Reading Room


Featuring 70 Papers as of March 27, 2014

  • Framework for building a Comprehensive Enterprise Security Patch Management Program Masters Michael Hoehl - March 27, 2014

    The concept of a patch is pretty straight forward and broadly understood. In business terms, patching is a form of quality control and defect repair.

  • Protecting Small Business Banking Susan Bradley - August 8, 2013

    Over the last several years, the use of online banking and other financial transactions have risen dramatically.

  • Implementing a Vulnerability Management Process Tom Palmaers - April 16, 2013

    A vulnerability is defined in the ISO 27002 standard as "A weakness of an asset or group of assets that can be exploited by one or more threats" (International Organization for Standardization, 2005).

  • Exploiting Financial Information Exchange (FIX) Protocol? Darren DeMarco - July 3, 2012

    The FIX Protocol website defines The Financial Information eXchange ("FIX") Protocol as a series of messaging specifications for the electronic communication of trade-related messages (FIX Protocol Ltd, 2012).

  • Covert Channels Over Social Networks Jose Selvi - June 4, 2012

    Today we live in a malware age, with the malware industry growing exponentially (AV-Test, 2012).

  • Robots.txt Jim Lehman - May 31, 2012

    Every minute of every day the web is searched, indexed and abused by web Robots; also known as Web Wanderers, Crawlers and Spiders.

  • BYOB: Build Your Own Botnet Francois Begin - August 17, 2011

    A recent report on botnet threats (Dhamballa, 2010) provides a sobering read for any security professional. According to its authors, the number of computers that fell victim to botnets grew at the rate of 8%/week in 2010, which translates to more than a six-fold increase over the course of the year.

  • Reducing Organizational Risk Through Virtual Patching Masters Joseph Faust - January 11, 2011

    Software patching for IT Departments across the organizational landscape has always been an integral part of maintaining functional, usable and stable software. Historically the traditional patch cycle has been focused on fixing or resolving issues which affect functionality. In recent years, with the advancement of more sophisticated and targeted threats which are occurring in quicker cycles, this focus is dramatically changing. (Risk Assessment Cisco, n.d.; Executive Office of The United States, 2005) . Corporations and Government now have a greater understanding of potential losses and expenses incurred by not maintaining application security and are moving towards an increased focus on patching and security (Epstein, Grow & Tschang, 2008). With organizations reputations, consumer confidence and corporate secrets at risk, corporations and government are recognizing the need to shift and address vulnerabilities at a much faster pace than they historically have done so (Chan, 2004). Over roughly the last ten years, the length of time between the documentation of a given vulnerability in a piece of software and the development of an actual exploit that can take advantage of the weakness in the application, has decreased tremendously. According to Andrew Jaquith, senior analyst at Yankee Group, the average time between vulnerability discovery and the release of exploit code is less than one week. (Shrinking time from, 2006). It has also been identified that 99% of intrusions result from exploitation of known vulnerabilities or configuration errors where countermeasures were available ("Risk reduction and.," 2010) . Clearly these statistics alone can prove daunting for many businesses trying to keep pace and maintain proper defenses against the bad guys.

  • Malicious Android Applications: Risks and Exploitation Joany Boutet - December 22, 2010

    Android is an open-source mobile operating system, based upon a modified version of the Linux kernel, initially developed by Android Inc., a firm purchased by Google in 2005. A Gartner study released on November 2010 outlined that Android has become the second-most popular OS in the world (Gartner, 11/2010). The growth of Android has exceeded their previous study, released last year, in which they had predicted that Android will be the No.2 worldwide mobile operating system in 2012 (The H, 08/10/2009). According to another Gartner study (Gartner, 08/2010)., there will be only a slight difference between Symbian and Android market share in 2014: 30.2% for Symbian against 29.6% for Android.

  • USB - Ubiquitous Security Backdoor Masters Erik Couture - August 25, 2009

    The Universal Serial Bus (USB) is an omnipresent data and peripheral communication port that poses a security threat in any modern computing environment. Proposed is a holistic approach to USB port-security, examining the problem from user requirements definition to organizational threat-risk assessment and finally technical and procedural-based risk mitigation.

  • Threat Analysis of Allowing Employee Internet Access Masters Mason Pokladnik - March 28, 2008

    The ISO 17799/27001 standard provides a good minimum description of what organizations should be doing to protect themselves, but it should not be the sole focus of your security and audit control design. A better approach is to allow your information-security management-system subcommittees or technical specialists to analyze the threats your organization is likely to face. Then, design your controls around those threats, balancing the cost to mitigate a threat versus the cost of a threat occurring in your environment. Finally, after you have analyzed the threats, you can double check your policies and procedures against a regulatory or management framework, such as ISO17799, SOX, GLBA, HIPPA or PCI.

  • Attack vs. Defense on an Organizational Scale Omar Fink - December 11, 2007

    Historically, the motivation behind most cyber attacks was similar to graffiti, in that the main purpose was to make a mark on somebody elses territory, to demonstrate technical skill by compromising a web server and defacing the main page, with the primary goal seeming to be simply to make a statement of existence. In recent years, this has evolved to being more concerned about making a profit or creating a political impact.

  • ANI vulnerability: History repeats Shashank Gonchigar - October 24, 2007

    Animated cursors (.ani files) are used to change the appearance of the mouse pointer to an animation. Common example would be Mouse pointer turning into hour glass when the processor is busy. In the month of March 2007 a quite severe vulnerability was announced. It was subsequently exploited because of a flaw in the code which handled these files. This paper is a discussion about the ANI header buffer overflow vulnerability (Microsoft Security Bulletin MS07-017 - CVE-2007-0038). As we progress, we will understand what caused this vulnerability, analyze an exploit (PoC), understand the heap spraying technique employed by this exploit and finish with the incident handling process.

  • A System of Persistent Baseline Automated Vulnerability Scanning and Response in a Distributed University Environment Chet Langin - September 18, 2007

    This paper describes and analyzes a persistent automated baseline vulnerability scanning procedure in a university (The University), including preparation, response, and follow up procedures. A Ruby script called run_nxscan.rb, written by the author, runs the nxscan scanning tool (York University, 2007) and processes the output. But this paper is more about the overall system used than just about a script and the nxscan tool. See Wack, Tracy, and Souppaya (2003) for a list of some other vulnerability scanning tools.

  • Malware Analysis: Environment Design and Artitecture Adrian Sanabria - August 2, 2007

    The goal of this paper is to discuss the architecture and design necessary to create an effective malware analysis lab environment, and to explore possibilities beyond the traditional two or three system VM-based lab.

  • Visually Assessing Possible Courses of Action for a Computer Network Incursion Grant Vandenberghe - June 15, 2007

    This study has suggested that an additional course of action step be added to the incident handling process. This addition would require that an incident handler identify the effects of his action before disrupting ongoing commercial or military operations.

  • A Survey of Wireless Mesh Networking Security Technology and Threats Anthony Gerkis - October 18, 2006

    This paper will summarize the technologies and challenges related to wireless mesh networks.

  • Address Resolution Protocol Spoofing and Man-in-the-Middle Attacks Robert Wagner - August 11, 2006

    This paper is designed to introduce and explain ARP spoofing.

  • Exploiting BlackICE When a Security Product has a Security Flaw Peter Gara - July 9, 2005

    This paper contains a fictional story about a computer expert who gets into evil ways and tries to denigrate his ex-colleague at her new workplace.

  • A Spyware Survival Toolkit Peter McGranaghan - May 17, 2005

    This paper will discuss the sources of spyware, the types of spyware, and methods of prevention, detection, and removal of spyware.

  • What is Santy bringing you this year? Pieter Danhieux - May 5, 2005

    This early and evil "Santa Claus" present caused some serious havoc for administrators of phpBB bulletin board software around Christmas 2004, defacing almost 40 thousand phpBB sites in a short period.

  • Electronic Toll Collection Don Flint - July 25, 2004

    Since 1992 active Radio Frequency Identification (RFID) tags have been used in vehicles to automate the toll process on toll roads, bridges, and tunnels in a process called Electronic Toll Collection (ETC). These tags are mounted to the windshield or externally surrounding the license plate on a vehicle and read as the vehicle proceeds without stopping through special lanes at the toll plaza.

  • Phishing: An Analysis of a Growing Problem Anthony Elledge - July 25, 2004

    Email has become an invaluable communication tool for both business and personal use. Among the many security issues that now affect computer users, there is a growing threat known as "phishing".

  • Risk-Eye for the IT Security Guy Thomas Siu - May 2, 2004

    An enterprise risk management workflow model is presented to illustrate the `big picture' of risk management, the key to developing a "keen eye" for IT security risks as a part of the overall IT management doctrine.

  • Skimming and Its Side Effects Nobie Cleaver - March 9, 2004

    What I have learned in my research has truly amazed me and I endeavor to share some of that information in this paper. I will define skimming, describe what a skimming device may look like, discuss how skimming is done, provide some statistical information and provide some pointers on how to avoid being skimmed and what to do if it happens.

  • Vulnerability Management: Tools, Challenges and Best Practices Cathleen Brackin - December 13, 2003

    This paper will outline the key steps to Vulnerability Management, and provide an in-depth look at the tools, challenges and best practices of each part of the VM lifecycle.

  • Corporate Anti-Virus Protection - A Layered Approach Elizabeth Peyton - November 6, 2003

    This paper offers a "defense-in-depth" solution for large enterprises and corporations where there may be thousands of entry points through which viruses can enter, causing possible system damage and information theft or loss.

  • Managing vulnerabilities exposed by Windows services. James Williams - November 6, 2003

    This paper looks at the vulnerabilities exposed by Windows services, how and why these risks occur, identify the tools for manipulating Windows services, and provide solutions to secure these identified vulnerabilities.

  • Vulnerability naming schemes and description languages: CVE, Bugtraq, AVDL and VulnXML Michael Rohse - October 31, 2003

    These limitations inspired two new proposals: AVDL (Application Vulnerability Description Language) and VulnXML. With them it will be possible to directly import a describing XML document into a scanning tool and the tool will generate and launch the vulnerability scan. AVDL and VulnXML will be described and discussed in this paper.

  • Spoofing: An Overview of Some the Current Spoofing Threats Neil Riser - October 31, 2003

    This paper introduces and explains four forms of information spoofing: IP, ARP, Web, and DNS.

  • Anatomy of an IP Fragmentation Vulnerability in Linux IPChains: Investigating Common Vulnerabilities and Exposures (CVE) Candidate Vulnerability CAN-1 Karim Sobhi - October 31, 2003

    This paper investigates a potential IP fragmentation vulnerability in Linux IPChains.

  • Assessing Threats To Information Security In Financial Institutions Cynthia Bonnette - October 31, 2003

    This paper explores key issues related to threat assessment, including essential elements, methodologies, and common pitfalls, along with a recommended approach for completing and documenting this activity.

  • Printer Insecurity: Is it Really an Issue? Vernon Vail - October 31, 2003

    This document starts with a brief look at basic system and network security principles, continues with the revealing of some printer threats and vulnerabilities, and ends with a discussion about how to deal with the issue.

  • A New Generation of File Sharing Tools Dan Klinedinst - October 31, 2003

    Excessive file sharing can have serious effects on a variety of organizations, from lost revenue to lost productivity and wasted resources.

  • Security for Online Transaction Processing in a White Label Financial Switch Fabian Soler - October 31, 2003

    White label financial switches have introduced automatic banking machines (ABMs) in niche markets by taking advantage of cheap modern network and PC technology.

  • Large Scale Network Incidents - What Can We Do? Jay Garden - October 31, 2003

    This paper looks into the similarities between the two types of attacks and discusses ways to mitigate the risk from an Internet-wide perspective.

  • Worms as Attack Vectors: Theory, Threats, and Defenses Matthew Todd - October 31, 2003

    This paper provides a brief discussion of what constitutes a typical worm, along with a brief history, reasons they may be released, and who might gain from their use.

  • Beyond Conventional Terrorism...The Cyber Assault Rajeev Puran - October 31, 2003

    The text presented in this practical write up is established to review the various intents, events, acts and possibilities of computing technology based terrorism and warfare.

  • How do we define Responsible Disclosure? Stephen Shepherd - October 31, 2003

    This paper explores some key events in vulnerability disclosure, the conceptual differences between full disclosure, nondisclosure, limited disclosure and responsible disclosure, then examines some existing disclosure policies and proposed standards.

  • Vulnerabilities &; Vulnerability Scanning Ken Houghton - October 31, 2003

    This white paper will discuss the benefits and pitfalls of Vulnerability Scanning and will suggest an approach suitable for small and medium-sized businesses, as well as discussing the possibility of buying this as a service from a specialist agency.

  • Big Brother is Watching: An Update on Web Bugs Steve Nichols - October 31, 2003

    This paper discusses various types of script and executable web bugs that can retrieve almost any information the programmer wishes to obtain from the user's computer.

  • Aspects of Biological Evolution and Their Implications for Unix Computer Security Michael Folsom - October 31, 2003

    This paper presents aspects of biological evolution and their implications for Unix computer security.

  • Introduction to IP Spoofing Victor Velasco - October 31, 2003

    This paper describes the use of IP spoofing as a method of attacking a network in order to gain unauthorized access.

  • Kernel Rootkits Dino Zovi - October 31, 2003

    This paper provides an in-depth discussion on kernel rootkits.

  • Examining the RPC DCOM Vulnerability: Developing a Vulnerability-Exploit Cycle Kevin OShea - October 31, 2003

    This paper proposes to build on the vulnerability life-cycle work first proposed by Arbaugh, Fithen and McHughi to establish a detailed framework for vulnerability analysis.

  • Vulnerability Assessments: The Pro-active Steps to Secure Your Organization Robert Boyce - October 31, 2003

    This paper provides an in-depth look at vulnerability assessments and discusses pro-active steps to secure your organization.

  • An Overview of Gnutella Brenda Batkins - October 31, 2003

    This document addresses origins of Gnutella, what it is and how it works as well as some Gnutella-compatible software, along with possible security concerns.

  • Cyber-stalking, Privacy Intrusion at It's Scariest Pamela Valentine - October 31, 2003

    This paper describes Cyber-stalking and what you can do, or not do, to prevent it.

  • Unicode Vulnerability - How & Why? Andrew Brannan - October 31, 2003

    This paper discusses the power and flexibility of the Unicode vulnerability make it one of the most popular, and therefore dangerous, vulnerabilities currently used by attackers today.

  • Defending Against Code Red II Using Symantec NetProwler and Intruder Alert, ddos Kenneth Donze - October 31, 2003

    In this paper I will address the use of Symantec's NetProwler, network based IDS (NIDS), and Intruder Alert, host based IDS (HIDS), to detect and react to the Code Red II

  • The Changing Face of Distributed Denial of Service Mitigation Justin Stephen - October 31, 2003

    This paper reviews traditional best practices and tools for DDoS mitigation, discusses the inherent weaknesses of these best practices, the developing legal issues and trends that may soon be forcing change on how DDoS attacks are combated, and looks at the new generation of tools becoming available for mitigating these attacks.

  • Instant Messaging: How Secure Is It? Susan Willner - October 31, 2003

    This paper describes Instant Messaging, a popular method of communication, although there are some security issues that should be considered.

  • FTP and the Warez Scene Shelli Crocker - October 31, 2003

    Although software theft via FTP is very common, the risk of FTP abuse can be reduced by scanning networks for anonymous FTP sites, monitoring FTP activity, and securing FTP server configuration.

  • Peer-to-Peer Security and Intel's Peer-to-Peer Trusted Library Chris McKean - October 31, 2003

    Intel has released a code library that software developers can use to strengthen the security of, and add "trust" to new peer-to-peer applications, examined in this paper.

  • Spoofed IP Address Distributed Denial of Service Attacks: Defense-in-Depth Steven Bass - October 31, 2003

    The purpose of this paper is to look at a defense-in-depth approach to spoofed IP address DDoS attacks, including known defenses, new techniques, and recent developments.

  • Outsourcing and the Increased Dangers of 'Dial Up' Access Paul Jenkinson - October 31, 2003

    The objective this paper is to highlight how the current trend of outsourcing support services can dangerously augment the already well-known issues surrounding dial up access to a corporate network.

  • Analysis of FTP Hijack Phong Huynh - October 31, 2003

    This paper demonstrates how historical lessons can improve our skills as InfoSec professionals and can be used as a platform for management to understand the technology solutions we are proposing.

  • Free InfoSec Training, Compliments of History Chris Bachmann - October 31, 2003

    This paper Demonstrates how historical lessons can be used as a platform for management to understand the technology solutions we are proposing and how historical lessons can improve our skills as InfoSec professionals.

  • Internal Threat - Risks and Countermeasures Jarvis Robinson - October 31, 2003

    This paper cover the risks associated with insider threat, and provides practical counter-measures, which should challenge the reader to focus on the people and processes that protect information rather than technology.

  • Remote Access White Paper Ken Stasiak - October 31, 2003

    This paper looks at remote access security issues, pointing to how remote access solution can reduce administration time and increase security.

  • ICMP Attacks Illustrated Christopher Low - October 31, 2003

    This paper shows how ICMP can and has been used in many phases of an attacker's advance in a system compromise.

  • Cross-Sight Scripting Vulnerabilities Mark Shiarla - October 31, 2003

    This paper states that cross-site scripting is a potential risk for most Web servers.

  • The Instant Messaging Menace: Security Problems in the Enterprise and Some Solutions Dan Frase - October 31, 2003

    In this paper, the security threats posed by the use of consumer grade instant messaging clients in the enterprise, including privacy and identity issues are discussed, along with malware and bug vulnerabilities.

  • SSL Man-in-the-Middle Attacks Peter Burkholder - October 31, 2003

    This paper examines the mechanics of the SSL protocol attack, then focuses on the greater risk of SSL attacks when the client is not properly implemented or configured.

  • Buffer Overflows for Dummies Josef Nelien - October 31, 2003

    This paper tries to fill the gap between Buffer Overflows and errors within program source code, providing an in-depth discussion on stack smashing, frame pointer overwrite, return-into-libc, heap based overflow techniques and possible countermeasures.

  • Cyber Scam Artists: A New Kind of .con Robert Fried - October 31, 2003

    This paper will closely examine the emergence of the fraudster into cyberspace and analyze the steps being taken to help deal with the issue of online fraud.

  • Potential Vulnerabilities of Timbuktu Remote Control Software David Batz - October 31, 2003

    This paper is neither for nor against the use of Timbuktu software as a Windows Remote Access /Remote Control solution, however, there are a number of potentially serious vulnerabilities that may be encountered through the use of the product.

  • 10 Vulnerabilities a Scanner Might Not Find Jeffrey King - May 12, 2003

    This paper particularly serves as a resource to those who are new to the information assurance field, and provides an insight to two common protocols used in Internet security.

  • Electromagnetic Attack: Is Your Infrastructure and Data at Risk? Michael Hayden - August 10, 2001

    Attack of the infrastructure by way of radio frequency devices is technically possible and has been demonstrated on a small scale.

  • Why Bother About BIOS Security? Robert Allgeuer

    This paper gives: an overview of the BIOS and its functions; a detailed discussion of known threats to the BIOS and the hardware of a PC - as well as how they could be exploited; and, finally, countermeasures that can mitigate the risks

Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact

All papers are copyrighted. No re-posting or distribution of papers is permitted.

Masters This paper was created by a SANS Technology Institute student as part of their Master's curriculum.