Featuring 105 Papers as of April 13, 2017
Speed and Scalability Matter: Review of LogRhythm 7 SIEM and Analytics Platform Analyst Paper
by Dave Shackleford - April 13, 2017
- Associated Webcasts: Speed and Scalability Matter: SANS Review of LogRhythm 7 SIEM and Analytics Platform
Just how scalable, fast and accurate are SIEM tools when under load? To find out, we put the LogRhythm 7.2 Threat Lifecycle Management Platform to the test. We found that its clustered Elasticsearch indexing layer supported large log volumes of security and event data during simulated events that would require investigation and remediation.
Cyber Threat Intelligence Uses, Successes and Failures: The SANS 2017 CTI Survey Analyst Paper
by Dave Shackleford - March 14, 2017
- Associated Webcasts: Cyber Threat Intelligence in Action-Skills and Implementations: Results of the 2017 Cyber Threat Intelligence Survey Part 1 Cyber Threat Intelligence in Action-Effectiveness of CTI Programs and Wish Lists for the Future: Results of the 2017 Cyber Threat Intelligence Survey Part 2
- Sponsored By: Arbor Networks Rapid7 Inc. Lookingglass Cyber Solutions, Inc. Anomali DomainTools ThreatConnect
Respondents' biggest challenges to effective implementation of cyber threat intelligence (CTI) are lack of trained staff, funding, time to implement new processes, and technical capability to integrate CTI, as well as limited management support. Those challenges indicate a need for more training and easier, more intuitive tools and processes to support the use of CTI in today's networks. These and other trends and best practices are covered in this report.
DevSecOps Transformation: The New DNA of Agile Business Analyst Paper
by Dave Shackleford - February 21, 2017
This is an additional resource that accompanies the analyst paper, "The DevSecOps Approach to Securing Your Code and Your Cloud". To view the paper please click this link.
PLC Device Security - Tailoring needs by Wen Chinn Yew - February 15, 2017
Programmable Logic Controller (PLC) is widely used in many industries. With increasing concern and interest in the security of these controllers and their impact to the industries, there is a growing trend to integrate security directly into them. It is not realistic or wise to have a one size fit all solution. This paper presents focus areas and requirements suited for various classes of PLCs in the market. It looks at the threats and vulnerabilities faced by them and current security solutions adopted. The paper then recommends how PLC vendors should have different but extensible security solutions applied across various classes of controllers in their product portfolio.
The DevSecOps Approach to Securing Your Code and Your Cloud Analyst Paper
by Dave Shackleford - February 7, 2017
- Sponsored By: CloudPassage
DevSecOps, at heart, is about collaboration. More specifically, it is continual collaboration between information security, application development and IT operations teams. Having all three teams immersed in all development and deployment activities makes it easier for information security teams to integrate controls into the deployment pipeline without causing delays or creating issues by implementing security controls after systems are already running. Despite the potential benefits, getting started with DevSecOps will likely require some cultural changes and considerable planning, especially when automating the configuration and security of assets in the cloud. To help the shift toward a more collaborative culture, security teams need to integrate with the developers who are promoting code to cloud-based applications to show they can bring quality conditions to bear on any production code push without slowing the process. Security teams should also work with QA and development to define the key qualifiers and parameters that need to be met before any code can be promoted. This paper also has an additional resource titled, "DevSecOps Transformation: The New DNA of Agile Business". The resource can be accessed by clicking this link.
Insider Threats and the Need for Fast and Directed Response Analyst Paper
by Dr. Eric Cole - December 1, 2016
- Associated Webcasts: Insider Threats and the Real Financial Impact to Organizations - A SANS Survey
- Sponsored By: Veriato
As breaches continue to cause significant damage to organizations, security consciousness is shifting from traditional perimeter defense to a holistic understanding of what is causing the damage and where organizations are exposed. Although many attacks are from an external source, attacks from within often cause the most damage. This report looks at how and why insider attacks occur and their implications.
Taking Action Against the Insider Threat Analyst Paper
by Eric Cole, PhD - October 5, 2016
- Associated Webcasts: Taking Action Against Insider Threats Taking Action Against Insider Threats
- Sponsored By: Dtex Systems
Most organizations tend to focus on external threats, but insider threats are increasingly taking center stage. Insider threats come not only from the malicious insider, but also from infiltrators and unintentional insiders as well. Why are insider threats so common and why do they have such a significant impact? What is the difference between the different types of insider threats and the degree of risk they can constitute?
Intelligent Network Defense Analyst Paper
by Jake Williams - September 8, 2016
When an army invades a sovereign nation, one of the defenders’ first goals is to disrupt the invader’s command and control (C2) operations. The same is true when cyber attackers invade your network. Network defenders must prevent adversary communication, stopping the attack in its tracks while alerting the incident response (IR) team to the point of compromise and nature of the attack. Read on to learn more.
Generating Hypotheses for Successful Threat Hunting by Robert M. Lee and David Bianco - August 15, 2016
Threat hunting is a proactive and iterative approach to detecting threats. Although threat hunters should rely heavily on automation and machine assistance, the process itself cannot be fully automated. One of the human’s key contributions to a hunt is the formulation of a hypotheses to guide the hunt. This paper explores three types of hypotheses and outlines how and when to formulate each of them.
The SANS State of Cyber Threat Intelligence Survey: CTI Important and Maturing Analyst Paper
by Dave Shackleford - August 15, 2016
- Associated Webcasts: The State of Cyber Threat Intelligence: Part 1: How Cyber Threat Intelligence Is Consumed and Processed The State of Cyber Threat Intelligence: Part 2: The Value of CTI
- Sponsored By: Arbor Networks Hewlett Packard NETSCOUT Systems, Inc. Rapid7 Inc. AlienVault Anomali
It’s 2016, and the attacks (and attackers) continue to be more brazen than ever. In this threat landscape, the use of cyber threat intelligence (CTI) is becoming more important to IT security and response teams than ever before. This paper provides survey results along with advice and best practices for getting the most out of CTI.
Scalable Methods for Conducting Cyber Threat Hunt Operations STI Graduate Student Research
by Michael C. Long II - July 14, 2016
Information Security professionals commonly agree that organizations cannot prevent 100% of all cyber attacks. For this reason, organizations are encouraged to practice defense in depth so that if any one security measure fails, another will reduce the exposure and mitigate the impact. However, despite investing countless sums of money, manpower, and time into developing and maintaining a robust security infrastructure, organizations still struggle to identify and respond to cyber intrusions in a timely manner. Cyber Threat Hunt Teams have recently emerged as a proactive defense asset capable of methodically detecting and responding to advanced persistent threats that evade traditional rule or signature-based security solutions. This paper describes scalable methods and practices to plan and conduct cyber threat hunt operations throughout the enterprise.
Threat Hunting: Open Season on the Adversary Analyst Paper
by Dr. Eric Cole - April 12, 2016
- Associated Webcasts: Open Season on Cyberthreats: Part 2- Threat Hunting Methodologies and Tools Open Season on Cyberthreats: Part I- Threat Hunting 101
- Sponsored By: HPE Carbon Black DomainTools Endgame Sqrrl Data, Inc. Malwarebytes
Nearly 86% of organizations responding to the survey want to be doing the hunting, albeit informally, as more than 40% do not have a formal threat hunting program in place. Results indicate that hunting is providing benefits, including finding previously undetected threats, reducing attack surfaces and enhancing the speed and accuracy of response by using threat hunting. They also suggest that organizations want to improve their threat-hunting programs and realize more benefits from threat hunting.
Automated Network Defense through Threat Intelligence and Knowledge Management by Christopher O'Brien - January 4, 2016
Many organizations know that they should have cyber security threat intelligence, fewer know how to use it and fewer still are actually doing so.
Applying Data Analytics on Vulnerability Data by Yogesh Dhinwa - December 23, 2015
An organization with services spread across the globe depends on information technology and information systems. Adoption and compliance of information security standards have become mandatory for many organizations, especially those working under government regulations.
Understanding and Preventing Threats to Point of Sale Systems STI Graduate Student Research
by Richard Hummel - October 15, 2015
Data breaches have become a systemic problem in the retail, financial, and healthcare sectors, resulting in mass exfiltration of sensitive customer and/or patient data. These breaches continue to be a major problem for all sectors, but primarily that of the retail sector. It has seen many different Point-of-Sale systems compromised, databases stolen, and customer data sold in underground forums. Many studies and white papers describe and analyze these breaches in detail, but fail to address all aspects of a single breach in one succinct article. As such, practitioners are only educated in part on the threats and the methods to mitigate these threats. This paper will cover three of the more prominent breaches, how the breaches occurred, how data was stolen, and actions organizations need to take to mitigate or, hopefully, eliminate the threats altogether.
Observation and Response: An Intelligent Approach Analyst Paper
by J. Michael Butler - August 7, 2015
- Associated Webcasts: Tracking and Observation-How-To and What To Watch For
- Sponsored By: Anomali
A SANS Analyst Program whitepaper by J. Michael Butler. It discusses how properly focused observation and tracking efforts provide intelligence from inside the enterprise by monitoring for indicators of compromise such as odd point-in-time activities on the network, unusual machine-to-machine communications, outbound transfers, connection requests and many other suspicious activities.
Applying Lessons Learned for the Next Generation Vulnerability Management System STI Graduate Student Research
by John Dittmer - June 8, 2015
The objective of this paper is to recommendations for improving a vulnerability management system in development.
Using Software Defined Radio to Attack "Smart Home" Systems by Florian Eichelberger - May 1, 2015
The objective of this paper is to describe several plausible attacks that target "Smart-Home" systems using SDR platforms.
The Role of Static Analysis in Heartbleed by Jeff Sass - February 12, 2015
Numbered security vulnerabilities known as Common Vulnerabilities and Exposures (CVEs), have been on the rise since the United States Computer Emergency Readiness Team (US-CERT) began tracking them in 1999.
Detecting Crypto Currency Mining in Corporate Environments by Jan D'Herdt - February 4, 2015
Crypto currencies  such as Bitcoin, Dogecoin, Primecoin, Litecoin, Riecoin and many others are digital currencies that do not follow the normal set of rules for currencies as we know them.
Automated Defense - Using Threat Intelligence to Augment by Paul Poputa-Clean - January 19, 2015
Threat Intelligence means different things to different people.
Point of Sale Systems and Security: Executive Summary Analyst Paper
by Wes Whitteker - November 20, 2014
- Sponsored By: Carbon Black
The last year has seen scores of point of sale (POS) systems compromised by bad actors. In many cases, these environments were PCI-DSS compliant at the time of compromise. Executives seeking to protect their organizations and POS systems from compromise need to look beyond PCI-DSS and adopt a proactive "offense must inform defense" approach to POS security.
Creating a Threat Profile for Your Organization by Stephen Irwin - October 2, 2014
Developing a detailed threat profile, provides organizations with a clear illustration of the threats that they face, and enables them to implement a proactive incident management program that focuses on the threat component of risk. Organizations are facing new types of advanced persistent threat (APT) scenarios that existing risk management programs are not able to evaluate completely and incident management programs are not able to defend against. This paper provides information about how to expand existing risk management models to better illustrate APTs and provides a framework on how to gather threat related information so that detailed threat profiles that include APTs can be developed for organizations.
Critical Security Controls: From Adoption to Implementation Analyst Paper
by James Tarala - September 18, 2014
- Associated Webcasts: The Critical Security Controls: From Adoption to Implementation A SANS Survey
- Sponsored By: Qualys Tripwire, Inc. McAfee EiQnetworks
This SANS survey report explores how widely the CSCs are being adopted, as well as what challenges adopters are facing in terms of implementation of the controls and what they are looking for to improve their implementation practices.
MalwareD: A study on network and host based defenses that prevent malware from accomplishing its goals. by Dave Walters - September 17, 2014
Malware is an ever-growing problem on the Internet. Organizations struggle to prevent, detect, and responds to malware threats.
Insider Threats in Law Enforcement Analyst Paper
by Dr. Eric Cole - September 4, 2014
Based on the valuable information they have at their disposal, law enforcement agencies are among those that are prime targets for advanced attacks. While network protection can be extensive and sophisticated, the exploitation of insiders poses a serious threat for illegal access to these agencies.
An Opportunity In Crisis by Harshit Nayyar - June 3, 2014
As the cliche saying goes, 'The Chinese word for Crisis contains a symbol for Opportunity'.
Improving Security Management with Real-Time Queries Analyst Paper
by Dave Shackleford - April 2, 2014
Product review McAfee Real Time Command with a focus on features and ease of use. Examination of its security-related features found the product to be surprisingly intuitive.
DDoS Attacks Advancing and Enduring: A SANS Survey Analyst Paper
by John Pescatore - March 20, 2014
Survey on the state of DDoS readiness reveals more frequent and sophisticated DDoS attacks as well as lack of preparedness in many enterprises.
Framework for building a Comprehensive Enterprise Security Patch Management Program STI Graduate Student Research
by Michael Hoehl - January 2, 2014
The concept of a patch is pretty straight forward and broadly understood. In business terms, patching is a form of quality control and defect repair.
SANS Security Analytics Survey Analyst Paper
by Dave Shackleford - October 1, 2013
- Associated Webcasts: SANS Analytics and Intelligence Survey Results Part I: The Risk Landscape
- Sponsored By: Guidance Software LogRhythm Hewlett Packard SolarWinds Hexis Cyber Solutions
Survey on next generation of security tools shows that market is in need of analytics and intelligence wrapped around the data that is being/can be collected in organizations.
Scaling Analytics to Meet Real-Time Threats in Large Enterprises: A Deep Dive into LogRhythm's Security Analytics Platform Analyst Paper
by Dave Shackleford - September 10, 2013
- Associated Webcasts: Under Pressure: Scaling Analytics to Meet Real-Time Threats
- Sponsored By: LogRhythm
Evaluation of LogRhythm’s real-time analytics capabilities.
How DDoS Detection and Mitigation Can Fight Advanced Targeted Attacks Analyst Paper
by John Pescatore - September 5, 2013
Exploration of how DDoS is used as part of advanced targeted attacks (ATAs) and description of how DDoS detection and prevention tools and techniques can also be used against ATAs.
Protecting Small Business Banking by Susan Bradley - July 22, 2013
Over the last several years, the use of online banking and other financial transactions have risen dramatically.
Implementing a Vulnerability Management Process by Tom Palmaers - April 9, 2013
A vulnerability is defined in the ISO 27002 standard as "A weakness of an asset or group of assets that can be exploited by one or more threats" (International Organization for Standardization, 2005).
Beyond Continuous Monitoring: Threat Modeling for Real-time Response Analyst Paper
by Mark Hardy - October 13, 2012
- Sponsored By: SecurityCoverage
Threat modeling, through timely and accurate inputs, can be used by enterprises to mitigate and defeat attack scenarios before they fully unfold.
Exploiting Financial Information Exchange (FIX) Protocol? by Darren DeMarco - July 3, 2012
The FIX Protocol website defines The Financial Information eXchange ("FIX") Protocol as “a series of messaging specifications for the electronic communication of trade-related messages” (FIX Protocol Ltd, 2012).
Covert Channels Over Social Networks by Jose Selvi - June 4, 2012
Today we live in a malware age, with the malware industry growing exponentially (AV-Test, 2012).
Robots.txt by Jim Lehman - May 31, 2012
Every minute of every day the web is searched, indexed and abused by web Robots; also known as Web Wanderers, Crawlers and Spiders.
APT Dot Gov: Protecting Federal Systems from Advanced Threats Analyst Paper
by G. Mark Hardy - October 31, 2011
- Sponsored By: F5 Networks, Inc.
This paper describes advanced threats against federal and other governmental systems and provides advice on how to identify and protect the data at risk.
BYOB: Build Your Own Botnet by Francois Begin - August 17, 2011
A recent report on botnet threats (Dhamballa, 2010) provides a sobering read for any security professional. According to its authors, the number of computers that fell victim to botnets grew at the rate of 8%/week in 2010, which translates to more than a six-fold increase over the course of the year.
Reducing Organizational Risk Through Virtual Patching by Joseph Faust - January 11, 2011
Software patching for IT Departments across the organizational landscape has always been an integral part of maintaining functional, usable and stable software. Historically the traditional patch cycle has been focused on fixing or resolving issues which affect functionality. In recent years, with the advancement of more sophisticated and targeted threats which are occurring in quicker cycles, this focus is dramatically changing. (Risk Assessment – Cisco, n.d.; Executive Office of The United States, 2005) . Corporations and Government now have a greater understanding of potential losses and expenses incurred by not maintaining application security and are moving towards an increased focus on patching and security (Epstein, Grow & Tschang, 2008). With organizations’ reputations, consumer confidence and corporate secrets at risk, corporations and government are recognizing the need to shift and address vulnerabilities at a much faster pace than they historically have done so (Chan, 2004). Over roughly the last ten years, the length of time between the documentation of a given vulnerability in a piece of software and the development of an actual exploit that can take advantage of the weakness in the application, has decreased tremendously. According to Andrew Jaquith, senior analyst at Yankee Group, the average time between vulnerability discovery and the release of exploit code is less than one week. (“Shrinking time from,” 2006). It has also been identified that “99% of intrusions result from exploitation of known vulnerabilities or configuration errors where countermeasures were available” ("Risk reduction and.," 2010) . Clearly these statistics alone can prove daunting for many businesses trying to keep pace and maintain proper defenses against the bad guys.
Malicious Android Applications: Risks and Exploitation by Joany Boutet - December 22, 2010
Android is an open-source mobile operating system, based upon a modified version of the Linux kernel, initially developed by Android Inc., a firm purchased by Google in 2005. A Gartner study released on November 2010 outlined that Android has become the second-most popular OS in the world (Gartner, 11/2010). The growth of Android has exceeded their previous study, released last year, in which they had predicted that Android will be the No.2 worldwide mobile operating system in 2012 (The H, 08/10/2009). According to another Gartner study (Gartner, 08/2010)., there will be only a slight difference between Symbian and Android market share in 2014: 30.2% for Symbian against 29.6% for Android.
USB - Ubiquitous Security Backdoor STI Graduate Student Research
by Erik Couture - August 25, 2009
The Universal Serial Bus (USB) is an omnipresent data and peripheral communication port that poses a security threat in any modern computing environment. Proposed is a holistic approach to USB port-security, examining the problem from user requirements definition to organizational threat-risk assessment and finally technical and procedural-based risk mitigation.
Threat Analysis of Allowing Employee Internet Access STI Graduate Student Research
by Mason Pokladnik - March 28, 2008
The ISO 17799/27001 standard provides a good minimum description of what organizations should be doing to protect themselves, but it should not be the sole focus of your security and audit control design. A better approach is to allow your information-security management-system subcommittees or technical specialists to analyze the threats your organization is likely to face. Then, design your controls around those threats, balancing the cost to mitigate a threat versus the cost of a threat occurring in your environment. Finally, after you have analyzed the threats, you can double check your policies and procedures against a regulatory or management framework, such as ISO17799, SOX, GLBA, HIPPA or PCI.
Attack vs. Defense on an Organizational Scale by Omar Fink - December 11, 2007
Historically, the motivation behind most cyber attacks was similar to graffiti, in that the main purpose was to make a mark on somebody else’s territory, to demonstrate technical skill by compromising a web server and defacing the main page, with the primary goal seeming to be simply to make a statement of existence. In recent years, this has evolved to being more concerned about making a profit or creating a political impact.
ANI vulnerability: History repeats by Shashank Gonchigar - October 24, 2007
Animated cursors (.ani files) are used to change the appearance of the mouse pointer to an animation. Common example would be Mouse pointer turning into hour glass when the processor is busy. In the month of March 2007 a quite severe vulnerability was announced. It was subsequently exploited because of a flaw in the code which handled these files. This paper is a discussion about the ANI header buffer overflow vulnerability (Microsoft Security Bulletin MS07-017 - CVE-2007-0038). As we progress, we will understand what caused this vulnerability, analyze an exploit (PoC), understand the heap spraying technique employed by this exploit and finish with the incident handling process.
A System of Persistent Baseline Automated Vulnerability Scanning and Response in a Distributed University Environment by Chet Langin - September 18, 2007
This paper describes and analyzes a persistent automated baseline vulnerability scanning procedure in a university (“The University”), including preparation, response, and follow up procedures. A Ruby script called run_nxscan.rb, written by the author, runs the nxscan scanning tool (York University, 2007) and processes the output. But this paper is more about the overall system used than just about a script and the nxscan tool. See Wack, Tracy, and Souppaya (2003) for a list of some other vulnerability scanning tools.
Malware Analysis: Environment Design and Artitecture by Adrian Sanabria - August 2, 2007
The goal of this paper is to discuss the architecture and design necessary to create an effective malware analysis lab environment, and to explore possibilities beyond the traditional two or three system VM-based lab.
Visually Assessing Possible Courses of Action for a Computer Network Incursion by Grant Vandenberghe - June 15, 2007
This study has suggested that an additional course of action step be added to the incident handling process. This addition would require that an incident handler identify the effects of his action before disrupting ongoing commercial or military operations.
A Survey of Wireless Mesh Networking Security Technology and Threats by Anthony Gerkis - October 18, 2006
This paper will summarize the technologies and challenges related to wireless mesh networks.
Exploiting BlackICE When a Security Product has a Security Flaw by Peter Gara - July 9, 2005
This paper contains a fictional story about a computer expert who gets into evil ways and tries to denigrate his ex-colleague at her new workplace.
A Spyware Survival Toolkit by Peter McGranaghan - May 17, 2005
This paper will discuss the sources of spyware, the types of spyware, and methods of prevention, detection, and removal of spyware.
What is Santy bringing you this year? by Pieter Danhieux - May 5, 2005
This early and evil "Santa Claus" present caused some serious havoc for administrators of phpBB bulletin board software around Christmas 2004, defacing almost 40 thousand phpBB sites in a short period.
Phishing: An Analysis of a Growing Problem by Anthony Elledge - July 25, 2004
Email has become an invaluable communication tool for both business and personal use. Among the many security issues that now affect computer users, there is a growing threat known as "phishing".
Electronic Toll Collection by Don Flint - July 25, 2004
Since 1992 active Radio Frequency Identification (RFID) tags have been used in vehicles to automate the toll process on toll roads, bridges, and tunnels in a process called Electronic Toll Collection (ETC). These tags are mounted to the windshield or externally surrounding the license plate on a vehicle and read as the vehicle proceeds without stopping through special lanes at the toll plaza.
Risk-Eye for the IT Security Guy by Thomas Siu - May 2, 2004
An enterprise risk management workflow model is presented to illustrate the `big picture' of risk management, the key to developing a "keen eye" for IT security risks as a part of the overall IT management doctrine.
Skimming and Its Side Effects by Nobie Cleaver - March 9, 2004
What I have learned in my research has truly amazed me and I endeavor to share some of that information in this paper. I will define skimming, describe what a skimming device may look like, discuss how skimming is done, provide some statistical information and provide some pointers on how to avoid being skimmed and what to do if it happens.
Vulnerability Management: Tools, Challenges and Best Practices by Cathleen Brackin - December 13, 2003
This paper will outline the key steps to Vulnerability Management, and provide an in-depth look at the tools, challenges and best practices of each part of the VM lifecycle.
Managing vulnerabilities exposed by Windows services. by James Williams - November 6, 2003
This paper looks at the vulnerabilities exposed by Windows services, how and why these risks occur, identify the tools for manipulating Windows services, and provide solutions to secure these identified vulnerabilities.
Corporate Anti-Virus Protection - A Layered Approach by Elizabeth Peyton - November 6, 2003
This paper offers a "defense-in-depth" solution for large enterprises and corporations where there may be thousands of entry points through which viruses can enter, causing possible system damage and information theft or loss.
Examining the RPC DCOM Vulnerability: Developing a Vulnerability-Exploit Cycle by Kevin OShea - October 6, 2003
This paper proposes to build on the vulnerability life-cycle work first proposed by Arbaugh, Fithen and McHughi to establish a detailed framework for vulnerability analysis.
Vulnerabilities &; Vulnerability Scanning by Ken Houghton - September 8, 2003
This white paper will discuss the benefits and pitfalls of Vulnerability Scanning and will suggest an approach suitable for small and medium-sized businesses, as well as discussing the possibility of buying this as a service from a specialist agency.
Assessing Threats To Information Security In Financial Institutions by Cynthia Bonnette - August 8, 2003
This paper explores key issues related to threat assessment, including essential elements, methodologies, and common pitfalls, along with a recommended approach for completing and documenting this activity.
Printer Insecurity: Is it Really an Issue? by Vernon Vail - August 8, 2003
This document starts with a brief look at basic system and network security principles, continues with the revealing of some printer threats and vulnerabilities, and ends with a discussion about how to deal with the issue.
Anatomy of an IP Fragmentation Vulnerability in Linux IPChains: Investigating Common Vulnerabilities and Exposures (CVE) Candidate Vulnerability CAN-1 by Karim Sobhi - July 14, 2003
This paper investigates a potential IP fragmentation vulnerability in Linux IPChains.
Vulnerability naming schemes and description languages: CVE, Bugtraq, AVDL and VulnXML by Michael Rohse - May 30, 2003
These limitations inspired two new proposals: AVDL (Application Vulnerability Description Language) and VulnXML. With them it will be possible to directly import a describing XML document into a scanning tool and the tool will generate and launch the vulnerability scan. AVDL and VulnXML will be described and discussed in this paper.
10 Vulnerabilities a Scanner Might Not Find by Jeffrey King - May 12, 2003
This paper particularly serves as a resource to those who are new to the information assurance field, and provides an insight to two common protocols used in Internet security.
Beyond Conventional Terrorism...The Cyber Assault by Rajeev Puran - April 6, 2003
The text presented in this practical write up is established to review the various intents, events, acts and possibilities of computing technology based terrorism and warfare.
Worms as Attack Vectors: Theory, Threats, and Defenses by Matthew Todd - February 22, 2003
This paper provides a brief discussion of what constitutes a typical worm, along with a brief history, reasons they may be released, and who might gain from their use.
How do we define Responsible Disclosure? by Stephen Shepherd - February 19, 2003
This paper explores some key events in vulnerability disclosure, the conceptual differences between full disclosure, nondisclosure, limited disclosure and responsible disclosure, then examines some existing disclosure policies and proposed standards.
Security for Online Transaction Processing in a White Label Financial Switch by Fabian Soler - December 28, 2002
White label financial switches have introduced automatic banking machines (ABMs) in niche markets by taking advantage of cheap modern network and PC technology.
A New Generation of File Sharing Tools by Dan Klinedinst - December 15, 2002
Excessive file sharing can have serious effects on a variety of organizations, from lost revenue to lost productivity and wasted resources.
Large Scale Network Incidents - What Can We Do? by Jay Garden - December 10, 2002
This paper looks into the similarities between the two types of attacks and discusses ways to mitigate the risk from an Internet-wide perspective.
Potential Vulnerabilities of Timbuktu Remote Control Software by David Batz - October 9, 2002
This paper is neither for nor against the use of Timbuktu software as a Windows Remote Access /Remote Control solution, however, there are a number of potentially serious vulnerabilities that may be encountered through the use of the product.
Cyber Scam Artists: A New Kind of .con by Robert Fried - June 12, 2002
This paper will closely examine the emergence of the fraudster into cyberspace and analyze the steps being taken to help deal with the issue of online fraud.
Buffer Overflows for Dummies by Josef Nelißen - May 1, 2002
This paper tries to fill the gap between Buffer Overflows and errors within program source code, providing an in-depth discussion on stack smashing, frame pointer overwrite, return-into-libc, heap based overflow techniques and possible countermeasures.
SSL Man-in-the-Middle Attacks by Peter Burkholder - February 1, 2002
This paper examines the mechanics of the SSL protocol attack, then focuses on the greater risk of SSL attacks when the client is not properly implemented or configured.
The Instant Messaging Menace: Security Problems in the Enterprise and Some Solutions by Dan Frase - January 31, 2002
In this paper, the security threats posed by the use of consumer grade instant messaging clients in the enterprise, including privacy and identity issues are discussed, along with malware and bug vulnerabilities.
Cross-Sight Scripting Vulnerabilities by Mark Shiarla - January 9, 2002
This paper states that cross-site scripting is a potential risk for most Web servers.
ICMP Attacks Illustrated by Christopher Low - December 11, 2001
This paper shows how ICMP can and has been used in many phases of an attacker's advance in a system compromise.
Remote Access White Paper by Ken Stasiak - November 28, 2001
This paper looks at remote access security issues, pointing to how remote access solution can reduce administration time and increase security.
Internal Threat - Risks and Countermeasures by Jarvis Robinson - November 15, 2001
This paper cover the risks associated with insider threat, and provides practical counter-measures, which should challenge the reader to focus on the people and processes that protect information rather than technology.
Address Resolution Protocol Spoofing and Man-in-the-Middle Attacks by Robert Wagner - September 27, 2001
This paper is designed to introduce and explain ARP spoofing.
Analysis of FTP Hijack by Phong Huynh - September 19, 2001
This paper demonstrates how historical lessons can improve our skills as InfoSec professionals and can be used as a platform for management to understand the technology solutions we are proposing.
Outsourcing and the Increased Dangers of 'Dial Up' Access by Paul Jenkinson - September 15, 2001
The objective this paper is to highlight how the current trend of outsourcing support services can dangerously augment the already well-known issues surrounding dial up access to a corporate network.
Spoofed IP Address Distributed Denial of Service Attacks: Defense-in-Depth by Steven Bass - September 12, 2001
The purpose of this paper is to look at a defense-in-depth approach to spoofed IP address DDoS attacks, including known defenses, new techniques, and recent developments.
Free InfoSec Training, Compliments of History by Chris Bachmann - August 21, 2001
This paper Demonstrates how historical lessons can be used as a platform for management to understand the technology solutions we are proposing and how historical lessons can improve our skills as InfoSec professionals.
Peer-to-Peer Security and Intel's Peer-to-Peer Trusted Library by Chris McKean - August 20, 2001
Intel has released a code library that software developers can use to strengthen the security of, and add "trust" to new peer-to-peer applications, examined in this paper.
Instant Messaging: How Secure Is It? by Susan Willner - August 19, 2001
This paper describes Instant Messaging, a popular method of communication, although there are some security issues that should be considered.
The Changing Face of Distributed Denial of Service Mitigation by Justin Stephen - August 16, 2001
This paper reviews traditional best practices and tools for DDoS mitigation, discusses the inherent weaknesses of these best practices, the developing legal issues and trends that may soon be forcing change on how DDoS attacks are combated, and looks at the new generation of tools becoming available for mitigating these attacks.
Defending Against Code Red II Using Symantec NetProwler and Intruder Alert, ddos by Kenneth Donze - August 15, 2001
In this paper I will address the use of Symantec's NetProwler, network based IDS (NIDS), and Intruder Alert, host based IDS (HIDS), to detect and react to the Code Red II worm.today.
Electromagnetic Attack: Is Your Infrastructure and Data at Risk? by Michael Hayden - August 10, 2001
Attack of the infrastructure by way of radio frequency devices is technically possible and has been demonstrated on a small scale.
Unicode Vulnerability - How & Why? by Andrew Brannan - August 7, 2001
This paper discusses the power and flexibility of the Unicode vulnerability make it one of the most popular, and therefore dangerous, vulnerabilities currently used by attackers today.
An Overview of Gnutella by Brenda Batkins - July 27, 2001
This document addresses origins of Gnutella, what it is and how it works as well as some Gnutella-compatible software, along with possible security concerns.
Cyber-stalking, Privacy Intrusion at It's Scariest by Pamela Valentine - July 27, 2001
This paper describes Cyber-stalking and what you can do, or not do, to prevent it.
Vulnerability Assessments: The Pro-active Steps to Secure Your Organization by Robert Boyce - July 12, 2001
This paper provides an in-depth look at vulnerability assessments and discusses pro-active steps to secure your organization.
Kernel Rootkits by Dino Zovi - July 4, 2001
This paper provides an in-depth discussion on kernel rootkits.
Big Brother is Watching: An Update on Web Bugs by Steve Nichols - July 3, 2001
This paper discusses various types of script and executable web bugs that can retrieve almost any information the programmer wishes to obtain from the user's computer.
Aspects of Biological Evolution and Their Implications for Unix Computer Security by Michael Folsom - July 3, 2001
This paper presents aspects of biological evolution and their implications for Unix computer security.
Spoofing: An Overview of Some the Current Spoofing Threats by Neil Riser - July 1, 2001
This paper introduces and explains four forms of information spoofing: IP, ARP, Web, and DNS.
FTP and the Warez Scene by Shelli Crocker - December 14, 2000
Although software theft via FTP is very common, the risk of FTP abuse can be reduced by scanning networks for anonymous FTP sites, monitoring FTP activity, and securing FTP server configuration.
Introduction to IP Spoofing by Victor Velasco - November 21, 2000
This paper describes the use of IP spoofing as a method of attacking a network in order to gain unauthorized access.
Why Bother About BIOS Security? by Robert Allgeuer -
This paper gives: an overview of the BIOS and its functions; a detailed discussion of known threats to the BIOS and the hardware of a PC - as well as how they could be exploited; and, finally, countermeasures that can mitigate the risks
Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact firstname.lastname@example.org.
All papers are copyrighted. No re-posting or distribution of papers is permitted.