What incidentlevel would this situation be classified as?
Darren is the network administrator for Greyson & Associates, a large law firm in Houston. Darren is responsible for all network functions as well as any digital forensics work that is needed. Darren is examining the firewall logs onemorning and notices some unusual activity. He traces the activity target to one of the firm�s internal file servers and finds that many documents on that server were destroyed. After performing some calculations, Darren finds the damageto be around $75,000 worth of lost data. Darren decides that this incident should be handled and resolved within the same day of its discovery. What incidentlevel would this situation be classified as?
What is the correct action to be taken by Rebecca in this situation as a recommendation to management?
Rebecca is a security analyst and knows of a local root exploit that has the ability to enable local users to use available exploits to gain root privileges. This vulnerability exploits a condition in the Linux kernel within the execve() system call. There is no known workaround that exists for this vulnerability. What is the correct action to be taken by Rebecca in this situation as a recommendation to management?
How was Bill able to get Internet access without using an agency laptop?
Hampton is the senior security analyst for the city of Columbus in Ohio. His primary responsibility is to ensure that all physical and logical aspects of the city’s computer network are secure from all angles. Bill is an IT technician that works with Hampton in the same IT department. Bill’s primary responsibility is to keep PC’s and servers up to date and to keep track of all the agency laptops that the company owns and lends out to its employees. After Bill setup a wireless network for the agency, Hampton made sure that everything was secure. He instituted encryption, rotating keys, turned off SSID broadcasting, and enabled MAC filtering. According to agency policy, only company laptops are allowed to use the wireless network, so Hampton entered all the MAC addresses for those laptops into the wireless security utility so that only those laptops should be able to access the wireless network.
Hampton does not keep track of all the laptops, but he is pretty certain that the agency only purchases Dell laptops. Hampton is curious about this because he notices Bill working on a Toshiba laptop one day and saw that he was on the Internet. Instead of jumping to conclusions, Hampton decides to talk to Bill’s boss and see if they had purchased a Toshiba laptop instead of the usual Dell. Bill’s boss said no, so now Hampton is very curious to see how Bill is accessing the Internet. Hampton does site surveys every couple of days, and has yet to see any outside wireless network signals inside the company’s building.
How was Bill able to get Internet access without using an agency laptop?
How would you resolve this situation?
You are the Security Administrator of Xtrinity, Inc. You write security policies and conduct assesments to protect the company’s network. During one of your periodic checks to see how well policy is being observed by the employees, you discover an employee has attached a modem to his telephone line and workstation. He has used this modem to dial in to his workstation, thereby bypassing your firewall. A security breach has occurred as a direct result of this activity. The employee explains that he used the modem because he had to download software for a department project. How would you resolve this situation?
What is a good example of a programming error that Bob can use to explain to the management how encryption wil
Bob has a good understanding of cryptography, having worked with it for many years. Cryptography is used to secure data from specific threats, but it does not secure the application from coding errors. It can provide data privacy; integrity and enable strong authentication but it cannot mitigate programming errors. What is a good example of a programming error that Bob can use to explain to the management how encryption will not address all their security concerns?
How can you modify your scan to prevent triggering this event in the IDS?
While performing ping scans into a target network you get a frantic call from the organization’s security team. They report that they are under a denial of service attack. When you stop your scan, the smurf attack event stops showing up on the organization’s IDS monitors. How can you modify your scan to prevent triggering this event in the IDS?
What technique could Harold use to sniff his agency's switched network?
Harold is the senior security analyst for a small state agency in New York.He has no other security professionals that work under him, so he has to do all the security-related tasks for the agency.Coming from a computer hardware background, Harold does not have a lot of experience with security methodologies and technologies, but he was the only one who applied for the position.
Harold is currently trying to run a Sniffer on the agency’s network to get an idea of what kind of traffic is being passed around, but the program he is using does not seem to be capturing anything.He pours through the Sniffer’s manual, but cannot find anything that directly relates to his problem.Harold decides to ask the network administrator if he has any thoughts on the problem.Harold is told that the Sniffer was not working because the agency’s network is a switched network, which cannot be sniffed by some programs without some tweaking.
What technique could Harold use to sniff his agency’s switched network?
Why did the 14 character passwords not take much longer to crack than the 8 character passwords?
Harold works for Jacobson Unlimited in the IT department as the security manager. Harold has created a security policy requiring all employees to use complex 14 character passwords. Unfortunately, the members of management do not want to have to use such long complicated passwords so they tell Harold’s boss this new password policy should not apply to them. To comply with the management’s wishes, the IT department creates another Windows domain and moves all the management users to that domain. This new domain has a password policy only requiring 8 characters.
Harold is concerned about having to accommodate the managers, but cannot do anything about it. Harold is also concerned about using LanManager security on his network instead of NTLM or NTLMv2, but the many legacy applications on the network prevent using the more secure NTLM and NTLMv2. Harold pulls the SAM files from the DC’s on the original domain and the new domain using Pwdump6.
Harold uses the password cracking software John the Ripper to crack users’ passwords to make sure they are strong enough.?Harold expects that the users’ passwords in the original domain will take much longer to crack than the management’s passwords in the new domain. After running the software, Harold discovers that the 14 character passwords only took a short time longer to crack than the 8 character passwords.
Why did the 14 character passwords not take much longer to crack than the 8 character passwords?
Which of the following operator in Google search will you use to achieve this?
You are footprinting the www.xsecurity.com domain using the Google search engine. You would like to determine what sites link to www.xsecurity.com at the first level of relevance. Which of the following operator in Google search will you use to achieve this?
Why was John not able to connect?
John is the network administrator for Frederickson Machinery in Tampa, Florida. Frederickson Machinery has one large office, and a number of smaller offices spread out around the city. John’s primary responsibility is to oversee the network equipment hat includes switches, routers, gateways and firewalls. John is the only employee allowed to make any changes or troubleshoot the network equipment so he has to run to any of the offices himself whenever there are any network issues. John is becoming more and more busy, so he wants to be able to remotely manage the network equipment as much as possible. He does not want to use telnet because of its inherent security flaws, so he decides to use SSH. John downloads a program from the Internet for SSH connections and attempts to connect to one of his routers at another office. After a short time, the following screen pops up on his computer:
Why was John not able to connect?