Target Vulnerability Control

Precursors to
attack Port scan • Firewall
• Intrusion detection system
• Running as few services as possible
• Services that reply with only what is
necessary

• Social engineering • Education, user awareness

• Policies and procedures
• Systems in which two people must agree to
perform certain security-critical functions

• Reconnaissance • Firewall
• "Hardened" (self-defensive) operating system
and applications
• Intrusion detection system

• OS and application • Firewall

fingerprinting • "Hardened" (self-defensive) applications
• Programs that reply with only what is
necessary
• Intrusion detection system

Authentication
failures
• Impersonation • Strong, one-time authentication

• Guessing • Strong, one-time authentication

• Education, user awareness

• Eavesdropping • Strong, one-time authentication

• Encrypted authentication channel

• Spoofing • Strong, one-time authentication

• Session hijacking • Strong, one-time authentication

• Encrypted authentication channel
• Virtual private network

• Man-in-the-middle • Strong, one-time authentication

attack • Virtual private network
• Protocol analysis
 • Buffer overflow • Programming controls
• Intrusion detection system
Programming • Controlled execution environment
flaws • Personal firewall

• Addressing errors • Programming controls

• Intrusion detection system
• Controlled execution environment
• Personal firewall
• Two-way authentication

• Parameter • Programming controls

modification, time- • Intrusion detection system
of-check to time- • Controlled execution environment
of-use errors • Intrusion detection system
• Personal firewall

• Server-side include • Programming controls

• Personal firewall
• Controlled execution environment
• Intrusion detection system

• Cookie • Firewall
• Intrusion detection system
• Controlled execution environment
• Personal firewall

• Malicious active • Intrusion detection system

code: Java, • Programming controls
ActiveX • Signed code

• Malicious code: • Intrusion detection system

virus, worm, • Signed code
Trojan horse • Controlled execution environment
• Intrusion detection system

• Malicious typed • Signed code

code • Intrusion detection system
• Controlled execution environment
 • Protocol flaw • Programming controls
• Controlled execution environment

• Eavesdropping • Encryption

• Passive wiretap • Encryption

Confidentiality
• Misdelivery • Encryption

• Exposure within • End-to-end encryption

the network

• Traffic flow • Encryption

analysis • Traffic padding
• Onion routing

• Cookie • Firewall
• Intrusion detection system
• Controlled execution environment

• Protocol flaw • Firewall

• Controlled execution environment
• Intrusion detection system
• Protocol analysis
• Audit

• Active wiretap • Encryption

• Error detection code
Integrity • Audit

• Impersonation • Firewall
• Strong, one-time authentication
• Encryption
• Error detection code
• Audit

• Falsification of • Firewall
message • Encryption
• Strong authentication
• Error detection code
• Audit
 • Noise • Error detection code

• Web site • Error detection code

defacement • Intrusion detection system
• Controlled execution environment
• Hardened host
• Honeypot
• Audit

• DNS attack • Firewall

• Intrusion detection system
• Strong authentication for DNS changes
• Audit

• Protocol flaw • Firewall

• Redundant architecture

• Transmission or • Architecture
component failure

• Connection • Firewall
flooding, e.g., • Intrusion detection system
echo-chargen, ping • ACL on border router
of death, smurf, • Honeypot
Availability syn flood

• DNS attack • Firewall

• Intrusion detection system
• ACL on border router
• Honeypot

• Traffic redirection • Encryption

• Audit

• Distributed denial • Firewall

of service • Intrusion detection system
• ACL on border router
• Honeypot