Evaluating Common Threats

SECURITY +

Evaluating Common Threats

Jerry Grugin

 

            How do we evaluate threats to computers or computer systems?  In order to evaluate threats, we need to know what these threats are.  We need to be able to differentiate between various system security threats, which is the first step in security risk assessment.  We need to know certain basic fundamental concepts about systems.  When we know these things, we will be better able to protect systems.

First Security Fundamental - Privilege Escalation

            We don't give individual users or systems access to areas to which they are not supposed to have access.  One of the first types of measure that may be taken against a system involves privilege.  It involves escalating privilege or increasing permissions beyond those that are allowed by the security policy.  Therefore, we want to ensure the concept of least privilege where users are only given access to the things they are supposed to have access to based on the credentials of the user account being used to log into a system or the membership of some group.  Privilege escalation can happen on purpose or by default, or it could be an actual category of attack that looks for vulnerabilities on systems and services and then uses the situation to take advantage of them.  Escalation of privilege is tied very closely to permissions.  In an escalation of privilege attack, the attacker tries to escalate the permissions from a basic user and change them to administrator permissions.  We need to know the difference between system permissions and normal user permissions.  System permissions allow modify, read & execute, and write.  A normal user, though, can read & execute, list content, and read.  So an attacker would try to escalate from a basic user to an administrator or system account.

Malware

            One of the primary reasons why an attacker would want to escalate privileges on a system is to introduce something called malware into a networking environment or onto a system, maybe even a server.  Malware is short for "Malicious Software."  It refers to software programs that are designed to damage or perform some type of unwanted action on a computer.  The types of malware include viruses, worms, trojan horses, and spyware.

Categories of Threats

            Malware can be introduced via several types of environments.  The first type of threat is intentional.  These are threats that are lodged against a system by a malicious, knowledgeable user.  The second type of threat is unintentional.  This is simply an educated user that accidentally downloads malware by accident.  The third category of threat is an internal attack.  Over sixty percent of attacks are caused by an insider.  The fourth type of attack is external.  It is important to understand that malware can be introduced through different combinations of the four threats.  For example, a threat could be an intentional internal attack or an intentional external attack.  In the same way, an attack could be an unintentional internal attack or an unintentional external attack.

Virus

            A virus is simply a computer program that can do the same thing as other computer programs do.  It is a program that spreads by first infecting files or system areas of a network.  A virus makes copies of itself.  Some are harmless, while others will damage a computer.  In today's times, viruses are primarily spread using email messages.  The types of viruses are polymorphic, stealth, retrovirus, multipartite, armored, companion, phage, and macro.  Importantly, a polymorphic virus can modify itself to avoid detection from antivirus software.  These viruses attack systems, servers, and hosts.  They will display messages on computers.  Sometimes they will delete files from the system.  A polymorphic virus can actually encrypt parts of itself to avoid detection.  This is called mutation.  Basically, the polymorphic virus modifies its signature in order to bypass antivirus detection.