

Viruses

Trojan horses

Users are not a specialists

The Network is part of our life

Stollen information costs too much

Loosing time means loosing clients

IT is not a component but a part of the core company processes

Security can‘t be just a component

Top ten business trends

Ranking

Gartner’s 2003 CIO Agenda – „Leading for Productivity and Growth“

Top ten business trends, 2003

Gartner – Copyright © 2003

Costs/budget pressures

Data security concerns

Faster innovation

Business risk management

Single view of customer

Stakeholder pressure

Greater transparency of reporting

E-Enabled business/government

Growing value of knowledge capital

Personal data privacy concerns

1

2

3

4

5

6

7

8

9

10

1

4

5

-

3

2

-

6

8

-

1

4

6

-

3

8

-

5

10

-

2003

2002

2001

Selected change
in ranking compared with 2002

0

1

2

3

4

5

6

7

8

9

10

Average weighted score (max = 10)

Top ten technology priorities

Ranking

Gartner’s 2003 CIO Agenda – „Leading for Productivity and Growth“

Top ten technology priorities, 2003

Security enhancement tools

Applications integration/middleware/messaging

Enterprise portal deployment

Network infrastructure/mgmt. tools

Internal E-Enabling infrastructure

Web design, development and content mgmt. tools

Storage mgmt. (SAN, NAS) deployment

Customer Relationship Mgmt. (CRM)

Web services – internal or external

Deploying XML-based processes/messaging

Selected change
in ranking compared with 2002

Average weighted score (max = 10)

0

1

2

3

4

5

6

7

8

9

10

1

3

7

5

6

2

11

9

-

12

2

5

8

3

1

-

-

6

-

12

1

9

12

17

13

14

18

6

2

8

2002

2001

2006

1

2

3

4

5

6

7

8

9

10

2003

Gartner – Copyright © 2003

IBM Security & Privacy Services Portfolio

IBM/Kroll Enterprise Assessment

Health Check

Assessments

Site

Process

System

Network

Internet

Application

Wireless

Security & Resilience

Logical & Physical

Ethical Hacking

BCRS Assessments

BCRS Impact Analysis

Assess

Planning

Architec. & Design

Implementation

Management

What should I do?

Help me do it.

Manage it.

Managed Security
services

Intrusion Detection

Vulnerability Scanning

Firewall Mgmt.

Incident Mgmt.

Vulnerability
Assessment

Security Mgmt.
Standards/Controls

Physical & Logical
Security

Compliance Checking

Security Integrity &
Advisories

Virus Services

Network Security

Security Education

BCRS Recovery

Services

Product Selection

Tivoli Services

Security Awareness Program

OEM Product Implementation

Logical & Physical Integration

Policy definition

Standards definition

Process Development

Enterprise Architecture

Internet Architecture

Secure Solution Design

Secure Wireless Solution Design

PKI Enabled VPN

BCRS Strategy Development

Workshops

Security

Privacy

Public Key Infrastructure

Wireless

Info Asset Profile

Privacy Strategy
and Implementation

PKI Planning and Design

BCRS Plan Development

Logical & Physical Planning

ibm.com/security

Ibm.com/services/security

IBM Worldwide Security Presence

Why IBM?

Americas

Security Center of Competence

PKI Center of Competence

Managed Security Services Delivery Center

Business Innovation Center/
Ethical Hacking Lab

Security & Privacy Practice

Research Labs

Europe, Middle East & Africa

Wireless Center of Competence

Managed Security Services Delivery Center

Security & Privacy Practice

Research Labs

Ethical Hacking

Asia Pacific

Managed Security Services Delivery Center

Business Innovation Center/
Ethical Hacking Lab

Security & Privacy Practice

Research Labs

World’s largest Outsourcing and Web Hosting business

Business Continuity and Recovery Services professionals in 120 recovery sites in 77 countries

3,000 IBM security professionals who are trained, deployed and trusted

Security research in 5 major labs

Market Position

Outperformers

IBM Security Resources

Source: IDC, 2003

Scope of offering versus growth potential of respondents

Unrealized potential: Execution

Underperformers

Unrealized potential: Resources

Scope of Offering

Growth Potential

@stake

Qualys

Foundstone

Ubizen

Symantec

Guardent

Red Siren

Cigital

Counterpane

NETSEC

RSA

TrueSecure

Accenture

CheckPoint

Sun

AT&T

Predictive
Systems

VeriSign

Qinetiq

ISS

Unisys

D&T

E&Y

BearingPoint

SAIC

PwC

CSC

EDS

Narrow

Broad

Low

High

IBM GS

IBM Partner in Security

Global Alliance

Cisco Systems

IT-Security Alliances

Check Point

NetScreen Technologies

Symantec

PKI Alliances

Baltimore Technologies

Entrust

Identrus

RSA Security

ValiCert

VeriSign

Physical Security Alliance

General Electric

Kroll

Lenel

CISCO AND IBM – WORKING TOGETHER TO IMPROVE NETWORK SECURITY

BS ISO/IEC 17799 — Code of practice for information security management

25

10

9

8

7

1

2

3

4

5

Security policy

2

Organizational security

1

3

Asset classification and control

4

Personnel security

5

Physical and environmental security

6

6

Communications and operations mgmt.

7

Access control

8

Systems development and maintenance

9

Business continuity management

10

Compliance

0

50

75

100

Interviews and Document Review according to ISO/IEC 17799

For our technology recommendations, we use based on ISO 7498-2 method

Holistic Approach – The Four Layer Model

Business

IT

Security

Security

Security

Security

Business process

Plane

Organization

Plane

Solutions

Plane

Infrastructure

Plane

Business

IT

IBM Security Services Protfolio

Security Controls Review

Security Process Review

Site Security Assessment

Application Security Assessment

Security Process Development

Security Policy & Standards Development

Custom Security Architecture

Host/Network Security Assessment (Ethical Hacking)

Product Evaluation/Selection

Wireless Risk Assessment

ISO IEC 17799

ISO IEC 7498-2 (X.800)

ISO IEC 15408 (CC 2.1)

Common Criteria

Security Controls Review

Sections: Policy, Organizational, Assets, Personnel, and Compliance

Company Security Manager, Company Information Security Manager, Business Managers, end user representatives, data and application owners, internal and/or external audit

Section: Physical

IT Operations Manager and staff, end users

Section: Communications/Operations

IT Operations Manager and staff, IT Network Manager and staff, end users

Section: Access Control

IT Operations Manager and staff, IT Technical Support Manager and staff, IT Network Support Manager and staff, end users, application owners

Section: Development

Applications Development Manager and staff, application owners

Section: Business Continuity

Business Recovery Planning Manager, application owners, end users

Security Process Review

Conducted against an agreed, predefined information security standard using interviews with appropriate staff

Verification of the accuracy of the answers given by reviewing the actual processes or documentation as appropriate

Site Security Assessment

Portals

Cameras

Power, Water, Gas,

Telephone, Cable TV

Satellite

Microwave

Server room

Bridges

Routers

Hubs

Employee

Central Office

& Telephone

Network

To provide an in-depth review of the site security controls in place and related processes used within an organization

Application Security Assessment

This activity involves a comprehensive (end to end) assessment of a client server application in the context of its development and operational environments.

The methodology describes an in-depth review of a client's application, the application development and maintenance processes and the complete application operational environment including the application itself, the platform it runs on, the networking services used, and any data base or operating platforms services used.

Application Server

Firewall

Production Data

Authorized Users

Web Server

Security Policy & Standards Development

COMMON REQUIREMENTS

UNIQUE REQUIREMENTS

Contractual

Business Continuity

Virus Prevention

Regulatory

Type of Business

Organization/Culture

The objective of this service is to investigate the requirements for information security, the associated priorities and then to develop the custom policies and standards that are needed to safeguard the organizations information assets.

Custom Security Architecture

Enterprise Architecture

P

R

O

C

E

D

U

R

E

IS Standard

Business Standard

P

R

O

C

E

D

U

R

E

P

R

O

C

E

D

U

R

E

P

R

O

C

E

D

U

R

E

P

R

O

C

E

D

U

R

E

P

R

O

C

E

D

U

R

E

P

R

O

C

E

D

U

R

E

P

R

O

C

E

D

U

R

E

Enterprise Policy

Enterprise Architecture

Corporate Level

Formal

Guiding principles for all security decisions

Standards

Implementation Oriented

General "Policy" Level Statements

Auditable Exception Process

Process/Procedure

Environment Specific

Executable

Auditable Exception Process

IBM Enterprise Risk Assessment Service

Security

Process Review

Security

Implementation

Review

Kick-off

Meeting

Document

Review

Interviews

Physical Security Review

Technical Security Review

Analysis

Reporting

Follow-on

Workshop

Management

Presentation

Site Manager

Finance Director

Marketing Director

IT-Director

Group of users

...

Host/Network Assessment (Ethical hacking)

This assessment is comprehensive, covering not only the intruder view of the system but also the configuration and management of the systems (routers, servers, hosts, DBs), factors that could lead to new exposures in the future.

This assessment will be customized to cover whatever system platforms, network connections, software and databases comprise a client's infrastructure. A subset of the tasks can be used for any platform assessment and well as internal network assessments.

Application Server

Firewall

Production Data

Un-Authorized Users

Web Server

Ethical hacking is a controlled hacker attack

It is controlled to prevent a damage or theft that occurs with real hackers, but it uses the same techniques and methods.

Hacking process

Crackers trying to penetrate a system generally use a port scanners to run against the target firewalls, web servers, or other machines connected to the Internet.The results show the services running i.e. FTP, telnet, Web, Mail, etc. Armed with this information the cracker can detect the version of each service running and begin the research to look up the vulnerabilities known to exist for each.

Ethical Hacking Definition

Physical Security und Technical Security Review

Attack Plan

Takeover

Cleanup

Listening phase

Stealth phase

Advancement

Gaining a toehold

Listening phase

Probe & attack

Reconnaissance

Typical Cracker
Attack

low

medium

high

low

mdium

high

probability

impact

Planning Assessment – External or Internal Testing

What problems do Ethical hackers find?

Configuration errors, vulnerable software and un-pached software

Weak access control mechanisms, weak authentication mechanisms including weak passwords

Poor password schemes, secret untested “cryptography”, or no passwords at all

Network and Application design issues, including security bypass issues

Systems admin “backdoors”

Error handling issues

Weak or default user accounts

Application program coding errors and application injection error checking

Unsecured and/or un-needed services

Assumed trust problems through broken access control and session management

Customers consider IBM to be an ethical business partner. Hence an ethical hacking engagement may cause a number of ethical, legal and potential embarrassing issues for us and the target customer company. So we insist to be perfect…

- We'll never read customer's emails

- We'll never hack servers which are out of the defined scope

- We'll never work without authorization (GOJF) letter

- We'll never do a demo to a client how bad their security is

- We'll never do an unannounced hacks

- We'll never reveal the sources of the information in our reports

- We'll never copy the files, information or software from the client

- We'll keep all strictly confidential

Ethical Issues - Ethical Hacking Code of Conduct

Target: Hello, Application support.

Attacker: Who am I speaking with?

Target: Jane, how can I help you?

Attacker: Hi Jane this is John from the help desk. We have one of the corporate executives trying to login to get his daily report and his user ID is coming up as invalid can you help me with this?

Target: Sure what do you need?

Attacker: Well I’m trying to login to the application and I’m getting username is not recognized. Can you verify what Bob Smith’s user ID actually is?

Target: Let me look. Here it is smith01.

Attacker: Great he told me smith1. This guy is driving me crazy. Can you reset that and we’ll have him set a new password once he’s able to login to the application.

Target: Sure thing give me 10 minutes.

Attacker: Thanks I appreciate it.

Social Engineering – The Art of Deception

Attention all Hackme Bank employees. Recent high-profile corporate scandals have damaged investor confidence in public companies. Fallout from these scandals have included lawsuits, bankruptcies and some of the most wide-ranging corporate governance legislation ever.

It is important to remember that a strong value system based on integrity and accountability has always been at the core of Hackme Bank's existence.

In accordance with corporate policy, you are now required to certify your compliance with security guidelines on an annual basis. Please take time now to log onto the corporate compliance website.

Goto http://10.100.1.12/compliance.html

Log in with your company logon and password and follow the directions on the site.

Your cooperation is greatly appreciated.

J.S. Smith

Vice President, Corporate Security

Office of the CIO

Hackme Bank

E-based Social Engineering

Reports structure

EXECUTIVE SUMMARY

Covering a short overview, and a summary of key business issues strengths and weaknesses

SCOPE

A statement of the original statement of Work scope and a table detailing the targets

METHODOLOGY

The IBM Ethical hacking methodology used to perform the assessment

DETAILED FINDINGS and RECOMMENDATIONS

APPENDIX

IBM's ethical hackers understand the importance of finding and fixing vulnerabilities and exposures before a hostile cracker is able to uncover them and damage occures

A penetration test can demonstrate the effectiveness/shortcomings of an organization's own intrusion detection/alarms

The penetration test and the resulting reports can serve as a useful tool to train the client's system administration and security staffs

IBM not simply run tools and generate reports. IBM takes the ethical hack results and conducts a full analysis of the client’s security vulnerabilities

The report written for the client is usually broken down into two major sections – the executive summary and technical review

How secure is the client network and the applications?

How skilled the administrators are?

Are security compliance and the goals of upper management being met?

Scan results, exploits worked, unauthorized access obtained, bad development practices, etc

Benefits

9

10

7

8

5

6

3

4

Reporting

Follow-on Workshop

Typical Project Plan

Kick-off Meeting

1

2

Time frames

Interviews

Document Review

Physical Security Review

Technical Infrastructure Review

Analysis

Th@nk you, very much!

It’s time for the
demo and questions
& answers…

This presentation has

been made exlusively with 100% free and open source software

Yovko Lambrev

Security & Privacy Consultant

Ethical Hacking Services

IBM Bulgaria Ltd.

36, Dragan Tzankov Blvd.

World Trade Center INTERPRED

Phone: +359 2 969-3214

Mobile: +359 88 826-2552

Fax: +359 2 971-2550

http://ibm.com/security

http://yovko.net

IBM Security & Privacy Portfolio

security hacking assessment services consultant practice

1901-01-01T01:00:00