20 Security Testing

Early computer systems rarely worried about security.
Phone phreaks showed the need for security before the internet.
Morris Worm 1988
Golly, we need to protect our computer systems after all.

For security, there is an intelligent adversary.
You must protect ALL weak points; especially the ones you do not know about.

Hackers: white hat, black hat, grey hat
(Many attacks now come from people looking for money; e.g. ransomware)

Have a backup!
Backup data, and have a backup way of providing service.
Hard to protect against users who are careless!

Security is:
confidentiality, integrity, and availability
kept secret, cannot be changed, and ready to use 
active versus passive attacks
interruption, denial of service, 
interception, key logging, packet sniffing
modification, fabrication

Most attacks exploit a vulnerability

Types of malware:
Bacteria: (excessive user)
Fork bomb: (bacteria that forks itself)
Logic bomb: (unauthorized function)
Trapdoor: (secret access)
Trojan Horse: (trick users into using)
Virus:(small self replicating, started by human action)
Worm: (replicates itself withoutintervention,  once started)
Zombie: (A computer which has unauthorized users who have access to control it)
Bot network: (collection of zombies controlled by a master)
Spyware: (monitors the actions of the user)
DoS Tools: (Tools which enable denial of service attacks)
Ransomware: (Software which does something, and demands ransom to undo it)
Adware:(software that keeps giving you ads on your system)