Featuring 87 Papers as of April 9, 2015
Insider Threats and the Need for Fast and Directed Response
by Dr. Eric Cole - April 9, 2015
- Associated Webcasts: Insider Threats and the Real Financial Impact to Organizations - A SANS Survey
- Sponsored By: SpectorSoft
This paper discusses the results of the 2015 SANS Insider Threat Survey. Written by Dr. Eric Cole, it examines the operational challenges of defending against malicious or negligent insiders and reviews the financial impact of insider attacks.
The Role of Static Analysis in Heartbleed
by Jeff Sass - February 12, 2015
Numbered security vulnerabilities known as Common Vulnerabilities and Exposures (CVEs), have been on the rise since the United States Computer Emergency Readiness Team (US-CERT) began tracking them in 1999.
Detecting Crypto Currency Mining in Corporate Environments
by Jan D'Herdt - February 4, 2015
Crypto currencies  such as Bitcoin, Dogecoin, Primecoin, Litecoin, Riecoin and many others are digital currencies that do not follow the normal set of rules for currencies as we know them.
Automated Defense - Using Threat Intelligence to Augment
by Paul Poputa-Clean - January 19, 2015
Threat Intelligence means different things to different people.
Point of Sale Systems and Security: Executive Summary
by Wes Whitteker - November 20, 2014
- Sponsored By: Bit9 + Carbon Black
The last year has seen scores of point of sale (POS) systems compromised by bad actors. In many cases, these environments were PCI-DSS compliant at the time of compromise. Executives seeking to protect their organizations and POS systems from compromise need to look beyond PCI-DSS and adopt a proactive "offense must inform defense" approach to POS security.
Creating a Threat Profile for Your Organization
by Stephen Irwin - October 2, 2014
Developing a detailed threat profile, provides organizations with a clear illustration of the threats that they face, and enables them to implement a proactive incident management program that focuses on the threat component of risk. Organizations are facing new types of advanced persistent threat (APT) scenarios that existing risk management programs are not able to evaluate completely and incident management programs are not able to defend against. This paper provides information about how to expand existing risk management models to better illustrate APTs and provides a framework on how to gather threat related information so that detailed threat profiles that include APTs can be developed for organizations.
Critical Security Controls: From Adoption to Implementation
by James Tarala - September 18, 2014
- Associated Webcasts: The Critical Security Controls: From Adoption to Implementation A SANS Survey
- Sponsored By: Qualys Tripwire, Inc. McAfee, a division of Intel Security EiQnetworks
This SANS survey report explores how widely the CSCs are being adopted, as well as what challenges adopters are facing in terms of implementation of the controls and what they are looking for to improve their implementation practices.
MalwareD: A study on network and host based defenses that prevent malware from accomplishing its goals.
by Dave Walters - September 17, 2014
Malware is an ever-growing problem on the Internet. Organizations struggle to prevent, detect, and responds to malware threats.
Insider Threats in Law Enforcement
by Dr. Eric Cole - September 4, 2014
Based on the valuable information they have at their disposal, law enforcement agencies are among those that are prime targets for advanced attacks. While network protection can be extensive and sophisticated, the exploitation of insiders poses a serious threat for illegal access to these agencies.
An Opportunity In Crisis
by Harshit Nayyar - June 3, 2014
As the cliche saying goes, 'The Chinese word for Crisis contains a symbol for Opportunity'.
Improving Security Management with Real-Time Queries
by Dave Shackleford - April 2, 2014
- Associated Webcasts: The Value of On-Demand Endpoint Visibility
- Sponsored By: McAfee, a division of Intel Security
Product review McAfee Real Time Command with a focus on features and ease of use. Examination of its security-related features found the product to be surprisingly intuitive.
DDoS Attacks Advancing and Enduring: A SANS Survey
by John Pescatore - March 20, 2014
Survey on the state of DDoS readiness reveals more frequent and sophisticated DDoS attacks as well as lack of preparedness in many enterprises.
Framework for building a Comprehensive Enterprise Security Patch Management Program
by Michael Hoehl - January 2, 2014
The concept of a patch is pretty straight forward and broadly understood. In business terms, patching is a form of quality control and defect repair.
SANS Security Analytics Survey
by Dave Shackleford - October 1, 2013
- Associated Webcasts: SANS Analytics and Intelligence Survey Results Part I: The Risk Landscape
- Sponsored By: Guidance Software LogRhythm Hewlett Packard SolarWinds Hexis Cyber Solutions
Survey on next generation of security tools shows that market is in need of analytics and intelligence wrapped around the data that is being/can be collected in organizations.
Scaling Analytics to Meet Real-Time Threats in Large Enterprises: A Deep Dive into LogRhythm's Security Analytics Platform
by Dave Shackleford - September 10, 2013
- Associated Webcasts: Under Pressure: Scaling Analytics to Meet Real-Time Threats
- Sponsored By: LogRhythm
Evaluation of LogRhythms real-time analytics capabilities.
How DDoS Detection and Mitigation Can Fight Advanced Targeted Attacks
by John Pescatore - September 5, 2013
Exploration of how DDoS is used as part of advanced targeted attacks (ATAs) and description of how DDoS detection and prevention tools and techniques can also be used against ATAs.
Protecting Small Business Banking
by Susan Bradley - July 22, 2013
Over the last several years, the use of online banking and other financial transactions have risen dramatically.
Implementing a Vulnerability Management Process
by Tom Palmaers - April 9, 2013
A vulnerability is defined in the ISO 27002 standard as "A weakness of an asset or group of assets that can be exploited by one or more threats" (International Organization for Standardization, 2005).
Beyond Continuous Monitoring: Threat Modeling for Real-time Response
by Mark Hardy - October 13, 2012
- Sponsored By: SecurityCoverage
Threat modeling, through timely and accurate inputs, can be used by enterprises to mitigate and defeat attack scenarios before they fully unfold.
Exploiting Financial Information Exchange (FIX) Protocol?
by Darren DeMarco - July 3, 2012
The FIX Protocol website defines The Financial Information eXchange ("FIX") Protocol as a series of messaging specifications for the electronic communication of trade-related messages (FIX Protocol Ltd, 2012).
Covert Channels Over Social Networks
by Jose Selvi - June 4, 2012
Today we live in a malware age, with the malware industry growing exponentially (AV-Test, 2012).
by Jim Lehman - May 31, 2012
Every minute of every day the web is searched, indexed and abused by web Robots; also known as Web Wanderers, Crawlers and Spiders.
APT Dot Gov: Protecting Federal Systems from Advanced Threats
by G. Mark Hardy - October 31, 2011
- Sponsored By: F5 Networks, Inc.
This paper describes advanced threats against federal and other governmental systems and provides advice on how to identify and protect the data at risk.
BYOB: Build Your Own Botnet
by Francois Begin - August 17, 2011
A recent report on botnet threats (Dhamballa, 2010) provides a sobering read for any security professional. According to its authors, the number of computers that fell victim to botnets grew at the rate of 8%/week in 2010, which translates to more than a six-fold increase over the course of the year.
Reducing Organizational Risk Through Virtual Patching
by Joseph Faust - January 11, 2011
Software patching for IT Departments across the organizational landscape has always been an integral part of maintaining functional, usable and stable software. Historically the traditional patch cycle has been focused on fixing or resolving issues which affect functionality. In recent years, with the advancement of more sophisticated and targeted threats which are occurring in quicker cycles, this focus is dramatically changing. (Risk Assessment Cisco, n.d.; Executive Office of The United States, 2005) . Corporations and Government now have a greater understanding of potential losses and expenses incurred by not maintaining application security and are moving towards an increased focus on patching and security (Epstein, Grow & Tschang, 2008). With organizations reputations, consumer confidence and corporate secrets at risk, corporations and government are recognizing the need to shift and address vulnerabilities at a much faster pace than they historically have done so (Chan, 2004). Over roughly the last ten years, the length of time between the documentation of a given vulnerability in a piece of software and the development of an actual exploit that can take advantage of the weakness in the application, has decreased tremendously. According to Andrew Jaquith, senior analyst at Yankee Group, the average time between vulnerability discovery and the release of exploit code is less than one week. (Shrinking time from, 2006). It has also been identified that 99% of intrusions result from exploitation of known vulnerabilities or configuration errors where countermeasures were available ("Risk reduction and.," 2010) . Clearly these statistics alone can prove daunting for many businesses trying to keep pace and maintain proper defenses against the bad guys.
Malicious Android Applications: Risks and Exploitation
by Joany Boutet - December 22, 2010
Android is an open-source mobile operating system, based upon a modified version of the Linux kernel, initially developed by Android Inc., a firm purchased by Google in 2005. A Gartner study released on November 2010 outlined that Android has become the second-most popular OS in the world (Gartner, 11/2010). The growth of Android has exceeded their previous study, released last year, in which they had predicted that Android will be the No.2 worldwide mobile operating system in 2012 (The H, 08/10/2009). According to another Gartner study (Gartner, 08/2010)., there will be only a slight difference between Symbian and Android market share in 2014: 30.2% for Symbian against 29.6% for Android.
USB - Ubiquitous Security Backdoor
by Erik Couture - August 25, 2009
The Universal Serial Bus (USB) is an omnipresent data and peripheral communication port that poses a security threat in any modern computing environment. Proposed is a holistic approach to USB port-security, examining the problem from user requirements definition to organizational threat-risk assessment and finally technical and procedural-based risk mitigation.
Threat Analysis of Allowing Employee Internet Access
by Mason Pokladnik - March 28, 2008
The ISO 17799/27001 standard provides a good minimum description of what organizations should be doing to protect themselves, but it should not be the sole focus of your security and audit control design. A better approach is to allow your information-security management-system subcommittees or technical specialists to analyze the threats your organization is likely to face. Then, design your controls around those threats, balancing the cost to mitigate a threat versus the cost of a threat occurring in your environment. Finally, after you have analyzed the threats, you can double check your policies and procedures against a regulatory or management framework, such as ISO17799, SOX, GLBA, HIPPA or PCI.
Attack vs. Defense on an Organizational Scale
by Omar Fink - December 11, 2007
Historically, the motivation behind most cyber attacks was similar to graffiti, in that the main purpose was to make a mark on somebody elses territory, to demonstrate technical skill by compromising a web server and defacing the main page, with the primary goal seeming to be simply to make a statement of existence. In recent years, this has evolved to being more concerned about making a profit or creating a political impact.
ANI vulnerability: History repeats
by Shashank Gonchigar - October 24, 2007
Animated cursors (.ani files) are used to change the appearance of the mouse pointer to an animation. Common example would be Mouse pointer turning into hour glass when the processor is busy. In the month of March 2007 a quite severe vulnerability was announced. It was subsequently exploited because of a flaw in the code which handled these files. This paper is a discussion about the ANI header buffer overflow vulnerability (Microsoft Security Bulletin MS07-017 - CVE-2007-0038). As we progress, we will understand what caused this vulnerability, analyze an exploit (PoC), understand the heap spraying technique employed by this exploit and finish with the incident handling process.
A System of Persistent Baseline Automated Vulnerability Scanning and Response in a Distributed University Environment
by Chet Langin - September 18, 2007
This paper describes and analyzes a persistent automated baseline vulnerability scanning procedure in a university (The University), including preparation, response, and follow up procedures. A Ruby script called run_nxscan.rb, written by the author, runs the nxscan scanning tool (York University, 2007) and processes the output. But this paper is more about the overall system used than just about a script and the nxscan tool. See Wack, Tracy, and Souppaya (2003) for a list of some other vulnerability scanning tools.
Malware Analysis: Environment Design and Artitecture
by Adrian Sanabria - August 2, 2007
The goal of this paper is to discuss the architecture and design necessary to create an effective malware analysis lab environment, and to explore possibilities beyond the traditional two or three system VM-based lab.
Visually Assessing Possible Courses of Action for a Computer Network Incursion
by Grant Vandenberghe - June 15, 2007
This study has suggested that an additional course of action step be added to the incident handling process. This addition would require that an incident handler identify the effects of his action before disrupting ongoing commercial or military operations.
A Survey of Wireless Mesh Networking Security Technology and Threats
by Anthony Gerkis - October 18, 2006
This paper will summarize the technologies and challenges related to wireless mesh networks.
Exploiting BlackICE When a Security Product has a Security Flaw
by Peter Gara - July 9, 2005
This paper contains a fictional story about a computer expert who gets into evil ways and tries to denigrate his ex-colleague at her new workplace.
A Spyware Survival Toolkit
by Peter McGranaghan - May 17, 2005
This paper will discuss the sources of spyware, the types of spyware, and methods of prevention, detection, and removal of spyware.
What is Santy bringing you this year?
by Pieter Danhieux - May 5, 2005
This early and evil "Santa Claus" present caused some serious havoc for administrators of phpBB bulletin board software around Christmas 2004, defacing almost 40 thousand phpBB sites in a short period.
Phishing: An Analysis of a Growing Problem
by Anthony Elledge - July 25, 2004
Email has become an invaluable communication tool for both business and personal use. Among the many security issues that now affect computer users, there is a growing threat known as "phishing".
Electronic Toll Collection
by Don Flint - July 25, 2004
Since 1992 active Radio Frequency Identification (RFID) tags have been used in vehicles to automate the toll process on toll roads, bridges, and tunnels in a process called Electronic Toll Collection (ETC). These tags are mounted to the windshield or externally surrounding the license plate on a vehicle and read as the vehicle proceeds without stopping through special lanes at the toll plaza.
Risk-Eye for the IT Security Guy
by Thomas Siu - May 2, 2004
An enterprise risk management workflow model is presented to illustrate the `big picture' of risk management, the key to developing a "keen eye" for IT security risks as a part of the overall IT management doctrine.
Skimming and Its Side Effects
by Nobie Cleaver - March 9, 2004
What I have learned in my research has truly amazed me and I endeavor to share some of that information in this paper. I will define skimming, describe what a skimming device may look like, discuss how skimming is done, provide some statistical information and provide some pointers on how to avoid being skimmed and what to do if it happens.
Vulnerability Management: Tools, Challenges and Best Practices
by Cathleen Brackin - December 13, 2003
This paper will outline the key steps to Vulnerability Management, and provide an in-depth look at the tools, challenges and best practices of each part of the VM lifecycle.
Managing vulnerabilities exposed by Windows services.
by James Williams - November 6, 2003
This paper looks at the vulnerabilities exposed by Windows services, how and why these risks occur, identify the tools for manipulating Windows services, and provide solutions to secure these identified vulnerabilities.
Corporate Anti-Virus Protection - A Layered Approach
by Elizabeth Peyton - November 6, 2003
This paper offers a "defense-in-depth" solution for large enterprises and corporations where there may be thousands of entry points through which viruses can enter, causing possible system damage and information theft or loss.
Examining the RPC DCOM Vulnerability: Developing a Vulnerability-Exploit Cycle
by Kevin OShea - October 6, 2003
This paper proposes to build on the vulnerability life-cycle work first proposed by Arbaugh, Fithen and McHughi to establish a detailed framework for vulnerability analysis.
Vulnerabilities &; Vulnerability Scanning
by Ken Houghton - September 8, 2003
This white paper will discuss the benefits and pitfalls of Vulnerability Scanning and will suggest an approach suitable for small and medium-sized businesses, as well as discussing the possibility of buying this as a service from a specialist agency.
Assessing Threats To Information Security In Financial Institutions
by Cynthia Bonnette - August 8, 2003
This paper explores key issues related to threat assessment, including essential elements, methodologies, and common pitfalls, along with a recommended approach for completing and documenting this activity.
Printer Insecurity: Is it Really an Issue?
by Vernon Vail - August 8, 2003
This document starts with a brief look at basic system and network security principles, continues with the revealing of some printer threats and vulnerabilities, and ends with a discussion about how to deal with the issue.
Anatomy of an IP Fragmentation Vulnerability in Linux IPChains: Investigating Common Vulnerabilities and Exposures (CVE) Candidate Vulnerability CAN-1
by Karim Sobhi - July 14, 2003
This paper investigates a potential IP fragmentation vulnerability in Linux IPChains.
Vulnerability naming schemes and description languages: CVE, Bugtraq, AVDL and VulnXML
by Michael Rohse - May 30, 2003
These limitations inspired two new proposals: AVDL (Application Vulnerability Description Language) and VulnXML. With them it will be possible to directly import a describing XML document into a scanning tool and the tool will generate and launch the vulnerability scan. AVDL and VulnXML will be described and discussed in this paper.
10 Vulnerabilities a Scanner Might Not Find
by Jeffrey King - May 12, 2003
This paper particularly serves as a resource to those who are new to the information assurance field, and provides an insight to two common protocols used in Internet security.
Beyond Conventional Terrorism...The Cyber Assault
by Rajeev Puran - April 6, 2003
The text presented in this practical write up is established to review the various intents, events, acts and possibilities of computing technology based terrorism and warfare.
Worms as Attack Vectors: Theory, Threats, and Defenses
by Matthew Todd - February 22, 2003
This paper provides a brief discussion of what constitutes a typical worm, along with a brief history, reasons they may be released, and who might gain from their use.
How do we define Responsible Disclosure?
by Stephen Shepherd - February 19, 2003
This paper explores some key events in vulnerability disclosure, the conceptual differences between full disclosure, nondisclosure, limited disclosure and responsible disclosure, then examines some existing disclosure policies and proposed standards.
Security for Online Transaction Processing in a White Label Financial Switch
by Fabian Soler - December 28, 2002
White label financial switches have introduced automatic banking machines (ABMs) in niche markets by taking advantage of cheap modern network and PC technology.
A New Generation of File Sharing Tools
by Dan Klinedinst - December 15, 2002
Excessive file sharing can have serious effects on a variety of organizations, from lost revenue to lost productivity and wasted resources.
Large Scale Network Incidents - What Can We Do?
by Jay Garden - December 10, 2002
This paper looks into the similarities between the two types of attacks and discusses ways to mitigate the risk from an Internet-wide perspective.
Potential Vulnerabilities of Timbuktu Remote Control Software
by David Batz - October 9, 2002
This paper is neither for nor against the use of Timbuktu software as a Windows Remote Access /Remote Control solution, however, there are a number of potentially serious vulnerabilities that may be encountered through the use of the product.
Cyber Scam Artists: A New Kind of .con
by Robert Fried - June 12, 2002
This paper will closely examine the emergence of the fraudster into cyberspace and analyze the steps being taken to help deal with the issue of online fraud.
Buffer Overflows for Dummies
by Josef Nelißen
- May 1, 2002
This paper tries to fill the gap between Buffer Overflows and errors within program source code, providing an in-depth discussion on stack smashing, frame pointer overwrite, return-into-libc, heap based overflow techniques and possible countermeasures.
SSL Man-in-the-Middle Attacks
by Peter Burkholder - February 1, 2002
This paper examines the mechanics of the SSL protocol attack, then focuses on the greater risk of SSL attacks when the client is not properly implemented or configured.
The Instant Messaging Menace: Security Problems in the Enterprise and Some Solutions
by Dan Frase - January 31, 2002
In this paper, the security threats posed by the use of consumer grade instant messaging clients in the enterprise, including privacy and identity issues are discussed, along with malware and bug vulnerabilities.
Cross-Sight Scripting Vulnerabilities
by Mark Shiarla - January 9, 2002
This paper states that cross-site scripting is a potential risk for most Web servers.
ICMP Attacks Illustrated
by Christopher Low - December 11, 2001
This paper shows how ICMP can and has been used in many phases of an attacker's advance in a system compromise.
Remote Access White Paper
by Ken Stasiak - November 28, 2001
This paper looks at remote access security issues, pointing to how remote access solution can reduce administration time and increase security.
Internal Threat - Risks and Countermeasures
by Jarvis Robinson - November 15, 2001
This paper cover the risks associated with insider threat, and provides practical counter-measures, which should challenge the reader to focus on the people and processes that protect information rather than technology.
Address Resolution Protocol Spoofing and Man-in-the-Middle Attacks
by Robert Wagner - September 27, 2001
This paper is designed to introduce and explain ARP spoofing.
Analysis of FTP Hijack
by Phong Huynh - September 19, 2001
This paper demonstrates how historical lessons can improve our skills as InfoSec professionals and can be used as a platform for management to understand the technology solutions we are proposing.
Outsourcing and the Increased Dangers of 'Dial Up' Access
by Paul Jenkinson - September 15, 2001
The objective this paper is to highlight how the current trend of outsourcing support services can dangerously augment the already well-known issues surrounding dial up access to a corporate network.
Spoofed IP Address Distributed Denial of Service Attacks: Defense-in-Depth
by Steven Bass - September 12, 2001
The purpose of this paper is to look at a defense-in-depth approach to spoofed IP address DDoS attacks, including known defenses, new techniques, and recent developments.
Free InfoSec Training, Compliments of History
by Chris Bachmann - August 21, 2001
This paper Demonstrates how historical lessons can be used as a platform for management to understand the technology solutions we are proposing and how historical lessons can improve our skills as InfoSec professionals.
Peer-to-Peer Security and Intel's Peer-to-Peer Trusted Library
by Chris McKean - August 20, 2001
Intel has released a code library that software developers can use to strengthen the security of, and add "trust" to new peer-to-peer applications, examined in this paper.
Instant Messaging: How Secure Is It?
by Susan Willner - August 19, 2001
This paper describes Instant Messaging, a popular method of communication, although there are some security issues that should be considered.
The Changing Face of Distributed Denial of Service Mitigation
by Justin Stephen - August 16, 2001
This paper reviews traditional best practices and tools for DDoS mitigation, discusses the inherent weaknesses of these best practices, the developing legal issues and trends that may soon be forcing change on how DDoS attacks are combated, and looks at the new generation of tools becoming available for mitigating these attacks.
Defending Against Code Red II Using Symantec NetProwler and Intruder Alert, ddos
by Kenneth Donze - August 15, 2001
In this paper I will address the use of Symantec's NetProwler, network based IDS (NIDS), and Intruder Alert, host based IDS (HIDS), to detect and react to the Code Red II worm.today.
Electromagnetic Attack: Is Your Infrastructure and Data at Risk?
by Michael Hayden - August 10, 2001
Attack of the infrastructure by way of radio frequency devices is technically possible and has been demonstrated on a small scale.
Unicode Vulnerability - How & Why?
by Andrew Brannan - August 7, 2001
This paper discusses the power and flexibility of the Unicode vulnerability make it one of the most popular, and therefore dangerous, vulnerabilities currently used by attackers today.
An Overview of Gnutella
by Brenda Batkins - July 27, 2001
This document addresses origins of Gnutella, what it is and how it works as well as some Gnutella-compatible software, along with possible security concerns.
Cyber-stalking, Privacy Intrusion at It's Scariest
by Pamela Valentine - July 27, 2001
This paper describes Cyber-stalking and what you can do, or not do, to prevent it.
Vulnerability Assessments: The Pro-active Steps to Secure Your Organization
by Robert Boyce - July 12, 2001
This paper provides an in-depth look at vulnerability assessments and discusses pro-active steps to secure your organization.
by Dino Zovi - July 4, 2001
This paper provides an in-depth discussion on kernel rootkits.
Big Brother is Watching: An Update on Web Bugs
by Steve Nichols - July 3, 2001
This paper discusses various types of script and executable web bugs that can retrieve almost any information the programmer wishes to obtain from the user's computer.
Aspects of Biological Evolution and Their Implications for Unix Computer Security
by Michael Folsom - July 3, 2001
This paper presents aspects of biological evolution and their implications for Unix computer security.
Spoofing: An Overview of Some the Current Spoofing Threats
by Neil Riser - July 1, 2001
This paper introduces and explains four forms of information spoofing: IP, ARP, Web, and DNS.
FTP and the Warez Scene
by Shelli Crocker - December 14, 2000
Although software theft via FTP is very common, the risk of FTP abuse can be reduced by scanning networks for anonymous FTP sites, monitoring FTP activity, and securing FTP server configuration.
Introduction to IP Spoofing
by Victor Velasco - November 21, 2000
This paper describes the use of IP spoofing as a method of attacking a network in order to gain unauthorized access.
Why Bother About BIOS Security?
by Robert Allgeuer -
This paper gives: an overview of the BIOS and its functions; a detailed discussion of known threats to the BIOS and the hardware of a PC - as well as how they could be exploited; and, finally, countermeasures that can mitigate the risks
Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact firstname.lastname@example.org.
All papers are copyrighted. No re-posting or distribution of papers is permitted.